18 Integration & RAG Practice Questions & Answers

1. 1. A customer-support agent is deployed with tools for issuing refunds, deleting user accounts, and writing directly to the production database, but its actual job is only to read order status and update support tickets. According to the principle of least privilege, what is the BEST remediation?

   • A.Add a system-prompt instruction telling the agent never to use the dangerous tools
   • B.Remove the unneeded tools and grant only read-order and update-ticket capabilities✓ Answer
   • C.Rely on the model's safety training to refuse harmful tool calls
   • D.Keep all tools but log every invocation for later audit

   Least privilege means an agent should hold only the capabilities its task requires, because any tool the agent possesses can be triggered by model error or prompt injection regardless of instructions. Prompt-level guardrails and logging are compensating controls, not privilege reduction: a capability that does not exist cannot be abused.

   Source: MCP Specification — Security Best Practices (least privilege); CCAR-P Exam Guide Domain 3Report a problem with this question

2. 2. An enterprise agent is connected to 80 tools from six MCP servers, and its tool-selection accuracy has dropped noticeably. What is the most likely cause?

   • A.The MCP protocol caps reliable operation at 10 tools per server
   • B.Embedding drift in the model's weights caused by too many servers
   • C.Capability bloat: many overlapping tool definitions consume context and make similar tools harder to distinguish✓ Answer
   • D.Tool definitions are ignored by the model unless they are listed alphabetically

   Every tool definition is injected into the model's context, so a large, overlapping toolset both consumes tokens and forces the model to discriminate among many near-duplicate options, which measurably degrades selection accuracy. The fix is curating a smaller, well-scoped toolset or loading tools on demand; there is no protocol-level tool cap and no alphabetical requirement.

   Source: Claude Docs — Agents and Tools: tool use best practices (tool count and context cost); CCAR-P Exam Guide Domain 3Report a problem with this question

3. 3. A team gives their agent a long-lived admin API token because "it avoids permission errors." From an integration-security standpoint, why is this dangerous even if the agent's instructions are benign?

   • A.A prompt injection or model error can now exercise the token's full privileges, so blast radius equals the token's scope, not the task's scope✓ Answer
   • B.Admin tokens cannot be used over HTTPS transports
   • C.The token will expire and break the integration
   • D.Admin tokens are slower to validate, increasing latency

   An agent's effective privilege is whatever its credentials allow, not whatever its instructions intend; because agents process untrusted content, an injected instruction or hallucinated tool call can spend every privilege the token carries. Scoping credentials narrowly and making them short-lived bounds the worst-case damage to the task's actual needs.

   Source: MCP Specification — Security Best Practices (token scoping, confused deputy); CCAR-P Exam Guide Domain 3Report a problem with this question

4. 4. An MCP server authenticates each end user with OAuth, but then executes every tool call against the database using one shared service account that can read all customers' records. What is the security gap?

   • A.The database connection should use API keys instead of a service account
   • B.OAuth tokens cannot legally be used with MCP servers
   • C.Authorization is not propagated: any authenticated user can reach data at the service account's privilege level, a confused-deputy pattern✓ Answer
   • D.Authentication is missing because OAuth does not verify identity

   Knowing who the user is (authentication) is useless if every downstream call runs with a single high-privilege identity, because the resource layer can no longer distinguish which user is asking and enforce per-user access rules. Correct designs propagate the caller's identity or apply per-user authorization checks at the resource, so each request is limited to that user's own data.

   Source: MCP Specification — Authorization; Security Best Practices (confused deputy); CCAR-P Exam Guide Domain 3Report a problem with this question

5. 5. During a gap analysis, a reviewer notes: "The agent's backend verifies that the API key is valid, but never checks whether the requesting user is allowed to view the specific record returned." Which gap does this describe?

   • A.An observability gap: the system lacks logging of the record access
   • B.An authorization gap: the request is authenticated but object-level access control is missing✓ Answer
   • C.A latency gap: the extra check would slow responses unacceptably
   • D.An authentication gap: the API key mechanism itself is broken

   Authentication answers "who are you" while authorization answers "what may you do"; validating the API key establishes identity but says nothing about whether that identity may access a particular object. Missing object-level authorization lets any valid caller enumerate other users' records, so the fix is an access-control check per resource, not a stronger key.

   Source: MCP Specification — Security Best Practices (authentication vs authorization); CCAR-P Exam Guide Domain 3Report a problem with this question

6. 6. A RAG-backed support chatbot runs a multi-step pipeline (query rewrite, vector search, cross-encoder rerank) on every query. Analysis shows 70% of queries are simple FAQ lookups, and p95 latency is far above target. What is the BEST way to manage the accuracy-latency tradeoff?

   • A.Route simple queries to a lightweight cached path and reserve the full pipeline for complex queries✓ Answer
   • B.Remove the reranker for all queries to guarantee low latency
   • C.Switch every query to a larger model so accuracy compensates for slowness
   • D.Increase chunk size so fewer retrieval calls are needed per query

   Tiered routing exploits the fact that latency budgets and accuracy needs differ per query: cheap, cacheable FAQ lookups get a fast path, while the expensive rerank pipeline is spent only where it changes the answer. Uniformly removing the reranker sacrifices accuracy on the hard 30%, and uniformly upgrading the model raises both cost and latency without addressing the mismatch.

   Source: Claude Docs — Agents and Tools: RAG/retrieval optimization (accuracy-latency routing); CCAR-P Exam Guide Domain 3Report a problem with this question

7. 7. A company must classify two million inbound emails per day with sub-second latency; a small fast model handles ~95% correctly, and a larger model is much more accurate but several times slower and costlier. Which integration pattern best balances accuracy and latency?

   • A.Use the fast model by default and escalate only low-confidence cases to the larger model✓ Answer
   • B.Run both models on every email and average their outputs
   • C.Use the fast model for everything and accept the 5% error rate silently
   • D.Use the large model for everything, since accuracy always outweighs latency

   Confidence-based escalation (cascading) sends the bulk of easy traffic through the cheap fast path and spends the expensive model only on the uncertain minority, so aggregate accuracy approaches the large model's while average latency and cost stay near the small model's. Running both models on everything doubles cost without a routing benefit, and the all-or-nothing options ignore that the tradeoff varies per input.

   Source: Claude Docs — Agents and Tools: model selection and routing (cost/latency/accuracy tradeoffs); CCAR-P Exam Guide Domain 3Report a problem with this question

8. 8. An enterprise runs tens of thousands of agent sessions per day and wants to detect when a deployment quietly degrades tool-call success rates. Which observability approach scales?

   • A.Disable logging to save storage and rely on unit tests
   • B.Emit structured traces and metrics (tool name, success/error, latency) per call, aggregate into dashboards with alerts, and sample transcripts for evals✓ Answer
   • C.Wait for user complaints, since they surface real failures
   • D.Have an engineer read a random transcript each morning

   At scale, regressions appear as statistical shifts in aggregate metrics long before humans could find them by reading transcripts, so instrumentation must be structured and machine-aggregatable, with alerting on rate changes and sampled transcripts feeding deeper evals. Manual spot-reading and complaint-driven detection both have sample sizes far too small to catch a percentage-point drop across thousands of sessions.

   Source: Claude Docs — Agents and Tools: agent observability and evaluation; CCAR-P Exam Guide Domain 3Report a problem with this question

9. 9. A multi-step agent workflow fails intermittently, and each run involves a dozen tool calls across several services. What logging design is MOST important for diagnosing these failures?

   • A.Correlate every tool call's inputs, outputs, errors, and latency under a shared trace/session ID spanning the whole run✓ Answer
   • B.Record only failed calls to minimize log volume
   • C.Log only the final answer, since intermediate steps are transient
   • D.Log everything at DEBUG level to a local file on each service with no shared identifier

   Agent failures are usually emergent — a plausible-but-wrong intermediate output poisons a later step — so diagnosis requires reconstructing the full causal chain, which is only possible when every call in a run shares a correlation ID. Logging only endpoints or only failures discards the successful-looking intermediate steps where the actual defect was introduced, and uncorrelated per-service logs cannot be stitched back into one run.

   Source: Claude Docs — Agents and Tools: tracing multi-step agent runs; CCAR-P Exam Guide Domain 3Report a problem with this question

10. 10. You are indexing legal contracts organized into numbered articles and clauses; users ask questions like "What does the termination clause say about notice periods?" Which chunking strategy fits this data shape best?

    • A.Structure-aware chunking on clause/section boundaries, attaching section headers and document metadata to each chunk✓ Answer
    • B.Sentence-level chunks to maximize the number of index entries
    • C.Fixed 512-token chunks with no overlap, since uniform size simplifies the index
    • D.One chunk per entire contract to guarantee full context

    Retrieval precision depends on chunks aligning with the units users actually ask about; clause-boundary chunking keeps each legal provision intact and the attached headers give the embedding and the model the context ("Article 12 — Termination") needed to match clause-targeted queries. Fixed-size chunks split provisions mid-sentence, whole-document chunks dilute the embedding and overflow context, and sentence chunks strip the surrounding meaning a clause needs.

    Source: Anthropic Docs — Embeddings (chunking for retrieval); Claude Docs — Agents and Tools: RAG design; CCAR-P Exam Guide Domain 3Report a problem with this question

11. 11. An internal search assistant frequently fails on queries containing exact identifiers such as SKUs ("WX-4471B") and error codes ("ERR_5023"), even though semantic search works well for natural-language questions. What retrieval change best matches this query pattern?

    • A.Lower the similarity threshold so more candidates are returned
    • B.Re-embed the corpus with larger chunks containing more identifiers each
    • C.Increase the embedding dimension so vectors capture identifiers better
    • D.Add lexical/keyword search (e.g., BM25) alongside embeddings in a hybrid retrieval setup✓ Answer

    Embeddings encode distributional meaning, so rare, arbitrary strings like SKUs and error codes have little semantic signal and match poorly in vector space; lexical search matches them exactly by term. Hybrid retrieval routes each query type to the mechanism that handles it — keywords for exact identifiers, vectors for paraphrased natural language — which neither bigger vectors nor looser thresholds can achieve.

    Source: Anthropic Docs — Embeddings (semantic vs lexical matching, hybrid search); CCAR-P Exam Guide Domain 3Report a problem with this question

12. 12. A support agent confidently quoted a return policy that was retired weeks earlier; the policy document was updated in the CMS, but the vector index is rebuilt only monthly. What is the BEST architectural fix?

    • A.Switch to a larger embedding model with more current knowledge
    • B.Raise the retrieval top-k so newer documents are more likely to appear
    • C.Trigger incremental index updates from CMS change events and carry version/effective-date metadata for recency filtering✓ Answer
    • D.Instruct the agent in its system prompt to double-check dates before answering

    A RAG system can only retrieve what its index contains, so if the index lags the source of truth, the agent will faithfully cite stale content no matter how it is prompted; the mechanism-level fix is keeping the index synchronized (event-driven or incremental updates) and encoding validity metadata so retrieval can prefer or filter to current versions. Raising top-k cannot surface a document version that was never indexed, and embedding models carry no knowledge of your private documents' freshness.

    Source: Claude Docs — Agents and Tools: RAG pipeline design (index freshness); Anthropic Docs — Embeddings; CCAR-P Exam Guide Domain 3Report a problem with this question

13. 13. A RAG knowledge base serves multiple corporate tenants from one vector store. How should tenant isolation be enforced so Tenant A can never retrieve Tenant B's documents?

    • A.Rely on embedding distance, since different companies' documents are semantically far apart
    • B.Add a system-prompt rule telling the model to ignore other tenants' documents
    • C.Have the model check each retrieved chunk's tenant field and discard mismatches
    • D.Enforce a server-side tenant filter (metadata filter or separate namespace/collection) applied to every query before results are returned✓ Answer

    Access control must be enforced deterministically in the retrieval layer, before any content reaches the model, because prompt instructions and model-side filtering are probabilistic and can be bypassed by injection or model error — and by then the cross-tenant data has already entered the context window. A server-enforced metadata filter or per-tenant namespace makes cross-tenant leakage structurally impossible rather than merely discouraged.

    Source: MCP Specification — Security Best Practices (server-side access control); Claude Docs — Agents and Tools: RAG with metadata filtering; CCAR-P Exam Guide Domain 3Report a problem with this question

14. 14. A platform team maintains one internal ticketing system that five different AI applications (a support agent, an IDE assistant, a chat product, and two internal bots) all need to access. Why is exposing it as an MCP server preferable to writing a bespoke API integration inside each application?

    • A.MCP encrypts data in a way REST APIs cannot
    • B.MCP removes the need for authentication between clients and the ticketing system
    • C.MCP standardizes the integration once, so any MCP-compatible client can discover and use the same tools — turning an M×N integration problem into M+N✓ Answer
    • D.MCP servers execute faster than direct API calls

    MCP's core value is standardization: the server describes its tools in a protocol-defined format that every compliant client can discover at runtime, so the integration is built and maintained once instead of five times, and new clients get it for free. MCP offers no inherent speed or encryption advantage over direct APIs and still requires proper authentication — the win is the many-clients-to-many-systems reuse pattern.

    Source: MCP Documentation — Introduction/Architecture (M×N integration problem); CCAR-P Exam Guide Domain 3Report a problem with this question

15. 15. A nightly batch job must call the same three internal endpoints in a fixed order with no branching, and results must be bit-for-bit reproducible. Which connection approach is most appropriate?

    • A.Spawn a multi-agent team where each agent owns one endpoint
    • B.Give an agent MCP tools for the three endpoints so it can decide the order
    • C.Call the APIs directly from conventional scripted code with no LLM in the loop✓ Answer
    • D.Have an LLM generate the API calls fresh each night from a prompt

    Agents add value when a task requires dynamic reasoning about which action to take next; a fully deterministic, fixed-sequence workflow gains nothing from model-driven tool selection while inheriting its costs — added latency, token spend, and nondeterministic failure modes that break reproducibility. The guiding rule is to use plain code for deterministic workflows and reserve agentic tool use for tasks with genuine decision points.

    Source: Claude Docs — Agents and Tools: when to use agents vs workflows (deterministic pipelines); CCAR-P Exam Guide Domain 3Report a problem with this question

16. 16. Within a research agent, one subtask — "analyze this 200-page filing and produce a risk summary" — requires many reasoning turns and would flood the parent agent's context. Which integration pattern fits, and why?

    • A.Pasting the full filing into the parent agent's context and asking it to be concise
    • B.A simple stateless tool call, since tools are always cheaper than agents
    • C.Delegating to a subagent that works in its own context window and returns only the distilled summary✓ Answer
    • D.Splitting the filing across 20 parallel tool calls that each summarize 10 pages independently with no coordination

    Agent-to-agent delegation is the right pattern when a subtask needs its own multi-turn reasoning loop and substantial working context: the subagent consumes the 200 pages in an isolated context window and only its compact conclusion crosses back, preserving the parent's context for orchestration. A stateless tool cannot carry out iterative reasoning, dumping the filing into the parent defeats the purpose, and uncoordinated parallel summaries lose cross-section risk connections.

    Source: Claude Docs — Agents and Tools: subagents and orchestrator patterns; CCAR-P Exam Guide Domain 3Report a problem with this question

17. 17. An agent platform could either (a) load all 400 tool definitions and every reference document into the system prompt at startup, or (b) expose a small search/discovery interface that lets the agent load tool definitions and reference files only when a task needs them. What is the main argument for approach (b)?

    • A.Approach (b) eliminates the need for any system prompt
    • B.Approach (b) removes the need for access controls on the tools
    • C.Monolithic context is technically impossible because prompts cannot exceed 400 definitions
    • D.Progressive discovery keeps the working context small and relevant, which lowers token cost and improves tool-selection and reasoning accuracy✓ Answer

    Model attention is a finite resource: irrelevant tool definitions and documents in context add token cost on every call and act as distractors that measurably hurt tool selection and reasoning, so loading context just-in-time keeps only task-relevant material in the window. Monolithic loading is possible but wasteful; progressive discovery trades a small lookup step for a consistently cleaner, cheaper context — it does not eliminate prompts or access controls.

    Source: Claude Docs — Agents and Tools: context management / progressive tool discovery; CCAR-P Exam Guide Domain 3Report a problem with this question

18. 18. A developer wants an agent to manage a mature internal service that already ships a well-documented CLI, and only this one agent will ever use it. Wrapping every CLI command as a custom MCP tool is proposed. What is the strongest reason this may be unnecessary?

    • A.MCP requires an internet connection while CLIs do not
    • B.CLIs cannot be invoked from agent environments under any circumstances
    • C.MCP tools cannot return text output, which CLIs produce
    • D.An agent with shell access can drive a documented CLI directly, so with a single consumer the MCP wrapper adds build and maintenance cost without the cross-client reuse that justifies it✓ Answer

    The economics of building an MCP server rest on reuse across multiple clients and standardized discovery; when exactly one agent consumes exactly one interface that is already agent-legible (documented commands, text I/O), direct CLI invocation delivers the same capability with zero additional integration surface to build, secure, and maintain. MCP remains the better choice when many clients need the integration or when tool schemas and managed authorization add real value.

    Source: MCP Documentation — when to build an MCP server; Claude Docs — Agents and Tools: tool vs CLI integration; CCAR-P Exam Guide Domain 3Report a problem with this question

Practice questions based on the official Claude Certified Architect – Professional (CCAR-P) exam guide and Anthropic's public documentation. This is an independent study tool, not affiliated with or endorsed by Anthropic, and does not grant certification. The real exam is 63 questions, 120 minutes, passing at a scaled 720/1000, delivered via Pearson VUE ($175). Official certification page →