Free Practice Questions for the Anthropic Claude Certified Developer CCDV-F Exam (2026 Updated)

Option B is correct because destructive production operations require deterministic enforcement outside the model’s probabilistic reasoning. Claude Code hooks can intercept lifecycle events before tool execution and explicitly allow, deny, or request further handling based on concrete rules.

Anthropic’s hooks documentation provides this exact security pattern. A PreToolUse hook can inspect a proposed command before execution and return a blocking decision. Anthropic’s example demonstrates blocking destructive operations such as drop table, while other commands proceed normally.

That mechanism can be adapted to database controls: block DROP, destructive DELETE, unauthorized schema modifications, or production writes; require explicit approval for high-risk operations; and allow read-only or known-safe queries automatically.

A merely increases the probability that someone might notice an unsafe operation and does not prevent execution. C assumes model capability can replace access controls, which is an unacceptable safety boundary. D is useful behavioral guidance but remains probabilistic and cannot guarantee prevention.

Therefore, B creates a deterministic control between model intent and side-effect execution. Relevant Study Guide topics: Claude hooks, PreToolUse, tool governance, deterministic enforcement, approval gates, least privilege, and destructive-operation protection.

===============

Option A follows disciplined production debugging: diagnose the actual failure mode before changing architecture or prompts. An output containing unsupported information might indeed be hallucination, but similar symptoms can result from stale conversation state, incorrect retrieval, unexpected tool output, prompt injection, incorrect request construction, or mismatched model/configuration versions.

A production trace should capture the user input, system instructions, relevant conversation history, retrieved content, tool calls and results, model/version, request parameters, response, and identifiers necessary to compare successful and failing cases. This establishes whether the model invented a fact or whether that fact entered context through another path.

B changes the model before establishing causality. C may eventually be useful if the confirmed problem is insufficient grounding, but implementing RAG before diagnosis can hide rather than explain the defect. D similarly changes prompting before verifying that prompt behavior is responsible.

The engineering sequence should be observe, reproduce, classify the failure, form a hypothesis, apply a targeted correction, and validate the correction with evaluations. Relevant Study Guide topics: production troubleshooting, observability, tracing, hallucination analysis, prompt injection, context failures, regression diagnosis, and lifecycle monitoring.

===============

Option C follows the governing constraint in the scenario: data residency is an enterprise requirement, whereas minimizing infrastructure management is a preference. A deployment architecture cannot knowingly violate a mandatory compliance boundary merely to accelerate delivery. The question should therefore be interpreted under its stated assumption that the described BYOC environment satisfies the enterprise residency policy.

Anthropic's current Managed Agents documentation distinguishes Anthropic-managed cloud environments from self-hosted sandboxes running on infrastructure controlled by the customer. Self-hosting keeps tool execution, files, and network egress within customer infrastructure, although Anthropic documents that model-facing tool inputs and outputs can still pass through its control plane; therefore, actual regulatory approval must be based on the organization's precise data-flow requirements.

B and D explicitly defer or violate the existing policy. A unnecessarily introduces a planned migration away from the residency-compliant architecture without establishing that such a migration would be permissible.

Accordingly, C is the intended certification answer. Relevant Study Guide topics: deployment topology, data residency, self-hosting, compliance constraints, infrastructure ownership, security boundaries, and architecture tradeoffs.

===============

Option A correctly separates sampling configuration from context management. Temperature historically controlled the randomness of token selection; it did not increase the number of tokens Claude could accept within a request. Anthropic’s current Messages API documentation continues to describe temperature in terms of randomness and, for newer model generations, marks manual temperature control as deprecated. Therefore, changing temperature cannot solve a context-capacity problem.

Long transcripts instead require context-engineering techniques. Appropriate approaches include chunking documents, summarizing earlier material, retrieving only relevant sections, or using context editing/compaction so high-value information remains visible while unnecessary material is removed. Anthropic’s context-editing guidance explicitly supports summarization and replacement of growing conversation history to keep long-running workloads within usable context limits.

B incorrectly conflates generation parameters with context capacity. C may save some tokens but removes persistent application instructions and is therefore architecturally unsound. D modifies an unrelated parameter without addressing the root cause. Relevant Study Guide topics: context windows, token budgets, sampling parameters, summarization, chunking, and context engineering.

===============

Option D reflects the correct architecture-selection principle: extension mechanisms should be selected according to what the capability must accomplish rather than familiarity, novelty, or implementation convenience. Anthropic explicitly distinguishes Claude extension mechanisms by purpose. Built-in tools cover common capabilities already supported by the platform. Custom tools expose application-specific callable operations through defined schemas. Skills package reusable knowledge, instructions, and workflows. MCP connects Claude to external systems, APIs, databases, and services through a standardized protocol.

The decision therefore depends on scope and integration boundaries. A reusable procedural workflow may belong in a Skill; access to an external enterprise system may warrant MCP; a narrowly application-specific operation can be a custom tool; and a built-in tool should generally be preferred when it already satisfies the requirement.

A makes prior team experience the architectural criterion rather than requirements. B assumes newer technology is inherently better. C optimizes implementation convenience without considering maintainability, interoperability, or reuse.

Therefore, D is the appropriate selection rule. Relevant Study Guide topics: built-in tools, custom tools, Skills, MCP, extension architecture, reuse boundaries, and capability selection.

===============

Option C matches Claude Code’s documented Skill architecture. Agent Skills are filesystem-based extension artifacts rather than ordinary application modules or repeated prompt fragments. A Skill is represented by a directory containing a required SKILL.md file and can include optional supporting scripts, templates, examples, and reference material.

Anthropic documents project Skills under .claude/skills/ < skill-name > /SKILL.md. Project-level Skills can be shared through Git and automatically discovered when Claude Code loads project settings. Supporting scripts can reside alongside the Skill and be referenced from SKILL.md.

A incorrectly embeds reusable procedural material into every CLAUDE.md file, creating duplication and loading instructions even when they are irrelevant. B creates a conventional source-code library but does not register a Claude Code Skill. D makes the capability dependent on undocumented, developer-specific setup and undermines team reuse.

Therefore, C uses the extension mechanism specifically designed for discoverable, reusable Claude capabilities. Relevant Study Guide topics: Agent Skills, .claude/skills, SKILL.md, supporting resources, filesystem discovery, project-level configuration, and reusable Claude Code capabilities.

===============

Option D is correct because the problem is not insufficient nominal context capacity; it is degraded signal quality as the working context grows. Anthropic’s context-window guidance explicitly states that more context is not automatically better. As conversations expand, recall and accuracy can degrade through “context rot,” so long-running agents need active context management rather than simply retaining every prior tool result.

A good pattern preserves the active task state while compacting, summarizing, or pruning stale intermediate outputs. Anthropic documents server-side compaction for long-running conversations and context-editing/pruning approaches that clear old tool results when they no longer contribute useful information. This keeps high-value constraints and conclusions visible without carrying every verbose response forward.

Option A changes frameworks without fixing the architectural cause. Option B may reduce call count but also creates larger multi-purpose tools and does not guarantee better context quality. Option C increases capacity while preserving the same low-signal accumulation, so the relevant facts can remain buried.

Therefore, D best implements context engineering for agentic workloads. Relevant Study Guide topics: context engineering, context rot, compaction, tool-result pruning, long-running agents, state preservation, and context-window optimization.

===============

Option D applies the correct hybrid pattern. Anthropic distinguishes workflows—where LLMs and tools execute along predefined code paths—from agents, where the model dynamically determines how to proceed. Anthropic recommends choosing the simplest architecture that meets the requirement: workflows provide predictability and consistency for well-understood tasks, while agents are valuable where flexible model-driven decisions are necessary.

Standard invoice processing is explicitly described as a small number of known steps. That makes a deterministic workflow the appropriate default because the path can be tested, monitored, and reproduced. The unexpected-format branch is different: the system must reason among rerouting, requesting clarification, or human escalation. That decision point is where agentic flexibility adds value.

A makes the entire process autonomous even though most steps do not require autonomy, increasing cost, latency, and unpredictability. B introduces multiple specialized agents despite no demonstrated need for that complexity. C collapses deterministic processing and exception handling into one monolithic model call, making validation and debugging harder.

Therefore, D combines workflow predictability with targeted agentic reasoning. Relevant Study Guide topics: workflows versus agents, routing, exception handling, hybrid agentic architecture, escalation, and complexity minimization.

===============

Option C satisfies both the enterprise routing requirement and sound application architecture. Claude is available through Amazon Bedrock, and Anthropic provides Bedrock-specific SDK integration rather than requiring applications to call api.anthropic.com directly. Current Anthropic documentation describes Claude in Amazon Bedrock as operating through AWS-managed infrastructure with AWS-native authentication, billing, and security boundaries. Newer Bedrock integrations use the Messages API shape, allowing substantial application logic to remain consistent across provider environments.

Anthropic SDKs also provide dedicated Bedrock clients—for example, Python includes AnthropicBedrockMantle for current Bedrock deployments. Keeping business logic separated from provider-specific authentication, endpoints, model identifiers, and transport configuration reduces migration and maintenance risk.

A violates architectural simplicity by duplicating every call unnecessarily. B knowingly violates the enterprise requirement until migration occurs. D directly ignores the contractual routing constraint and is therefore invalid regardless of technical feasibility.

The correct approach is to make Bedrock the configured inference provider while keeping higher-level application and agent behavior decoupled from provider-specific implementation details. Relevant Claude Developer topics are Claude API mechanics, cloud-provider integrations, Amazon Bedrock, SDK configuration, authentication boundaries, model invocation, and provider abstraction.

===============

Option D is the strongest enforcement design because an unconditional content policy requires an application-level control between model generation and user delivery. Prompt instructions are valuable for steering Claude, but they are probabilistic controls and should not be treated as the sole enforcement mechanism when prohibited categories must never be exposed.

Anthropic’s guardrail guidance recommends layered safeguards including screening, validation, monitoring, and filtering rather than relying exclusively on prompts. Its prompt-leak guidance specifically recommends output screening and post-processing, including deterministic techniques such as keyword matching, regular expressions, or other text-processing mechanisms where appropriate.

A improves the probability of policy compliance but cannot guarantee that every generated response will satisfy an externally defined application policy. B explicitly abandons the requirement. C detects violations only after exposure, which is unsuitable when the content must not reach users.

A production architecture can combine system instructions, structured classification, policy engines, deterministic rules, and model-based moderation, but the decisive requirement is enforcement before output delivery. Relevant Claude Developer topics are guardrails, output filtering, content moderation, deterministic enforcement, defense in depth, safe application boundaries, and production Claude application design.

===============

Option B is correct because the official Anthropic Python SDK is the supported abstraction for calling the Claude REST API from Python. Anthropic documents both synchronous and asynchronous clients, standardized request/response objects, streaming support, error classes, timeouts, request IDs, and built-in retry behavior for common transient failures. Using those documented primitives reduces boilerplate and keeps integration behavior aligned with the API.

Option A is technically possible, but it unnecessarily reimplements authentication headers, serialization, error mapping, retries, timeouts, and response handling that the SDK already provides. Direct HTTP is appropriate only when there is a specific reason not to use the supported client. Option C introduces another provider’s abstraction and a translation layer that is unrelated to the stated requirement and increases compatibility risk. Option D invokes shell commands from Python, creating needless process-management, security, and error-handling complexity.

The correct engineering principle is to use the highest-level supported client that satisfies the application’s requirements while retaining access to lower-level HTTP controls when genuinely needed. Therefore, B is the appropriate Claude integration pattern. Relevant Study Guide topics: Python SDK, REST abstraction, authentication, retries, exceptions, response parsing, synchronous/asynchronous clients, and maintainable API integration.

===============

A is the correct lifecycle architecture. The supplied Claude Certified Developer Foundations item explicitly selects A . A session is a state boundary, so its lifecycle must define when accumulated conversation state remains valid and when that state must be discarded. Anthropic's Managed Agents documentation establishes that a session maintains conversation history across multiple interactions and provides explicit session operations including creation, update, archive, and deletion.

A therefore addresses all three required controls: expiration , reset , and fresh-session creation . Expiration prevents indefinitely retained conversational state. Reset triggers allow the application to clear state when events such as logout, workflow completion, tenant switching, or explicit user reset occur. Fresh-session rules prevent context belonging to an earlier task from influencing a logically unrelated conversation.

B relies exclusively on timeout and does not cover event-driven resets. C places lifecycle correctness on users instead of the application. D applies global reset behavior and omits independent per-session expiration semantics.

Relevant Claude Developer topics: Agent Architecture, session lifecycle, multi-turn state, context boundaries, state reset, stale-context prevention, and session management .

===============

Option C applies the appropriate context-management technique. The issue is not simply whether the older conversation can physically fit into the context window; it is that stale details remain prominent enough to interfere with the model’s current task. Effective context engineering optimizes signal quality, not merely maximum token retention.

Anthropic’s context-editing documentation describes compaction as summarizing accumulated history and replacing the full history with a structured summary when context becomes large. This preserves important task state while substantially reducing low-value detail that can distract later reasoning.

A retains precisely the stale material producing the problem and therefore does not address context drift. B destroys all useful continuity between turns, including valid goals, decisions, and intermediate state. D is similarly excessive because limiting Claude to only the latest turn discards information that may still be required.

Compaction provides the correct middle ground: retain durable conclusions, current objectives, unresolved issues, and other high-signal state while compressing obsolete conversational detail. Relevant Study Guide topics: context engineering, compaction, conversation history, long-running agents, stale context, context drift, and high-signal state preservation.

===============

Option B creates a clear separation between persistent application instructions and per-request user content. Stable behavioral rules—role, output conventions, formatting constraints, policies, and other instructions intended to apply across requests—belong in the system-level instruction layer. User messages should primarily carry task-specific input and requirements that vary from interaction to interaction.

Anthropic’s Messages API defines the system prompt specifically as the mechanism for providing overarching context and instructions to Claude. Current guidance likewise recommends the top-level system field for instructions that should apply from the beginning of the conversation, while more transient information belongs in conversation messages.

A mixes persistent application behavior with user-controlled content and weakens separation of concerns. C preserves the inconsistent architecture responsible for the problem. D duplicates instructions unnecessarily, wastes context tokens, and increases the possibility that future edits create conflicting versions of the same rule.

Consolidating stable instructions also makes prompts easier to version, evaluate, review, and maintain. Therefore, B is the correct design. Relevant Study Guide topics: system prompts, instruction hierarchy, prompt organization, formatting consistency, separation of concerns, and maintainable prompt construction.

The supplied examination page marks B . The scenario already demonstrates why model upgrades must be treated as evaluated software changes rather than automatic replacements: the new model improves one metric while introducing a regression in another.

Anthropic's official model-selection guidance recommends creating benchmark tests specific to the application's use case, testing models with the application's actual prompts and data, comparing response quality and edge-case performance, and weighing performance against operational tradeoffs. Therefore, the correct action is to adapt the multi-section system prompt to the new model's behavior and repeat the evaluation. Only after the formatting regression is eliminated—or reduced below an explicitly acceptable threshold—should the upgrade proceed.

A incorrectly assumes that an 8% reasoning improvement numerically compensates for a 3% malformed-output rate; these metrics measure different consequences and cannot simply be subtracted. C treats the known incompatibility only downstream instead of first correcting the prompt/model interaction. D permanently rejects future improvement and is inconsistent with controlled lifecycle evolution.

The engineering principle is migration through regression testing and adaptation , not blind upgrading or permanent version avoidance.

Relevant Claude Developer topics: Systems Life Cycle, model migration, regression evaluation, prompt adaptation, compatibility testing, deployment gates, and continuous evolution .

===============

Option A correctly treats this as a context-dependent format drift problem rather than an arbitrary model failure. Because the application initially produces valid JSON and progressively loses structure over subsequent turns, the investigation should focus on how accumulated conversation history changes the instructions and examples visible to Claude. Earlier malformed outputs, conflicting instructions, tool results, or unnecessary historical content can gradually reduce adherence to the intended format.

The application should therefore inspect the conversation state, preserve the authoritative formatting requirement, prune irrelevant content where appropriate, and validate outputs at the application boundary. Anthropic's Structured Outputs capability is specifically designed to prevent malformed structured responses by constraining Claude to a supplied JSON Schema. Official guidance states that Structured Outputs provide valid, parseable, schema-compliant results for downstream processing.

B destroys the response rather than correcting the failure mode. C resets state but prevents meaningful multi-turn operation and does not diagnose why context causes drift. D changes model characteristics without establishing that the model is responsible.

The supplied question on page 12 identifies A as correct. Relevant topics: Agent Architecture, context engineering, format drift, structured outputs, context evolution, schema validation, and long-running conversations.

===============

Option D combines the three key properties of a reliable Claude tool: an explicit contract, clear tool-selection guidance, and controlled execution failure handling. Anthropic's tool documentation defines user tools using a name, detailed description, and JSON input_schema. The description should explain what the tool does, when it should and should not be used, parameter semantics, and relevant limitations. Anthropic emphasizes that precise descriptions materially improve Claude's ability to select the correct tool.

A clear schema prevents ambiguous parameter interpretation and allows validation before calling the external pricing API. Where stronger guarantees are required, Anthropic also supports strict tool use, which constrains generated tool inputs to the declared JSON Schema.

The application's execution layer must also convert pricing-service failures into explicit, handled error paths rather than uncontrolled exceptions. A deprives Claude of critical selection information. B increases malformed-call risk. C delegates infrastructure reliability to the reasoning loop instead of implementing appropriate integration error handling.

Therefore, D represents production-quality custom-tool construction. Relevant Study Guide topics: custom tools, JSON Schema, tool descriptions, validation, external API integration, and error handling.

===============

Option C accurately captures Anthropic’s distinction. Prompt engineering primarily concerns how instructions are written, structured, and organized to obtain the desired behavior from a particular model invocation. Techniques include explicit instructions, examples, roles, XML structure, output requirements, and task-specific prompt construction. Context engineering operates at a broader architectural level: it determines which information should actually be present in the model’s context at each inference step.

Anthropic defines prompt engineering as methods for writing and organizing LLM instructions, whereas context engineering encompasses strategies for curating and maintaining the optimal set of tokens during inference. For long-running agents, context can contain system instructions, tools, MCP resources, retrieved documents, prior messages, tool results, summaries, and memory.

This distinction matters because multi-step agents continuously generate new state. Effective systems may prune obsolete results, retrieve information just in time, compact earlier conversation history, isolate subagent contexts, or store persistent state externally. B is incorrect because context engineering has not simply replaced prompt engineering; the two operate at different scopes. A defines context too narrowly, and D obscures an important architectural distinction.

Therefore, C correctly represents Claude Developer coverage of prompt engineering versus context engineering, context curation, agent state, long-horizon workflows, and context-window optimization.

===============

D follows the principle of choosing the simplest architecture that satisfies demonstrated requirements . The supplied examination item explicitly marks D. In this scenario, portability is neither a present functional requirement nor a foreseeable roadmap requirement. Adding an abstraction therefore creates measurable complexity without delivering an identified product capability.

Anthropic provides official general-purpose SDKs for Claude in multiple languages. These expose the Messages API directly while adding idiomatic interfaces, type safety, streaming support, retries, and error handling. Anthropic separately describes compatibility layers and framework-specific libraries as alternative integration surfaces rather than requirements for ordinary Claude development.

A third-party abstraction becomes rational when there is a genuine requirement for multiple providers, vendor switching, standardized cross-model interfaces, or an existing architectural platform that mandates it. None exists here. Building that flexibility speculatively increases dependencies, debugging surface, version-compatibility work, and the possibility that provider-specific Claude capabilities are hidden behind a lowest-common-denominator API.

A optimizes for hypothetical future requirements. B doubles operational complexity. C creates an even larger maintenance burden.

Relevant Claude Developer topics: Claude App Design, SDK selection, abstraction boundaries, dependency management, YAGNI, integration architecture, and provider portability requirements .

===============

The supplied Claude Certified Developer Foundations source marks C . Model selection is a multidimensional engineering decision. There is no universally correct Claude model independent of workload requirements; the application must satisfy the required capability or quality while remaining within acceptable latency and cost envelopes.

Anthropic's official model-selection guidance explicitly identifies capabilities, speed, and cost as core considerations and recommends testing models against workload-specific benchmarks rather than selecting them from a single metric. The guidance further recommends evaluating actual prompts and data, comparing response accuracy, quality, and edge-case behavior, and then weighing the resulting performance and cost tradeoffs.

Options A, B, and D each establish one or two dimensions as primary and effectively defer the remainder. That can lead to a technically unsuitable model—for example, a cheap model that fails the quality threshold or a high-quality model whose latency makes the user experience unacceptable.

The correct method is to define minimum acceptable thresholds across all relevant dimensions and benchmark candidate models against the actual workload.

Relevant Claude Developer topics: Claude App Design, model selection, capability, quality, latency, cost, benchmarking, workload evaluation, tradeoff analysis, and production optimization .

Option A is correct because the Message Batches API is designed for asynchronous, high-volume processing where results do not need to be returned interactively. Anthropic’s API reference states that a Message Batch can contain many independent Messages requests and may take up to 24 hours to complete. That makes it appropriate for 10,000 overnight email-extraction jobs with a several-hour completion window.

Streaming in B solves a different requirement: it exposes partial response events while a single request is being generated, which is valuable for interactive user experiences or long-running synchronous requests, but it does not provide the workload-management advantages of a batch job. C processes items sequentially and unnecessarily sacrifices throughput. D can increase throughput with concurrent real-time calls, but it adds concurrency management and rate-limit pressure when the workload explicitly tolerates asynchronous completion.

The batch design also lets each request carry a custom identifier so results can be matched back to source emails even if completion order differs. Therefore, A is the intended Claude API choice. Relevant Study Guide topics: Message Batches API, asynchronous processing, high-volume workloads, request correlation, throughput, and non-interactive application design.

===============

Option A is correct because sensitive-data protection must occur before prohibited information crosses the application's trust boundary. If account numbers, passwords, or other secrets must not be sent to Claude, asking Claude to “ignore” those values after transmission does not satisfy the requirement. The application must determine which data is permitted to leave its controlled environment and transform or reject prohibited content before constructing the Claude request.

This principle is consistent with Anthropic's defense-in-depth guidance. Anthropic recommends input screening, limiting Claude's access to sensitive information, and applying least privilege so the model receives only information necessary for the task.

B is fundamentally too late: the sensitive information has already been transmitted to the model context before the system instruction can influence behavior. C is worse because logging can create an additional store containing the sensitive information and only detects exposure after it occurs. D implements some boundary filtering but deliberately leaves coverage incomplete until production incidents reveal additional patterns.

Therefore, A requires the boundary and its permitted data flows to be defined first, then enforced comprehensively through filtering, redaction, tokenization, or rejection. Relevant Study Guide topics: application boundaries, data minimization, sensitive-data handling, filtering, redaction, least privilege, and privacy-preserving design.

===============

The supplied question identifies B as the intended answer. Tool schemas are contracts between Claude and executable application code. When the downstream service accepts only a defined set of arguments, relaxing that schema merely shifts invalid data farther into the system and increases runtime failures.

Anthropic's current tooling provides an even stronger implementation of this principle through strict tool use . Setting strict: true constrains tool inputs to the declared JSON Schema, preventing undeclared properties, missing required values, and incompatible parameter types where the supported schema subset is used. Anthropic explicitly recommends strict tool use for validated parameters, type-safe function calls, and reliable agentic workflows.

In a non-strict or legacy implementation, the application should still validate arguments before dispatch and convert invalid calls into structured tool errors that Claude can interpret and potentially correct. A prompt instruction can reinforce behavior, but it should not replace deterministic validation. C and D weaken the system boundary and knowingly send invalid calls downstream.

Therefore, maintain the contract rather than adapting the contract to malformed model output.

Relevant Claude Developer topics: Agent Construction, tool schemas, strict tool use, JSON Schema, parameter validation, structured errors, retry behavior, and defensive execution boundaries .

===============

Option D addresses the architectural cause of the failure: an ambiguous tool surface. Claude chooses tools partly from their names, descriptions, schemas, and the relationship between the request and the capability described. If multiple tools appear to perform substantially the same task, selection becomes unnecessarily difficult.

Anthropic’s tool-definition guidance explicitly recommends consolidating related operations into fewer tools and making descriptions clear about both what a tool does and when it should be used. The documentation notes that fewer, more capable tools reduce selection ambiguity and make the available tool surface easier for Claude to navigate.

Option A makes the ambiguity worse by expanding an already overlapping tool set. B destroys required application capabilities. C could improve selection somewhat, because examples can clarify complex inputs, but it leaves the underlying duplication intact. Examples complement good tool design; they are not a substitute for distinct tool responsibilities.

Therefore, D is the strongest solution: remove unused tools, merge functions that represent the same conceptual operation, and write discriminative descriptions defining appropriate and inappropriate usage. Relevant Study Guide topics: tool design, tool selection, descriptions, tool consolidation, agent construction, and reducing ambiguity.

===============

The question presents a trust-boundary failure: model-generated tool arguments are being accepted without sufficient validation before an external operation executes. A tool call should therefore be treated like input arriving at any typed application interface—the application must ensure that the tool name and arguments satisfy the declared contract before dispatch.

Anthropic describes tool use as a contract in which the application defines the tool's schema and Claude returns structured tool_use input. Current Claude functionality also supports strict: true, which guarantees schema-compliant tool inputs through constrained generation and specifically addresses invented parameters, incompatible types, and missing required fields. For applications not using strict tool use, explicit application-side validation and a controlled error path remain essential.

B knowingly executes invalid input. C relies on uncontrolled repetition rather than deterministic validation and bounded recovery. D eliminates a useful capability instead of correcting its execution boundary.

Therefore, A provides the correct defensive design. Relevant Study Guide topics: tool calling, tool_use, input_schema, strict tool use, schema validation, defensive execution, error handling, and secure tool dispatch.