Claude Certified Architect (CCA-F) Cheat Sheet: Complete Reference [2026]

This is your quick-reference cheat sheet covering all 5 CCA-F exam domains. Bookmark this page and review it the night before your exam.

Exam Quick Facts

The Golden Rule

Programmatic enforcement > prompt-based guidance. On every exam question where both options appear, the answer that uses programmatic mechanisms (hooks, gates, interceptors, schema validation, retry loops) beats the one relying on prompts alone. This is the single most tested distinction across all five domains. If a question asks you to ensure a behavior always happens, the answer is never "add it to the system prompt." The answer is a programmatic mechanism that makes the behavior unavoidable.

Domain 1: Agentic Architecture & Orchestration (27%)

This is the heaviest domain on the exam. Over a quarter of your score comes from understanding agentic loops, multi-agent patterns, and orchestration decisions.

Agentic Loop Control

The fundamental agentic loop follows this cycle: Prompt -> Claude Response -> Check stop_reason -> Act -> Repeat.

• stop_reason = "tool_use" means Claude wants to call a tool. Continue the loop. Execute the tool and append the result to conversation history.
• stop_reason = "end_turn" means Claude considers the task complete. Terminate the loop.
• Between every iteration, append the full tool result to the conversation's messages array. Claude has no memory between API calls — the conversation history IS the memory.
• Token budget: Set a maximum token ceiling for the entire loop. When cumulative usage approaches the budget, inject a system message telling Claude to wrap up within the next 1-2 iterations.

# Canonical agentic loop structure
while True:
    response = client.messages.create(
        model="claude-sonnet-4-20250514",
        messages=messages,
        tools=tools
    )
    if response.stop_reason == "end_turn":
        break  # Task complete
    if response.stop_reason == "tool_use":
        tool_result = execute_tool(response.content)
        messages.append({"role": "assistant", "content": response.content})
        messages.append({"role": "user", "content": tool_result})

Hub-and-Spoke Pattern

The hub-and-spoke pattern is the primary multi-agent architecture tested on the CCA-F. Know these rules cold:

• Coordinator (hub) manages ALL communication between subagents. Subagents never talk to each other directly.
• Subagents have isolated context windows. They do NOT automatically inherit the coordinator's conversation history.
• When delegating to a subagent, the coordinator must explicitly pass all relevant findings in the subagent's prompt. If the coordinator discovered something in step 1 that subagent B needs, it must be included in B's prompt text.
• Parallel execution: The coordinator can emit multiple Task tool calls in a single response. Each spawned subagent runs concurrently.
• Sequential execution: When subagent B depends on subagent A's output, the coordinator must wait for A to complete before launching B.
• Subagent failure is isolated — one subagent's crash does not bring down the coordinator or other subagents.

Session Management

• --resume <session-name> continues a specific prior session with its full conversation history intact.
• fork_session creates an independent branch from a shared baseline. Changes in the fork do NOT propagate back to the original session.
• Sessions are identified by name strings. Use descriptive, consistent naming conventions for production systems.

Escalation Rules

Know exactly when an agent should escalate to a human and when it should NOT:

Escalate when:

• Customer explicitly requests a human agent
• Policy is ambiguous and no clear rule applies
• Agent makes no progress after multiple attempts (deterministic loop detection)
• Action would be irreversible (e.g., deleting data, processing refunds above threshold)
• Conflicting information that cannot be resolved programmatically

Do NOT escalate when:

• Customer expresses frustration (sentiment alone is NOT an escalation trigger)
• Agent's self-reported confidence score is low (confidence scores are poorly calibrated — this is a tested trap)
• The task is simply complex but within defined policy boundaries

Synchronous vs Asynchronous Execution

Token Budget Management

Token budgets prevent runaway agentic loops from consuming excessive resources. Key implementation details:

• Track cumulative input + output tokens across all loop iterations using the usage field in each API response
• When usage reaches ~80% of budget, inject a system-level instruction: "You are approaching the token budget. Summarize your findings and conclude within the next 1-2 iterations."
• Hard-stop at 100% of budget — do NOT rely on Claude to self-terminate. Use a programmatic check outside the loop.
• Budget should account for the growing conversation history — each iteration adds both the assistant response and tool results, making subsequent calls progressively larger.

# Token budget enforcement
MAX_TOKENS = 100000
total_tokens = 0

while True:
    response = client.messages.create(...)
    total_tokens += response.usage.input_tokens + response.usage.output_tokens

    if total_tokens > MAX_TOKENS * 0.8:
        messages.append({
            "role": "user",
            "content": "TOKEN BUDGET WARNING: Summarize findings and conclude."
        })
    if total_tokens > MAX_TOKENS:
        break  # Hard stop — programmatic enforcement

Subagent Design Principles

When designing subagents within a hub-and-spoke system, follow these rules:

• Single responsibility: Each subagent handles one well-defined domain (e.g., security scanning, dependency analysis, code quality)
• Scoped tool sets: Each subagent receives only the 4-5 tools it needs, not the full tool catalog
• Explicit input contracts: Define exactly what data the coordinator passes to each subagent and what the subagent returns
• Timeout boundaries: Each subagent has its own timeout. The coordinator does not wait indefinitely for any single subagent.
• Result normalization: Subagents return results in a standardized format so the coordinator can merge them without parsing multiple schemas

Agent State Machine

Complex agentic workflows can be modeled as state machines:

• States: idle, planning, executing, waiting_for_tool, reviewing, escalating, complete, failed
• Transitions: defined by stop_reason values, tool results, and validation outcomes
• Guards: programmatic conditions that must be true before a transition fires (e.g., "all required fields populated" before moving from extracting to reviewing)
• State machines make crash recovery straightforward — persist the current state and resume from there

Domain 1 Anti-Patterns

• Parsing natural language for loop termination instead of using stop_reason
• Using arbitrary iteration caps (e.g., max_loops = 10) as the primary stopping mechanism instead of semantic completion
• Overly narrow task decomposition that creates unnecessary subagent overhead
• Giving subagents access to the coordinator's full context instead of scoped, relevant information
• Using few-shot examples to enforce tool ordering (ordering = compliance = programmatic enforcement)

Domain 2: Tool Design & MCP Integration (18%)

Tool Description is King

Tool descriptions are the PRIMARY mechanism Claude uses to select which tool to call. Not the tool name. Not the system prompt. The description.

Every tool description should include:

• What the tool does (primary purpose)
• Input formats and expected parameter types
• Example queries the tool handles well
• Edge cases and limitations
• Boundary statements vs similar tools ("Use this for X. Use [other tool] for Y.")

Optimal Tool Count

• 4-5 tools per agent is the optimal range for reliable tool selection.
• At 18+ tools, selection accuracy degrades significantly. Claude starts making incorrect tool choices.
• If you need more than 5 tools, split into subagents with scoped tool sets.

tool_choice Parameter

MCP Configuration

Key MCP rules:

• Environment variable expansion: Use ${GITHUB_TOKEN} syntax in config files. NEVER commit raw secrets.
• MCP Resources expose content catalogs (GitHub issues, documentation, database schemas) as browsable data that Claude can query.
• MCP Prompts are reusable prompt templates served by MCP servers.
• MCP Tools are functions Claude can call through the standard tool-calling interface.

// .mcp.json — project-level, version controlled
{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": {
        "GITHUB_TOKEN": "${GITHUB_TOKEN}"
      }
    }
  }
}

Error Response Design

Critical rules for error responses:

• Always distinguish access failures from valid empty results. "You don't have permission to see results" is NOT the same as "No results found."
• Return structured error context: failure type, what was attempted, partial results (if any), suggested alternatives.
• Silently returning empty results as success is an anti-pattern — it prevents the agent from attempting recovery.

Built-in Claude Code Tools

Tool Description Writing Checklist

A well-written tool description is the difference between reliable tool selection and random misfires. For each tool, verify:

• Purpose statement: One sentence explaining what the tool does. "Searches a PostgreSQL database for customer records matching the given criteria."
• Parameter documentation: Each parameter described with type, format, and constraints. "customer_id (string, UUID format, required)"
• Boundary statement: Explicitly state what the tool does NOT do. "This tool searches existing records. To create new records, use the create_customer tool."
• Example invocations: 1-2 concrete examples. "To find all customers in California: { state: 'CA' }"
• Error behavior: What the tool returns on failure. "Returns { error: 'not_found' } if no matching records exist."

MCP Resource Types

MCP servers expose three types of capabilities. The exam expects you to distinguish them:

• Tools: Functions Claude can call. They take parameters and return results. Example: create_issue, search_documents.
• Resources: Read-only content catalogs that Claude can browse. They represent data, not actions. Example: list of GitHub issues, documentation pages, database schema definitions.
• Prompts: Reusable prompt templates served by the MCP server. They encapsulate domain-specific prompt engineering. Example: a "code review" prompt template with pre-configured instructions and formatting.

Domain 2 Anti-Patterns

• Relying on tool names instead of descriptions for routing decisions
• Loading 18+ tools into a single agent (selection accuracy degrades)
• Not distinguishing access failures from valid empty results in error responses
• Committing raw secrets in .mcp.json instead of using ${ENV_VAR} expansion
• Returning generic "error occurred" without structured context for recovery

Domain 3: Claude Code Configuration & Workflows (20%)

CLAUDE.md Hierarchy

This is one of the most tested topics. Know the hierarchy and the common trap.

CLAUDE.md Content Guidelines

• DO include: coding standards, test commands, architectural decisions, file organization rules, review criteria
• DO NOT include: secrets, API keys, personal preferences that should not apply to the team
• Place frequently referenced rules at the top of the file (beginning-bias in attention)
• Keep each rule specific and actionable: "Run npm test before committing" not "Make sure tests pass"

Custom Skills

Skills are reusable prompt-based extensions for Claude Code. Key frontmatter fields:

---
name: "review-security"
description: "Performs a security-focused code review"
context: fork          # Runs in isolated sub-agent
allowed-tools:         # Restricts available tools
  - Read
  - Grep
  - Glob
argument-hint: "file path or directory to review"
---

• context: fork runs the skill in an isolated sub-agent. This prevents verbose output from polluting the main conversation. Use for skills that produce large outputs.
• allowed-tools restricts which tools the skill can use. Follows principle of least privilege.
• argument-hint tells the user what parameter the skill expects.

Path-Specific Rules

For rules that only apply to certain files or directories:

• Located in .claude/rules/ directory
• Each rule file has YAML frontmatter with a paths field containing glob patterns
• Rules are loaded ONLY when Claude is editing files that match the glob patterns

# .claude/rules/api-standards.md
---
paths:
  - "src/api/**/*.ts"
  - "src/routes/**/*.ts"
---
All API endpoints must validate input using zod schemas.
Return standardized error responses with status codes.

Hooks

Hooks are programmatic enforcement mechanisms — they run shell commands at specific lifecycle events.

Hooks are defined in settings.json:

{
  "hooks": {
    "preToolUse": [
      {
        "matcher": "Bash",
        "command": "python3 /scripts/validate-command.py \"$TOOL_INPUT\""
      }
    ]
  }
}

Plan Mode vs Direct Execution

CI/CD Integration (Headless Mode)

Running Claude Code in CI/CD pipelines requires specific flags:

• -p (or --print) — Non-interactive mode. Prevents the pipeline from hanging waiting for user input. This is the essential flag for CI/CD.
• --output-format json — Machine-parseable output for downstream processing.
• --json-schema <path> — Validates output against a JSON schema.
• --allowedTools — Restricts tools available in headless mode (security best practice).

# Example: CI/CD code review
claude -p "Review the changes in this PR for security issues" \
  --output-format json \
  --allowedTools Read,Grep,Glob

Key CI/CD principles:

• Include prior review findings in the prompt so Claude reports only new or unaddressed issues (avoids duplicate noise).
• Use independent review sessions rather than self-review. When Claude generates code and then reviews it in the same session, it retains the reasoning context and is biased toward finding its own output correct.
• Separate generation from review by using different Claude instances or sessions.

Domain 4: Prompt Engineering & Structured Output (20%)

Prompt Engineering Rules

Explicit criteria beat vague guidance every time.

• "Be conservative" does NOT reduce false positives. Instead, specify: "Only flag issues with severity >= high that have a direct security impact."
• "Be thorough" does NOT improve coverage. Instead, specify: "Check for SQL injection, XSS, CSRF, and authentication bypass."
• Every criterion should be testable — someone reading the prompt should be able to verify whether an output meets the criterion.

Few-Shot Examples

• Use 2-4 targeted examples showing the reasoning behind classification decisions.
• Include the format Claude should use: location, issue description, severity level, suggested fix.
• Show acceptable patterns alongside genuine issues so Claude learns what NOT to flag.
• Show edge cases that are tricky to classify correctly.

<example>
<input>user_age = request.params["age"]</input>
<output>
{
  "location": "line 12, auth.py",
  "issue": "Unsanitized user input used directly",
  "severity": "high",
  "fix": "Validate and cast: int(request.params.get('age', 0))"
}
</output>
</example>

<example>
<input>age = int(validated_data["age"])</input>
<output>
{
  "location": "line 15, auth.py",
  "issue": "none",
  "severity": "n/a",
  "fix": "n/a",
  "note": "Input already validated through schema"
}
</output>
</example>

Structured Output with tool_use

Using tool_use with JSON schemas eliminates syntax errors (malformed JSON, missing fields). It does NOT eliminate semantic errors (wrong values, hallucinated data, incorrect classifications).

Schema design rules:

• Use nullable fields for information that may or may not exist in the source document
• Use "unclear" enum values for fields where the source is ambiguous
• Use "other" + detail string for unexpected categories that don't fit predefined enums
• Every field should handle the "I don't know" case gracefully

{
  "type": "object",
  "properties": {
    "company_name": { "type": "string" },
    "revenue": { "type": ["number", "null"] },
    "fiscal_quarter": {
      "type": "string",
      "enum": ["Q1", "Q2", "Q3", "Q4", "unclear"]
    },
    "industry": {
      "type": "object",
      "properties": {
        "category": {
          "type": "string",
          "enum": ["tech", "finance", "healthcare", "manufacturing", "other"]
        },
        "detail": { "type": ["string", "null"] }
      }
    }
  },
  "required": ["company_name", "revenue", "fiscal_quarter", "industry"]
}

Validation and Retry Pattern

When structured extraction fails validation:

1. Send back to Claude: original document + failed extraction + specific validation errors
2. Claude can fix: format mismatches, structural errors, misclassified fields
3. Claude CANNOT fix: absent information (if the data is not in the source, retrying will not create it)

Retry prompt structure:
- "The following extraction failed validation."
- "Original document: [document]"
- "Failed extraction: [JSON output]"
- "Validation errors: [specific errors]"
- "Please re-extract, fixing only the identified errors."

Batch API

Key Batch API rules:

• Use custom_id to correlate requests with results when the batch completes.
• No guaranteed processing time — plan for up to 24 hours.
• Single request only — you cannot have multi-turn conversations within a batch.
• Ideal for: end-of-day report generation, weekly compliance audits, bulk document extraction.

Multi-Instance Review Pattern

Why self-review is biased:

• When Claude generates code and then reviews it in the same context, it retains the reasoning that led to the original output.
• This makes it biased toward confirming its own work and less likely to catch errors.

Correct approach:

• Use independent Claude instances without the generator's context for review.
• Split reviews into per-file passes (catch local issues) and a cross-file integration pass (catch systemic issues).
• Feed each reviewer only the code to review, not the generation conversation.

Prompt Chaining Pattern

For complex extraction or analysis tasks, break the work into chained prompts:

1. Extract: Pull raw data from the source document using a focused extraction prompt
2. Validate: Run the extraction through schema validation and check for completeness
3. Enrich: Use a second prompt to classify, categorize, or augment the extracted data
4. Format: Convert to the final output schema

Each step uses a separate prompt with its own focused instructions. This is more reliable than a single massive prompt that tries to do everything at once.

System Prompt Best Practices

• Place the role definition first: "You are a security code reviewer analyzing Python applications."
• Follow with explicit criteria: numbered list of what to check for, severity levels, and output format
• Include boundary statements: "Do NOT suggest style changes. Focus only on security vulnerabilities."
• End with output format specification: exact JSON structure, required fields, example output
• Keep system prompts under 2000 tokens for optimal attention allocation

Domain 4 Anti-Patterns

• Using vague guidance ("be conservative") instead of explicit, testable criteria
• Few-shot examples to enforce tool call ordering (ordering requires programmatic enforcement)
• Expecting retries to produce information that is absent from the source document
• Using Batch API for any workflow that blocks a user waiting for a response
• Self-review in the same context instead of independent review instances
• Not including "unclear" or "other" options in enum schemas for ambiguous data

Domain 5: Context Management & Reliability (15%)

Lost-in-the-Middle Effect

Models process information at the beginning and end of the context window well but tend to miss or omit information in the middle. This is a well-documented attention pattern.

Mitigation strategies:

• Extract key facts from lengthy tool outputs and place them in a persistent "case facts" block at the top of the prompt
• Trim verbose tool outputs to only the relevant fields before appending to conversation history
• Place summaries at the input beginning, not buried in the middle
• For long documents, break into focused passes rather than processing everything in one massive context

Error Propagation in Agentic Chains

When a tool or subagent fails in a multi-step chain:

DO:

• Return structured error context: failure type, what was attempted, partial results gathered so far, suggested alternative approaches
• Allow the coordinator to make informed recovery decisions based on the error context
• Preserve partial results — if 3 of 4 tools succeeded, don't discard those results

DO NOT:

• Silently return empty results as success (prevents recovery)
• Return generic failure messages ("An error occurred") without context
• Let one failure cascade to unrelated subagents

// Good error response
{
  "status": "partial_failure",
  "completed": ["repo_scan", "dependency_check"],
  "failed": {
    "tool": "security_scan",
    "error_type": "timeout",
    "attempted": "Full repository security scan",
    "partial_results": "Scanned 47 of 120 files before timeout",
    "alternatives": ["Retry with reduced scope", "Queue for batch processing"]
  }
}

Context Degradation Signals

How to detect when Claude is losing track of context:

• Inconsistent answers: Claude gives different answers to the same question within one session
• Generic patterns: Claude references "typical patterns" or "common approaches" instead of citing specific findings from the current conversation
• Repetitive tool calls: Claude re-runs tools it already ran, suggesting it lost track of prior results
• Hallucinated references: Claude cites information that was never provided

Remediation:

• Use scratchpad files to persist key findings outside the context window
• Spawn subagents for complex subtasks to keep each context window focused
• Use /compact to compress conversation history while preserving essential information

Crash Recovery

For production agentic systems that must survive crashes:

• Agent exports its current state to a manifest file (JSON) at key checkpoints
• Manifest includes: completed steps, pending steps, intermediate results, current position in workflow
• On resume, coordinator loads the manifest and injects its contents into the new prompt
• Agent picks up from the last checkpoint rather than restarting from scratch

// Crash recovery manifest
{
  "workflow_id": "audit-2026-03-28",
  "completed_steps": ["data_collection", "initial_analysis"],
  "pending_steps": ["deep_review", "report_generation"],
  "intermediate_results": {
    "files_scanned": 847,
    "issues_found": 23,
    "critical_issues": 3
  },
  "checkpoint_timestamp": "2026-03-28T14:30:00Z"
}

Human Review and Quality Assurance

The exam tests whether you understand the limits of aggregate accuracy metrics.

• 97% overall accuracy can mask poor performance on specific document types or fields. If 90% of documents are easy and 10% are hard, overall accuracy hides the failure on hard cases.
• Use stratified random sampling: sample by document type AND by field, not just random sampling across the whole dataset.
• Route low-confidence extractions to human review rather than accepting them silently.
• Set thresholds per field and per document type, not one global threshold.

Information Provenance

When Claude synthesizes information from multiple sources:

• Require claim-source mappings: every factual claim must link to a specific URL, document name, relevant excerpt, and publication date
• When sources conflict: annotate BOTH values with their respective attributions. Do NOT silently pick one.
• Distinguish between: direct quotes, paraphrases, and inferences
• Track recency: more recent sources may supersede older ones, but flag the conflict for human review

Context Window Optimization Strategies

The exam tests multiple strategies for managing large context windows effectively:

Summarization Techniques:

• Progressive summarization: After every N tool calls, summarize findings so far and replace the detailed history with the summary
• Hierarchical summaries: Section-level summaries roll up into document-level summaries
• Key fact extraction: Pull out specific data points (names, numbers, dates, decisions) into a structured "case facts" block

Context Pruning:

• Remove successful but irrelevant tool outputs (e.g., "file saved successfully" messages)
• Trim API responses to only the fields Claude needs for the next step
• Replace large code blocks with focused excerpts around the relevant lines

Subagent Offloading:

• When a task requires analyzing 10 files, spawn a subagent for each file rather than loading all 10 into one context
• Each subagent returns a focused summary; the coordinator synthesizes the summaries
• This keeps each context window small and focused, avoiding the lost-in-the-middle problem

Reliability Patterns

Circuit Breaker Pattern:

• After N consecutive failures from a tool or API, stop retrying and switch to a fallback strategy
• Prevents cascading failures and wasted tokens on tools that are down
• Reset the circuit breaker after a cooldown period

Idempotency:

• Design tool calls to be safely retryable without side effects
• If the agent crashes and restarts, replaying the same tool calls should produce the same result
• Critical for crash recovery — the agent can re-execute from the last checkpoint without duplicating actions

Graceful Degradation:

• If a non-critical tool fails, continue with the available information rather than aborting the entire workflow
• Report the degradation in the final output: "Security scan was unavailable. Results include code quality and dependency analysis only."
• Let the human decide whether to re-run with the missing component

Domain 5 Anti-Patterns

• Assuming bigger context = better understanding (lost-in-the-middle still applies)
• Not persisting state for crash recovery in long-running workflows
• Using aggregate accuracy metrics without stratified per-type breakdown
• Silently dropping partial results when one step in a chain fails
• Not tracking information provenance when synthesizing from multiple sources

7 Anti-Patterns Quick Reference

These are the most commonly tested anti-patterns. If you see any of these as answer choices, they are almost certainly wrong.

5 Mental Models for the CCA-F

Use these mental models to quickly evaluate answer choices on exam day. When you are stuck between two answer choices, apply each mental model to see which answer holds up.

1. The Determinism Test: Can this solution fail silently? If yes, it needs programmatic enforcement, not a prompt instruction. Apply this whenever you see an answer that says "instruct Claude to always..." — if a hook, gate, or schema validation can enforce the same behavior, that is the correct answer. Prompts are suggestions. Hooks are guarantees.

2. The Isolation Principle: Does this subagent need access to all this context? If no, scope it down. Less context = more focused = more reliable. Apply this whenever a question involves multi-agent systems. The answer that gives each subagent the minimum necessary context is almost always correct. Full context sharing between agents is an anti-pattern.

3. The Recovery Question: If this step fails at 3 AM with no human available, can the system recover on its own? If no, add structured error context and checkpoint manifests. Apply this to any production scenario question. The answer that includes error context, partial results, and recovery paths is more production-ready than the one that assumes success.

4. The Attention Budget: Is the critical information buried in the middle of a massive context? If yes, extract it to the beginning or split into focused passes. Apply this whenever a question involves long documents, large codebases, or multi-file analysis. "Process everything in one pass" is almost always wrong for large inputs. "Split into focused per-file passes with a final integration pass" is almost always right.

5. The Calibration Check: Is the system relying on Claude's self-assessment of its own confidence or quality? If yes, replace with external validation (human review, schema checks, deterministic rules). Apply this whenever you see "confidence score" or "self-evaluation" in an answer. Claude's self-reported confidence is poorly calibrated. Deterministic thresholds and external validation are reliable.

6 Production Scenarios

The exam presents 6 scenario-based sections. You choose 4. Each scenario tests multiple domains through a realistic production use case.

• Automated Code Review Pipeline — Tests agentic loop design with stop_reason termination, CI/CD integration with the -p flag for headless mode, independent review sessions (not self-review), and structured output schemas for review comments. Expect questions about when to use Plan Mode vs Direct Execution and how to avoid duplicate findings across review passes.

• Customer Support Escalation System — Tests escalation rules (ambiguity triggers escalation, sentiment alone does not), hub-and-spoke orchestration with isolated subagents for different support domains, session management with --resume for continuing conversations, and programmatic human handoff triggers. Expect questions about why self-reported confidence scores are unreliable for escalation decisions.

• Document Extraction at Scale — Tests structured output schemas with nullable fields for missing data, "unclear" enum values for ambiguous fields, Batch API for overnight bulk processing (50% savings, no SLA), validation-retry loops (retries fix execution errors but not information gaps), and stratified human review sampling by document type AND field.

• Multi-Repository Security Audit — Tests parallel subagent execution (coordinator spawns concurrent scanners), tool scoping (4-5 tools per scanning subagent), error propagation with structured partial results (3 of 4 repos scanned successfully), crash recovery via manifest files, and token budget management across multiple parallel loops.

• Knowledge Base Q&A System — Tests information provenance with claim-source mappings, source conflict handling (annotate both values with attribution, never silently pick one), lost-in-the-middle mitigation (extract key facts to beginning of prompt), context degradation detection (references to "typical patterns" instead of specific findings), and progressive summarization for long conversations.

• CI/CD Compliance Enforcement — Tests hooks in settings.json for programmatic enforcement (preToolUse, postToolUse, preCommit), CLAUDE.md hierarchy for team coding standards (project-level, not user-level), path-specific rules in .claude/rules/ with glob patterns, and headless mode flags (-p, --output-format json, --allowedTools). Expect questions about why hooks beat CLAUDE.md instructions for compliance requirements.

Configuration Syntax Quick Reference

.mcp.json (Project-Level MCP Config)

{
  "mcpServers": {
    "server-name": {
      "command": "npx",
      "args": ["-y", "@scope/server-package"],
      "env": {
        "API_KEY": "${API_KEY}"
      }
    }
  }
}

CLAUDE.md (Project Standards)

# Project Standards

Testing

• Run npm test before every commit
• Maintain >80% code coverage

Code Style

• Use TypeScript strict mode
• No any types in production code

Architecture

• All API routes in src/routes/
• Shared types in src/types/

### settings.json (Hooks)

```json
{
  "hooks": {
    "preToolUse": [
      {
        "matcher": "Bash",
        "command": "python3 validate.py \"$TOOL_INPUT\""
      }
    ],
    "postToolUse": [
      {
        "matcher": "Edit",
        "command": "npx eslint --fix \"$TOOL_OUTPUT_PATH\""
      }
    ]
  }
}

Custom Skill Frontmatter

---
name: "skill-name"
description: "What this skill does"
context: fork
allowed-tools:
  - Read
  - Grep
  - Glob
argument-hint: "path to analyze"
---

Path-Specific Rules

# .claude/rules/test-standards.md
---
paths:
  - "**/*.test.ts"
  - "**/*.spec.ts"
---
Use describe/it blocks. Mock external dependencies.
Test both happy path and error cases.

Critical Distinctions Cheat Sheet

These are the pairs of concepts the exam expects you to distinguish. Getting these wrong accounts for most failed questions.

Additional Distinctions to Know

These secondary distinctions appear less frequently but still show up on the exam:

Exam Day Strategy

Time Management

You have 120 minutes for 60 questions — that is 2 minutes per question on average. But the 4 scenario sections take longer than standalone questions.

• First 10 minutes: Read all 6 scenario introductions. Choose your 4 strongest. Mark the 2 you will skip.
• Minutes 10-90: Work through your 4 chosen scenarios. Spend no more than 20 minutes per scenario.
• Minutes 90-110: Answer the remaining standalone (non-scenario) questions.
• Minutes 110-120: Review flagged questions. Do NOT change answers unless you are certain of an error.

Question Analysis Framework

When you read a question, identify these three things before looking at the answer choices:

1. Which domain is this testing? (Architecture, Tools, Config, Prompts, or Context)
2. Is this a "what" question or a "what NOT" question? Many questions ask you to identify the anti-pattern.
3. Does the Golden Rule apply? If any answer uses programmatic enforcement where others use prompts, the programmatic answer is almost certainly correct.

Common Trap Patterns

The exam uses specific patterns to create plausible-sounding wrong answers:

• The "update the prompt" trap: An answer that says "modify the system prompt to instruct Claude to..." when a programmatic alternative exists. Always wrong.
• The "increase context" trap: An answer that says "increase the context window size" to solve attention problems. Always wrong — use focused passes instead.
• The "confidence score" trap: An answer that says "use Claude's self-reported confidence to decide whether to escalate." Always wrong — use deterministic thresholds.
• The "more examples" trap: An answer that says "add more few-shot examples to enforce ordering." Wrong for compliance requirements — use programmatic gates.
• The "aggregate accuracy" trap: An answer that says "97% accuracy validates the system is working." Wrong without per-type stratified breakdown.

Domain Weight Distribution

Understanding how the exam weights each domain helps you allocate study time:

Pre-Exam Review Checklist

Use this checklist to verify you have covered every testable concept before sitting the exam.

Next Steps

You have the complete quick-reference for every testable CCA-F concept. For deeper explanations of any topic covered here, return to the Complete CCA-F Guide or the Domains Breakdown.

When you are ready to test your knowledge under exam conditions, visit our CCA-F Practice Exams for timed, scenario-based practice questions that mirror the real exam format.