CCAR-F sample questions with answers

1. A.

   Resumed sessions read the appended text lazily on the first turn that actually needs it, so the change lands whenever the conversation next touches a topic the instructions cover, which is why the switchover looks abrupt and unrelated to elapsed time.

2. B.

   Appended instructions are cached by the API for a fixed period keyed on their text, so a resumed session reads the previous cached block until the entry expires; the switchover time is the cache lifetime rather than anything about the session itself.

3. C.

   The system prompt is recorded on a session's first request and that record is reused until the session is compacted, so the new text reaches a resumed session only after compaction, or in a new session.

4. D.

   Resumed sessions load the appended text from the transcript rather than from the deploy, and the transcript is rewritten whenever the session is renamed, so the sessions that switched over are the ones whose users happened to rename them.

Choose 3.

1. A.

   The permission rules and other configuration held in the project's standard settings files, which have to be re-applied because a resumed process starts from a blank configuration state.

2. B.

   The fallback model list she supplied with the fallback-model flag.

3. C.

   Any extra working directories she granted with the add-dir flag at launch, and any she added mid-session with the equivalent slash command.

4. D.

   The model the session was using, which otherwise reverts to the account default on every resume regardless of whether that model is still available.

5. E.

   The MCP server configuration she originally loaded with the MCP config flag.

6. F.

   The subagent the session was launched as, which otherwise falls back to the default toolset even when the agent definition is still present in the project.

1. A.

   The replacement only changes what Claude sees; the tool has already run, so the request went out and telemetry such as tool spans and analytics events captured the original output before the hook ran - preventing or reshaping the call needs a PreToolUse hook, and the provider-side exposure needs a change outside the agent.

2. B.

   Post-tool replacement is performed by the runtime rather than in the application process, so neither the raw result nor the request ever exists in the team's environment; the reviewer's questions apply to the provider's systems and not to the agent at all.

3. C.

   The replacement is applied to the tool result before it is recorded, so telemetry holds the masked copy and the reviewer's first question is already answered; only the outbound request needs attention, and rewriting it with updatedToolOutput on the same hook covers that as well, because the field is applied to the recorded request as well as to the result that is delivered onward.

4. D.

   Because the hook returns a masked value, the runtime marks the original result as redacted and drops it from the transcript and from monitoring; the remaining gap is the model's context window, which retains the unmasked copy until the next compaction.

1. A.

   The exploration agent is one-shot and cannot be resumed, so it never gets a second turn in which the memory files would be loaded; delegating the same work to a resumable agent and sending it a follow-up message makes the conventions available on the second turn.

2. B.

   The exploration agent inherits the main conversation's model but not its system prompt, and the memory files are delivered as part of the system prompt, so the conventions are lost along with it; setting the model explicitly on the delegation restores both.

3. C.

   The exploration and planning agents skip the memory files and the git status snapshot that other subagents receive, so a pass that must apply project conventions needs a custom agent, or the conventions written into its prompt.

4. D.

   The exploration agent runs with a reduced tool set that excludes file reads outside the files named in its prompt, so it cannot open the memory file even though it is loaded; adding the memory file to the prompt's file list resolves it.

1. A.

   The second resume displaced the first, so one engineer is working in the original session while the other is in an automatically created copy.

2. B.

   Resuming a completed session replays its history into a new conversation, and the two replays were served from a shared cache of the same analysis.

3. C.

   Resuming does not copy the conversation, so both processes are appending to one transcript and each sees the other's turns interleaved into it.

4. D.

   Each resume created its own copy, and the two are being reconciled into a single history when both processes write to the same directory.

1. A.

   canUseTool is only invoked in interactive sessions that can display a prompt, so the rule holds during manual testing but is skipped in the non-interactive runs the team is using; moving the same code into a PermissionRequest hook restores it.

2. B.

   The callback is only consulted for tools that come from MCP servers, and because the refund tool is registered through the application's own in-process server rather than an external one, the SDK resolves it at the permission mode step instead of calling back into application code.

3. C.

   A call approved earlier in the permission evaluation, including by an allowedTools entry, never reaches canUseTool, so the check is silently skipped; a PreToolUse hook runs before every other step and sees every call.

4. D.

   The callback is being cancelled by its abort signal before it can return a decision, which the SDK treats as an approval; raising the callback's timeout and handling the signal explicitly will make the rule take effect on subsequent refund calls.

1. A.

   The specialists lacked a shared memory, so none could see that another had already covered the earlier shortage; enabling persistent memory on the specialist definition lets them deconflict without coordinator changes.

2. B.

   The coordinator synthesised before all three had returned, so the current-shortage findings arrived too late to be included; making the delegations blocking rather than background resolves the missing coverage.

3. C.

   Three specialists is too few for a topic of this breadth, and the coverage gap is a fan-out problem; the same briefs distributed across ten specialists would cover the current shortage because more searches reach more sources. Coverage shortfalls of this kind are consistently a fan-out problem rather than a briefing defect.

4. D.

   The briefs are too vague to divide the work: with no time window, no distinct angle and no boundaries, specialists independently chose different interpretations and duplicated searches, which is the reported failure mode of simple instructions like these.

1. A.

   Whether the rule protects the data or the agent's behaviour: an invariant that must hold for every caller belongs in the tool, while rules about how this agent works belong in its interception layer.

2. B.

   Whether the agent has the order total in context, because an interception layer can only evaluate a rule using values the model has already retrieved.

3. C.

   Whether the tool returns structured errors, since an invariant can only be enforced where a violation can be reported back in a machine-readable form.

4. D.

   Which team can ship the change sooner, since both placements enforce the rule identically once deployed and only delivery time distinguishes them.

1. A.

   The rule is now deterministic, but the text exceeds the length at which the runtime writes it to a file and passes a path with a preview, so the agent is quoting the preview back to the user; shortening the string resolves both the visibility and the enforcement question.

2. B.

   Injected context is advisory, and the second defect is that additionalContext is not honoured on PreToolUse at all - it is documented for session and prompt events only - so the string is being delivered to the user as an unhandled hook output.

3. C.

   Injected context is still advice, so nothing became deterministic; and the guidance is to write the text as factual statements rather than out-of-band system commands, because command-shaped text can trigger prompt-injection defences and be surfaced to the user.

4. D.

   Injected context is deterministic in the sense that it always arrives, and the real defect is placement: additionalContext returned from a PreToolUse hook is delivered at the start of the next turn rather than with the call, so the agent reads it after the refund has already been attempted.

1. A.

   State that the module was removed and where its responsibilities went, because a failed read tells the agent nothing about what is now true.

2. B.

   Start a fresh session, because a resumed session cannot retract a conclusion once the file it was based on no longer exists.

3. C.

   Ask the agent to treat any file it cannot read as removed, so that a read failure is enough to retire the earlier analysis of it.

4. D.

   Ask the agent to re-read the whole directory, so the absence of the file is evident from what the listing does and does not contain.