Pass Anthropic CCA-F Exam in First Attempt Easily

Unrelated destructive privileges violate least privilege. The proposal “Allow the public web worker to delete internal records if useful” conflicts with the required decision. “Remove the database deletion capability from that worker's allowed set” addresses the actual condition. An agent should receive only tools required for its assigned task. Tool access must be limited by the actual agent role and host permissions rather than broad defaults or a model’s own promises to avoid misuse.

The tool remains executable despite the warning. This alternative suggests “Document “do not delete” in its prompt but keep the capability”, whereas the supported approach is “Remove the database deletion capability from that worker's allowed set”. An agent should receive only tools required for its assigned task. Tool access must be limited by the actual agent role and host permissions rather than broad defaults or a model’s own promises to avoid misuse.

“Give the worker access to privileged maintenance consoles for faster search” is the wrong action for this case. Administrative scope is not required for public research. The supported choice is “Remove the database deletion capability from that worker's allowed set”. An agent should receive only tools required for its assigned task. Check which tools an agent can really invoke, apply the intended choice constraints, and reject an out-of-scope operation before any side effect.

A last-minute citation check needs narrowly scoped access. This alternative suggests “Give the formatter unrestricted source discovery and editing rights”, whereas the supported approach is “Give the formatter a narrow verify_citation tool and route full discovery to research”. Purpose-limited cross-role access avoids creating a general research agent inadvertently. Tool access must be limited by the actual agent role and host permissions rather than broad defaults or a model’s own promises to avoid misuse.

“Remove citation verification and trust the generated references” is the wrong action for this case. The formatter must verify support for each claim. The supported choice is “Give the formatter a narrow verify_citation tool and route full discovery to research”. Purpose-limited cross-role access avoids creating a general research agent inadvertently. Check which tools an agent can really invoke, apply the intended choice constraints, and reject an out-of-scope operation before any side effect.

Formatting should not mutate source material. The proposal “Let it rewrite the original evidence files during formatting” conflicts with the required decision. “Give the formatter a narrow verify_citation tool and route full discovery to research” addresses the actual condition. Purpose-limited cross-role access avoids creating a general research agent inadvertently. Tool access must be limited by the actual agent role and host permissions rather than broad defaults or a model’s own promises to avoid misuse.

Auto permits text-only answers and does not guarantee a call. This alternative suggests “Set tool_choice to auto and assume extraction will always occur”, whereas the supported approach is “Force the metadata extraction tool for the initial call, then hand control back”. Explicit tool choice can mandate the prerequisite action when the API supports that mode. Tool access must be limited by the actual agent role and host permissions rather than broad defaults or a model’s own promises to avoid misuse.

“Execute enrichment before metadata extraction completes” is the wrong action for this case. The downstream step depends on the extracted fields. The supported choice is “Force the metadata extraction tool for the initial call, then hand control back”. Explicit tool choice can mandate the prerequisite action when the API supports that mode. Check which tools an agent can really invoke, apply the intended choice constraints, and reject an out-of-scope operation before any side effect.

The stated requirement applies only where forced choice is available. The proposal “Force a tool type unsupported by the selected model without checking compatibility” conflicts with the required decision. “Force the metadata extraction tool for the initial call, then hand control back” addresses the actual condition. Explicit tool choice can mandate the prerequisite action when the API supports that mode. Tool access must be limited by the actual agent role and host permissions rather than broad defaults or a model’s own promises to avoid misuse.

“Treat auto as a guarantee the most relevant tool will execute” is the wrong action for this case. The model is allowed to respond with text instead. The supported choice is “The model may answer in text without selecting any tool”. Automatic selection does not mean a tool invocation is mandatory. Check which tools an agent can really invoke, apply the intended choice constraints, and reject an out-of-scope operation before any side effect.

It may call available tools when useful. The proposal “Assume auto prevents all tool use” conflicts with the required decision. “The model may answer in text without selecting any tool” addresses the actual condition. Automatic selection does not mean a tool invocation is mandatory. Tool access must be limited by the actual agent role and host permissions rather than broad defaults or a model’s own promises to avoid misuse.

Completion and tool invocation are separate events. This alternative suggests “Interpret an end_turn response as proof a tool must have executed”, whereas the supported approach is “The model may answer in text without selecting any tool”. Automatic selection does not mean a tool invocation is mandatory. Tool access must be limited by the actual agent role and host permissions rather than broad defaults or a model’s own promises to avoid misuse.

None expressly prevents tool calls. The proposal “Use tool_choice none when one tool must be called” conflicts with the required decision. “Require any available tool via the any choice mode” addresses the actual condition. The any mode mandates tool use while allowing tool selection among declared tools. Tool access must be limited by the actual agent role and host permissions rather than broad defaults or a model’s own promises to avoid misuse.

The requirement is any suitable tool, not a named one. This alternative suggests “Force a specific arbitrary tool despite multiple valid choices”, whereas the supported approach is “Require any available tool via the any choice mode”. The any mode mandates tool use while allowing tool selection among declared tools. Tool access must be limited by the actual agent role and host permissions rather than broad defaults or a model’s own promises to avoid misuse.

“Use auto and claim it guarantees a mandatory tool invocation” is the wrong action for this case. Auto allows direct text responses on supported models. The supported choice is “Require any available tool via the any choice mode”. The any mode mandates tool use while allowing tool selection among declared tools. Check which tools an agent can really invoke, apply the intended choice constraints, and reject an out-of-scope operation before any side effect.

Research does not require refunds or account deletion. This alternative suggests “Give the web researcher every privileged business tool because it might be convenient”, whereas the supported approach is “Role-specific least-privilege tool distribution”. Excess unrelated capabilities magnify misuse and confusing selection. Tool access must be limited by the actual agent role and host permissions rather than broad defaults or a model’s own promises to avoid misuse.

“Tell it to avoid dangerous calls but leave them executable” is the wrong action for this case. Prompt warnings are weaker than scoped permissions. The supported choice is “Role-specific least-privilege tool distribution”. Excess unrelated capabilities magnify misuse and confusing selection. Check which tools an agent can really invoke, apply the intended choice constraints, and reject an out-of-scope operation before any side effect.

Mislabeling the side effect hides the authorization risk. The proposal “Expose customer deletion as a harmless read-only search operation” conflicts with the required decision. “Role-specific least-privilege tool distribution” addresses the actual condition. Excess unrelated capabilities magnify misuse and confusing selection. Tool access must be limited by the actual agent role and host permissions rather than broad defaults or a model’s own promises to avoid misuse.

The agent cannot distinguish source authority or content scope. This alternative suggests “Leave internal and public tools with identical descriptions”, whereas the supported approach is “Expose a clearly scoped internal-report retrieval tool and constrain available choices”. Narrow tool options and descriptions express which evidence source is authoritative. Tool access must be limited by the actual agent role and host permissions rather than broad defaults or a model’s own promises to avoid misuse.

“Search only the public web for internal report questions” is the wrong action for this case. Confidential internal reports may not be publicly available. The supported choice is “Expose a clearly scoped internal-report retrieval tool and constrain available choices”. Narrow tool options and descriptions express which evidence source is authoritative. Check which tools an agent can really invoke, apply the intended choice constraints, and reject an out-of-scope operation before any side effect.

More overlapping choices will not solve the selection problem. The proposal “Add more broad browser tools without specific internal retrieval paths” conflicts with the required decision. “Expose a clearly scoped internal-report retrieval tool and constrain available choices” addresses the actual condition. Narrow tool options and descriptions express which evidence source is authoritative. Tool access must be limited by the actual agent role and host permissions rather than broad defaults or a model’s own promises to avoid misuse.

“Provide read access along with document deletion privileges” is the wrong action for this case. The agent could alter records during a summary task. The supported choice is “Provide only read access and controlled output tools to the summary agent”. The summary task requires evidence reading and controlled output, not permission to modify original files; tool permissions must reflect that scope. Check which tools an agent can really invoke, apply the intended choice constraints, and reject an out-of-scope operation before any side effect.

Summarization should preserve original evidence. The proposal “Let it modify source files to make the summary easier” conflicts with the required decision. “Provide only read access and controlled output tools to the summary agent” addresses the actual condition. The summary task requires evidence reading and controlled output, not permission to modify original files; tool permissions must reflect that scope. Tool access must be limited by the actual agent role and host permissions rather than broad defaults or a model’s own promises to avoid misuse.

The privilege scope exceeds a read-only role. This alternative suggests “Grant unrestricted Bash execution when only content retrieval is needed”, whereas the supported approach is “Provide only read access and controlled output tools to the summary agent”. The summary task requires evidence reading and controlled output, not permission to modify original files; tool permissions must reflect that scope. Tool access must be limited by the actual agent role and host permissions rather than broad defaults or a model’s own promises to avoid misuse.

Personal authentication does not grant tenant-wide authority. The proposal “Expose organization-wide write methods to every personal MCP user” conflicts with the required decision. “Limit write tools to authorized roles and validate tenant permissions on execution” addresses the actual condition. Tool exposure is not itself permission to mutate a tenant's records. Tool access must be limited by the actual agent role and host permissions rather than broad defaults or a model’s own promises to avoid misuse.

The service must verify authorization. This alternative suggests “Trust an agent's natural-language tenant claim without checking execution permissions”, whereas the supported approach is “Limit write tools to authorized roles and validate tenant permissions on execution”. Tool exposure is not itself permission to mutate a tenant's records. Tool access must be limited by the actual agent role and host permissions rather than broad defaults or a model’s own promises to avoid misuse.

“Rely on server naming as a substitute for per-operation role checks” is the wrong action for this case. A descriptive label does not enforce access rights. The supported choice is “Limit write tools to authorized roles and validate tenant permissions on execution”. Tool exposure is not itself permission to mutate a tenant's records. Check which tools an agent can really invoke, apply the intended choice constraints, and reject an out-of-scope operation before any side effect.

The selected model cannot honor that configuration. This alternative suggests “Require an unsupported forced-tool setting and ignore request errors”, whereas the supported approach is “Use schema-enforced structured output or supported strict tool schemas with auto selection”. Model-specific tool-choice restrictions require a supported structured-output design. Tool access must be limited by the actual agent role and host permissions rather than broad defaults or a model’s own promises to avoid misuse.

“Use a prose instruction “output JSON” without schema enforcement” is the wrong action for this case. Plain text does not guarantee a parseable machine contract. The supported choice is “Use schema-enforced structured output or supported strict tool schemas with auto selection”. Model-specific tool-choice restrictions require a supported structured-output design. Check which tools an agent can really invoke, apply the intended choice constraints, and reject an out-of-scope operation before any side effect.

A schema check is still required. The proposal “Interpret a valid-looking JSON string as proof it meets required field types” conflicts with the required decision. “Use schema-enforced structured output or supported strict tool schemas with auto selection” addresses the actual condition. Model-specific tool-choice restrictions require a supported structured-output design. Tool access must be limited by the actual agent role and host permissions rather than broad defaults or a model’s own promises to avoid misuse.

Quoting permission does not authorize the side effect. This alternative suggests “Enable order submission because a quote usually leads to purchase”, whereas the supported approach is “Expose pricing lookup and quote creation but not order submission”. Removing unauthorized side-effect tools reduces the risk of action beyond scope. Tool access must be limited by the actual agent role and host permissions rather than broad defaults or a model’s own promises to avoid misuse.

“Ask the agent to self-limit order creation while retaining a purchase API” is the wrong action for this case. The assistant still has access to an order-submission tool even when its task permits quotations only, so an accidental purchase remains possible. The supported choice is “Expose pricing lookup and quote creation but not order submission”. Removing unauthorized side-effect tools reduces the risk of action beyond scope. Check which tools an agent can really invoke, apply the intended choice constraints, and reject an out-of-scope operation before any side effect.

The business states are distinct. The proposal “Treat a prepared quotation as confirmation of a completed order” conflicts with the required decision. “Expose pricing lookup and quote creation but not order submission” addresses the actual condition. Removing unauthorized side-effect tools reduces the risk of action beyond scope. Tool access must be limited by the actual agent role and host permissions rather than broad defaults or a model’s own promises to avoid misuse.