Practice — CCAR-P Domain 3: Integration (19%)
17 scenario-based MCQs. Answer key + explanations at the bottom.
Q1
You inherit a production support agent connected to six MCP servers exposing 45 tools. Telemetry shows 90% of sessions use the same five tools, tool-selection accuracy is degrading, and input cost per request stays high even with caching enabled. Which change best addresses the root cause?
A. Move all 45 tool definitions behind a single cache breakpoint to cut their per-request read cost B. Rewrite the descriptions of the 40 rarely used tools so the model can discriminate between them C. Prune the connector surface to the tools sessions actually use and expose the rest on demand D. Route requests to a larger model that can reliably select among a 45-tool surface
Q2
A team's RAG pipeline over equipment manuals uses a fixed 512-token splitter with 10% overlap. Prose questions retrieve fine, but questions about specification tables produce wrong answers — inspection shows retrieved chunks containing half a table. Which fix targets this failure?
A. Raise top-K so that both fragments of a split table usually land in context together B. Add a cross-encoder reranking stage so table chunks outrank competing prose chunks C. Increase chunk overlap to 20% so content near boundaries is duplicated into both chunks D. Move to structure-aware chunking that splits on headings and keeps tables intact
Q3
A team is building a single internal application: one backend, three stable in-house tools, one client, and no plan to share these capabilities with any other host. One engineer wants to stand up an MCP server anyway "for future-proofing." Which assessment should the architect make?
A. Agree — MCP's trust model makes any deployment safer than in-app tool code B. Decline — MCP pays off through cross-client reuse and advertised discovery, which this design never exercises C. Agree — raw API tool use cannot express input schemas as precisely as MCP tools can D. Decline — MCP requires remote OAuth infrastructure that an internal application cannot justify
Q4
An internal analytics agent is deployed over Streamable HTTP. Employees authenticate to the chat frontend, but the MCP server queries the warehouse with one shared service account, and the system prompt instructs Claude to answer only about the requesting user's own business unit. An authn/authz gap analysis should flag which finding as critical?
A. Authorization lives only in model instructions; the data layer must scope queries to the authenticated user's identity B. The transport is wrong — internal MCP servers should run over stdio rather than Streamable HTTP C. The business-unit restriction should be restated at the end of the system prompt for recency weighting D. The frontend session length is too long and should force users to re-authenticate on every query
Q5
A retrieval pipeline needs sharper precision in its top results, but cross-encoder scoring of the whole corpus per query was measured in tens of seconds. Which design improves accuracy while respecting an interactive latency budget?
A. Precompute cross-encoder scores for every document offline and look them up at query time B. Keep the bi-encoder only and raise K from 5 to 50 to improve the odds of including the right chunk C. Retrieve ~20 candidates with the bi-encoder, cross-encoder rerank them, and keep the top 3–5 D. Skip retrieval and place the corpus directly into the model's long context on each query
Q6
Which statement correctly describes Anthropic's contextual retrieval technique?
A. A query-time LLM call expands the user's question with corpus context before it is embedded B. An indexing-time LLM call prepends a situating sentence to each chunk before it is embedded C. A reranking model attends jointly over the query and each candidate chunk at query time D. Each chunk's embedding is averaged with the embedding of its entire parent document
Q7
Users of a support assistant search with exact error codes ("E-4402") and part numbers. Dense-vector retrieval keeps returning thematically similar but wrong documents. Which retrieval change best fixes this?
A. Add a BM25 lexical arm and fuse both result lists with Reciprocal Rank Fusion B. Reduce chunk size so each identifier dominates its own chunk's embedding C. Lower the similarity threshold so more candidate documents reach the context D. Rewrite each query with an LLM to expand every code into a natural-language description
Q8
An enterprise Claude Code rollout needs about 30 specialized capabilities (deck generation, compliance checks, data pulls). Any single session touches two or three at most, and users cannot be relied on to remember what exists — the model itself must pull in a capability when it becomes relevant. Which packaging best avoids paying for all 30 in every prompt?
A. Concatenate the 30 capability guides into the system prompt behind one cache breakpoint B. Register each capability as a slash command that users invoke by name when they need it C. Ship one subagent per capability and have the orchestrator brief all of them at session start D. Package each capability as a Skill so only descriptions sit in context until one is invoked
Q9
A RAG assistant scores high on faithfulness/groundedness in offline evals, yet users keep reporting factually wrong answers. Where should the team look first?
A. Generation sampling parameters, since factually wrong output implies the model is hallucinating freely B. Retrieval recall@k, since high faithfulness with low recall means grounded answers from the wrong documents C. Chunk overlap settings, since facts near chunk boundaries may have been dropped during ingestion D. Citation formatting instructions, since users may be misreading which sources support each claim
Q10
Three weeks after launch, an integration's input spend triples. Traffic volume is unchanged and requests arrive seconds apart. Telemetry shows cache_read_input_tokens near zero with sustained cache_creation_input_tokens on nearly every request. What most likely happened?
A. A deploy put volatile content (a timestamp or per-user ID) into the cached prefix, churning the cache on every request B. The 5-minute cache TTL is expiring between requests, so each request pays the cache-write premium C. The stream of requests exceeded the four-cache-breakpoint limit, which silently disables caching D. Cache reads were repriced to write rates once the provider's launch-period discounts ended
Q11
An assistant answers questions over a stable 150K-token policy manual. Queries arrive in bursts seconds apart and need interactive latency; sending the full manual per request answers well but is slow and costly, and classic top-K RAG missed cross-references between distant sections. Which design best balances accuracy, latency, and cost?
A. Classic top-K RAG with a much larger K so cross-referenced sections are likely retrieved together B. Keep sending the full manual on every request and absorb the cost as the price of accuracy C. Pre-summarize the manual down to 20K tokens and answer every query from the summary D. Cache the full manual as a stable prefix and use retrieval to point at which sections to focus on
Q12
A regulated enterprise requires that any decision its production agent made can be reconstructed months later, back to the data it relied on. Which observability design satisfies the requirement?
A. Archive verbatim transcripts for a uniformly sampled 10% of production conversations and have compliance review the sample on a fixed schedule B. Log every final answer together with a model-generated natural-language explanation of the reasoning that produced it C. Thread request and conversation IDs through every call and log each tool call's name, arguments, and result, with provenance tags on extracted facts D. Enable extended thinking on all production traffic and retain the complete thinking blocks as the authoritative audit record
Q13
A security review of a RAG agent finds: the query_warehouse tool is described as "read-only," but its service account also holds write grants, and retrieved documents are untrusted third-party content. Which single control most reduces the blast radius of a prompt injection?
A. Swap the service account for a database credential that is actually read-only B. State "never write to the warehouse" at both the top and the end of the system prompt C. Screen retrieved documents with a second model that flags injection attempts D. Rewrite the tool description to state its read-only contract more forcefully
Q14
During a capability-bloat review, a product manager argues an unused CRM connector is "free to keep, because the agent never calls it." Why is this wrong?
A. Providers bill a monthly registration fee for every declared tool whether or not it is used B. Its tool definitions occupy context in every request and widen the surface an injected prompt can steer the model toward C. Unused connectors slow the MCP initialize handshake enough to break interactive latency SLAs D. Claude periodically invokes idle tools to keep their schemas warm, generating hidden background calls
Q15
An orchestrator must produce a migration plan for a 300-file codebase. If file-reading tools are wired directly to the orchestrator, every intermediate file read lands in its context and swamps the planning thread. Which integration surface fits best?
A. Expose each of the 300 files as an MCP resource and have the host attach the relevant ones B. Provide one CLI tool that concatenates all 300 files and returns them in a single result C. Submit per-file analysis requests through the Batch API and assemble the plan from the results D. Delegate exploration to subagents with focused contexts that return summaries to the orchestrator
Q16
A monitoring MCP tool returns a 25KB JSON dump per call. The agent calls it a dozen times per session and the context window fills long before the task ends — yet most decisions rely on only a few fields. Which redesign is best?
A. Raise max_tokens on every request so the model has more headroom to process the dumps B. Compress each payload into a compact encoded blob the model decodes when it needs details C. Return the decision-relevant fields plus a resource URI the model can fetch for full detail D. Prompt the agent to summarize each dump into a short note before making its next call
Q17
A contract-review assistant has exactly four tools and one 30K-token playbook, and every session exercises all of them. The team debates progressive discovery (load capabilities on demand) versus a monolithic front-loaded context. Which analysis is correct?
A. Front-load: a small, stable, always-used surface is the ideal cached prefix; discovery hops would just reload everything anyway B. Progressive discovery: minimizing resident context always dominates other integration concerns at this tier C. Progressive discovery: a 30K-token document in the system prompt is too large for cache_control to cover D. Front-load, but split the playbook across all four cache breakpoints so its segments can be read in parallel
Answers
Q1: C. Capability bloat is the root cause: every carried capability is context cost and attack surface, and 45 definitions dilute tool selection. Pruning to the used surface fixes accuracy, cost, and exposure at once. Caching (A) trims price but leaves selection accuracy and attack surface untouched; better descriptions (B) still leave 45 definitions competing for attention; a larger model (D) pays more to compensate for an architectural problem.
Q2: D. Structure-aware chunking beats naive splitting — a fixed-width splitter that bisects a table destroys its meaning, so the damage happens at indexing time. Higher K (A) doesn't guarantee both fragments co-retrieve, and each half-table's embedding is already corrupted. More overlap (C) only rescues facts that straddle a boundary; tables larger than the overlap still get bisected. Reranking (B) cannot repair chunks whose meaning was destroyed before embedding.
Q3: B. MCP's differentiators over raw API tool use are cross-client reusability, server-advertised discovery, and the ecosystem — none of which a single-app, single-client design exercises, so the simplicity principle says use direct tool use. (A) is false: trust must be configured either way. (C) is false: raw tool use takes the same JSON Schema definitions. (D) is false: stdio transport runs a local server with no OAuth at all, so the objection itself is wrong even though the conclusion matches.
Q4: A. Model instructions are not an access-control boundary: with one shared all-access service account, any successful steering of the model (or simple prompt failure) exposes other business units' data. Authorization must be enforced at the data layer with per-user identity and scoped credentials — least privilege. (B) is backwards; Streamable HTTP with OAuth 2.1 is the current remote standard. (C) is a prompt-quality tweak misapplied as a security control. (D) doesn't change what the shared credential can read.
Q5: C. The two-stage recipe buys cross-encoder accuracy while paying for it on only ~20 pairs: bi-encoder retrieval for candidates, cross-encoder rerank, keep top 3–5. (A) is impossible — a cross-encoder attends over query and document jointly, so nothing query-specific can be precomputed. (B) pads the context with more noise without sharpening what ranks first. (D) is the most expensive and slowest option and invites lost-in-the-middle degradation.
Q6: B. Contextual retrieval prepends an LLM-generated situating sentence to each chunk at indexing time, making chunks self-describing — a 30–50% retrieval-quality jump, generated cheaply with Haiku against a cached copy of the full document. (A) describes query rewriting, a different technique. (C) describes cross-encoder reranking. (D) is an invented mechanism.
Q7: A. Exact identifiers are precisely what embeddings blur and BM25 captures, so hybrid search with rank-based RRF fusion (which sidesteps incomparable score scales) is the documented fix — benchmarks show roughly 66% vs 57% MRR for hybrid over semantic-only. (B) and (C) still route everything through the embedding space that loses the codes. (D) adds a lossy hop: the rewriter must guess what the code means, while a lexical arm matches it exactly.
Q8: D. Skills are lazy: only the name and description sit in context until the model detects relevance and loads the body, so 30 capabilities cost almost nothing when idle. (A) reduces price via caching but every prompt still carries all 30 guides, diluting attention — and cache reads still cost ~10%. (B) makes discovery the user's job; slash commands are user-invoked, so capabilities go unused when users forget them. (C) briefs 30 subagents for work that won't happen — pure coordination waste.
Q9: B. Measure the two RAG stages separately: high faithfulness with low recall is the signature of confidently answering from the wrong documents, and the empirical rule is that retrieval is the bottleneck — debug it first. (A) contradicts the evidence; high faithfulness means the answers are grounded in what was retrieved. (C) jumps to one ingestion knob before measuring where the failure is. (D) is cosmetic and explains none of the factual errors.
Q10: A. Sustained cache_creation with near-zero reads is the signature of cache churn: any change to the cached prefix invalidates it, so a deploy that injected volatile content (timestamps, per-user IDs) before the breakpoint forces a rewrite every request. (B) is ruled out by the stem — requests arrive seconds apart and each access bumps the 5-minute TTL. (C) misreads the limit: four breakpoints is a per-request maximum, not a fleet quota. (D) is invented; read (~10%) and write (~125%) rates are fixed properties of the pricing model.
Q11: D. This is the recommended hybrid: cache the long document as a stable prefix and use retrieval to point at which sections to focus on. Burst traffic lands inside the 5-minute TTL, so the manual is read at ~10% input cost with low latency, while focusing instructions recover the cross-section reasoning top-K missed. (A) keeps retrieval quality as the bottleneck for cross-references. (B) pays full price and latency on every call. (C) trades away the fidelity the accuracy requirement demands.
Q12: C. Audit-friendly observability means a regulator can trace any decision back to source data: request/conversation IDs threading every call, each tool invocation logged with name, arguments, and result, and every extracted fact tagged with provenance. (A) fails because the one decision under investigation may fall outside the sample. (B) records a post-hoc narrative, not evidence of what data was actually used. (D) preserves reasoning text but not the tool-level data lineage auditors need.
Q13: A. Least privilege is the deterministic control: with a genuinely read-only credential, even a fully successful injection cannot write, regardless of model behavior. The runner-up (C) is probabilistic — a screener reduces the likelihood of injection but one miss still meets write-capable credentials. (B) and (D) are instructions to the model; prompts and descriptions steer behavior but do not constrain a steered model, which is exactly the threat under review.
Q14: B. Every capability an agent carries is context cost and attack surface: the connector's tool definitions are sent with every request (diluting tool selection) and give injected content one more privileged action to aim at, even if it is never legitimately called. (A) and (D) are invented behaviors — there is no registration fee and no keep-warm invocation. (C) is a trivial red herring; the handshake happens once, not per request.
Q15: D. This is the agent-to-agent case: subagents explore with focused, self-contained contexts and only their summaries flow up, so the orchestrator's planning thread stays clean. (A) still lands file contents in the orchestrator's own context — attachment changes who decides, not where the tokens go. (B) is the flooding failure mode in a single call. (C) forfeits interactive, dependency-aware exploration for an async 24-hour-SLA bulk mechanism designed for independent requests.
Q16: C. Tool outputs should be structured and focused; for large data the documented pattern is returning key fields plus a resource URI the model fetches on demand — progressive disclosure at the tool boundary. (A) confuses max_tokens, an output cap, with input context pressure. (B) still parks the full payload in context; an encoded blob costs tokens without being readable. (D) is too late — each 25KB dump has already entered context before it can be summarized.
Q17: A. Progressive discovery pays off when many capabilities are rarely used; here the surface is small, stable, and exercised every session, which is the textbook cached stable prefix — reads at ~10% cost after the first request, with no discovery round-trips that would deterministically load everything anyway. (B) is absolutist; resident-context minimization is a means, not the goal. (C) is false — large stable reference documents are a primary cache_control use case. (D) invents mechanics: breakpoints mark nested prefix units for reuse, they are not parallel read channels.