CCDV-F Practice Questions: Security and Safety Domain

Correct answer (A): The malicious PDF is untrusted input and should not be allowed to override developer intent. Because the concrete risk is leakage through an export tool, the strongest primary control is deterministic output or tool-argument validation that blocks full source text from being exported.

Why the other options are wrong:
- Option B: Prompt ordering can help, but it does not guarantee that tool arguments will exclude confidential full text.
- Option C: Having Claude identify malicious text may help analysis, but it still relies on the model rather than enforcing the export boundary.
- Option D: Uppercase detection is brittle and would block benign documents while missing many prompt-injection variants.

Correct answer (A): Tool results can contain both sensitive data and adversarial content. The application should minimize what is returned to Claude by filtering to the authorized resource and only the fields needed for the task. This reduces PII exposure and limits the prompt injection surface from irrelevant records.

Why the other options are wrong:
- Option B: A warning prompt does not remove sensitive or malicious content from the model context.
- Option C: Final-answer redaction does not prevent exposure of unrelated PII and adversarial content to the model.
- Option D: A stronger model is not a complete defense against prompt injection or unnecessary sensitive data exposure.

Correct answer (A): The app needs operational diagnostics, but it should minimize sensitive data exposure. Redacting PII, limiting retention, and restricting access preserve debugging value while reducing privacy risk. Full prompt and trace logging with broad access and indefinite retention is unsafe for sensitive healthcare intake data.

Why the other options are wrong:
- Option B: A warning banner does not reduce exposure, retention risk, or broad access to sensitive patient data.
- Option C: Sending full logs to the model can further expose PII and is not the primary privacy control.
- Option D: Disabling all logs may harm reliability and incident response when a minimized, access-controlled logging design can meet the stated debug need.

Correct answer (A): Irreversible production deletion should not depend on the model's confidence statement. A deterministic pre-tool hook can enforce policy, verify that the requester and target are allowed, require human approval for the risky action, and support audit logging before the destructive tool executes.

Why the other options are wrong:
- Option B: A reasoning explanation may help review, but it is not an enforceable safety control for an irreversible action.
- Option C: A keyword is not authorization, approval, or validation and can be supplied by any user or injected text.
- Option D: Reducing latency does not address the safety risk of unauthorized or accidental destructive execution.

Correct answer (A): Security audit logs for Claude applications should capture relevant events such as identity context, access checks, tool invocations, approval decisions, and denied actions. They should avoid unnecessary storage of sensitive prompt or response content. This supports accountability while minimizing confidential data exposure.

Why the other options are wrong:
- Option B: Full prompt and tool-response logging may expose confidential financial data beyond what reviewers need.
- Option C: Final answers alone omit key security events such as tool invocations, access checks, and approval decisions.
- Option D: Database logs alone may not capture Claude-specific decisions, denied actions, or approval-gate outcomes.

Correct answer (A): This workflow combines untrusted input, confidential data, and an external high-impact action. The best production pattern is layered defense: treat email content as untrusted, limit tool permissions, and require deterministic approval before sending external messages. This preserves useful drafting while enforcing non-negotiable safety controls outside the model.

Why the other options are wrong:
- Option B: Draft-only mode avoids some risk, but it removes required functionality rather than enforcing the stated approval pattern for external sends.
- Option C: A classifier and prompt control can be useful layers, but they do not replace scoped tools and deterministic approval for external sending.
- Option D: A larger model and full email logging do not enforce approval and may increase confidential data exposure in audit logs.

Correct answer (A): Sensitive state-changing actions need auditable records showing who initiated the action, what authorization and approval checks occurred, what resource changed, and what result followed. Logging should be structured and access-controlled, not absent or based on model self-attestation.

Why the other options are wrong:
- Option B: Minimizing sensitive data is important, but storing only the final response prevents investigation of tool use and authorization decisions.
- Option C: Claude's after-the-fact opinion is not evidence that authorization occurred and does not create a reliable audit trail.
- Option D: Customer reports are reactive and do not provide authorized access monitoring or incident investigation capability.

Correct answer (A): Authentication and content filtering do not prove that a user is authorized for a specific sensitive resource. The application or backing service must enforce role-based authorization before the tool retrieves salary data.

Why the other options are wrong:
- Option B: A stricter content filter may reduce some unsafe outputs, but it does not verify access rights before data retrieval.
- Option C: Claude's judgment about the user's role is not a reliable authorization check for confidential HR data.
- Option D: A warning banner may inform users, but it does not prevent unauthorized tool access or data exposure.

Correct answer (A): Claude-connected tools should use least-privilege credentials scoped to the minimum resources and actions needed. If the feature only needs department-limited invoice reads, the service role should not have broad update, vendor, or payment creation permissions.

Why the other options are wrong:
- Option B: Claude's intended behavior is not an IAM boundary; broad credentials increase blast radius if the agent or integration is misused.
- Option C: A service role does not replace user authentication or action-specific authorization for sensitive finance data.
- Option D: Hiding details in responses does not prevent unauthorized backend actions such as updates or payment creation.

Correct answer (A): The vendor email is untrusted input and includes prompt-injection language. For a high-impact payment action, the application must enforce identity validation, access-level verification, and approval requirements before executing the tool. Since analysts can only draft payments and the amount exceeds the approval threshold, the safe action is to draft and require controller approval.

Why the other options are wrong:
- Option B: Claude should not determine whether approval exists for a high-impact financial action; approval must be verified deterministically.
- Option C: Authentication confirms the analyst's identity, but it does not grant permission to approve a high-value payment.
- Option D: A cleaner email does not solve the authorization and approval requirement for payment execution.