CCDV-F - Security and Safety (8.1% of the exam) - Section 7.3
Leverage hooks for guardrails and safety controls within Claude applications.
Published skill weight 1.0 percent, the smallest skill on the exam. Covers using hooks as the mechanism that prevents a destructive action deterministically, in contrast with instructing the model not to take it, which is a probabilistic control rather than a guarantee.
hooks as guardrailspreventing destructive actionsdeterministic control versus instruction
Practice question for this objective
lock_openFree sampleSecurity and Safetymedium
A reporting assistant answers questions from a customer database through one tool that executes a query. The tool handler holds a database credential that can read and write every table. A written instruction in the system prompt tells the assistant to read data and never modify it. A security reviewer states that the assistant must not be capable of modifying the database at all, while it must continue to answer the same reporting questions. Which change satisfies the reviewer?
AAsk the assistant to include the intended operation type in its tool arguments and have the handler reject anything the assistant labels as a write, so a modifying query is turned away before it reaches the database.
BKeep the existing credential and record every executed query in an audit store, alerting the security team whenever a statement that modifies data is observed against the reporting tables.
CRestate the read-only restriction in the tool description as well as the system prompt, so that the constraint is visible at the point where the assistant decides how to call the tool.
DReplace the credential the tool handler uses with one granted read permission on the reporting tables only, so that any modifying statement is refused by the database itself.check_circle Correct
Scope what an agent's credentials permit rather than instructing the model to restrain itself from using them. Least privilege puts the boundary in the system that grants access. A credential with read permission only means the database refuses a modifying statement regardless of what the model generates, so the capability does not exist rather than being discouraged.
Why A is wrong: A declared operation type looks like a check, but the label is produced by the model rather than derived from the query, so a mislabelled write would pass the handler and reach a credential that can execute it.
Why B is wrong: Query auditing is a sound practice and gives useful evidence, but it observes a modification that has already happened rather than preventing one, and the reviewer asked that the capability be absent.
Why C is wrong: Placing guidance in the tool description does improve how the tool is used, which is why this is tempting, but it remains a request to the model and leaves the write capability fully available to the handler.
Why D is correct: The capability is removed at the layer that enforces it, so no query the assistant can produce is able to modify data, and the reporting questions still resolve against the tables the credential can read.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CCDV-F bank for this domain.
Reduce the sampling temperature on every request so the assistant follows the system prompt more closely and stops acting on wording it finds inside message bodies.
errorWhy it is wrong: Tempting because a lower temperature does make output more deterministic, so it feels like a way to make the assistant obey its instructions. It is not a security control: an injected instruction that the model treats as a legitimate request is followed just as reliably at low temperature.
Keep the deletion tool and require the assistant to state the owner's name and the reason in the tool arguments, so that every deletion carries an attributable justification in the call record.
errorWhy it is wrong: Richer arguments give a useful audit trail, which is why teams reach for this, but the model supplies those arguments itself and the deletion still executes on its say-so, so an unapproved deletion remains possible.
State a limit of 200 price changes per run in the agent's system prompt, and instruct it to stop and report once it believes that figure has been reached during the run.
errorWhy it is wrong: A stated limit reads as a clear boundary and often holds, but an instruction is advice the model may miscount or disregard, and the faulty run in question was one where its own judgement was already wrong.