Top CCDV-F Mistakes (and the Traps That Cost Real Points)

The single most common security misconception: telling Claude "never reveal the system prompt" or "never execute destructive commands" and treating that instruction as if it were enforcement. It isn't. "The model was told not to do X" and "the application technically prevents X" are different guarantees, and the exam consistently rewards the second one.

This shows up concretely in indirect-injection questions: the documented mitigation isn't "tell Claude to ignore instructions in documents," it's structural — put untrusted content only in tool_result blocks, label its source, JSON-encode it, and never place your own instructions inside a tool_result (that's the exact pattern an attacker would exploit).

"The app gave a wrong answer" can mean four different things — an API-layer failure, a tool-execution failure (is_error: true), a prompt/context problem, or a genuine model-output problem — and each needs a different fix. Candidates lose points by defaulting to whichever layer they personally find easiest to reason about, usually "the prompt needs work," even when the actual cause is a broken tool or a max_tokens truncation.

A recurring exam-trap shape: a fact that's true for one model tier and false for another, presented as if it were universal. Current examples worth memorizing explicitly rather than pattern-matching:

• temperature/top_p/top_k are accepted on older/mid tiers but rejected with a 400 error on the newest tier (Opus 5, Fable 5, Sonnet 5) — code that conditionally sets these must account for the target model.
• Extended thinking uses thinking: {type: "adaptive"} plus output_config.effort on Fable 5/Opus 5/Sonnet 5 — the older budget_tokens mechanism only still works on Haiku 4.5.
• The minimum cacheable prompt prefix varies by model — as low as 512 tokens on the newest tier, up to 4,096 tokens on older models. A short prompt can silently fail to cache; you must check cache_creation_input_tokens/cache_read_input_tokens in the response to confirm caching actually happened, not assume it did.

Two related over-trust mistakes. First: assuming a retry-on-failure strategy is automatically safe. The Messages API has no documented idempotency-key mechanism — if a tool call has a side effect (charging a card, sending an email) and the request is retried after a timeout, the side effect can duplicate unless the application builds its own dedup. Retryable-vs-permanent error classification (429/500/504/529/network are retryable; 400/401/402/403/404/409/413 are not) tells you whether to retry, not whether retrying is safe.

Second: assuming a structured-output feature guarantees correctness. "The model returned syntactically valid JSON" and "the output is semantically correct" are different guarantees — defensive parsing and schema validation on the receiving end are required regardless of how the output was requested, not an optional extra step.

Anthropic's own guidance is explicit: "optimizing single LLM calls with retrieval and in-context examples is usually enough" for many applications. An agent trades latency and cost for capability and introduces compounding-error risk across a multi-step loop. If the control flow can be fully diagrammed in advance, it's a workflow (or a single call), not an agent — and the exam rewards recognizing when a simpler shape already solves the problem.

The same over-engineering pattern shows up in tool selection: standing up an MCP server for a single, one-off integration that only one application will ever consume is unjustified overhead — MCP's payoff comes from reuse across multiple clients/hosts, not from any one integration.

This is the freshest domain on a freshly-launched exam, and it changed substantially on 2026-07-28. If your MCP knowledge predates that revision, several "facts" you remember are now the wrong answer.

Claude Code has its own recent shift worth knowing: auto permission mode — where a second classifier model reviews most actions instead of requiring human approval each time — became the built-in default on paid plans as of mid-August 2026, replacing the older simple allow/ask/deny mental model as the primary hands-off path. And custom slash commands were merged into Skills — a .claude/skills/<name>/SKILL.md file now creates the /name command, and skill bodies load into context on demand rather than sitting permanently in context the way CLAUDE.md does.

bypassPermissions mode is documented as intended for containers or VMs running as a non-root user — a sandboxed, isolated environment where a mistaken action has bounded blast radius. Using it on a general workstation to skip permission prompts is exactly the scenario it's designed against, and an option describing that usage is a distractor regardless of how much friction it removes.