The scenario describes indirect prompt injection: malicious instructions are embedded in third-party content that Claude processes as retrieved evidence. Option A addresses the threat at the appropriate boundary by classifying retrieved material as untrusted, screening it before use, and validating the model’s output before it can influence downstream actions.

Anthropic recommends placing untrusted third-party content in clearly identified tool-result structures, explicitly instructing Claude that retrieved content cannot override system or user instructions, screening tool output for injection attempts, and applying output validation. Mitigate Jailbreaks and Prompt Injections

Citations in Option B improve factual traceability but do not prevent embedded instructions from attempting to redirect model behavior. An outbound destination allow-list in Option C limits the damage that a compromised agent can cause through tool calls, but it does not directly detect or neutralize the injected content. Option D is valuable for detecting behavioral regression after a model change, not for controlling a specific malicious document during runtime.

A production implementation should combine content provenance, structural separation, injection screening, least-privilege tools, output-schema validation, and human confirmation for consequential actions.

Study Guide references/topics: Indirect prompt injection; untrusted retrieved content; input classification; output validation; layered runtime guardrails.

===============

Project-scope configuration is appropriate for shared MCP definitions, permissions, hooks, and other repository-specific behavior that every team member should receive consistently. Managed configuration complements this by enforcing organization-wide security and compliance requirements that individual developers cannot override. Together, these mechanisms separate collaborative project configuration from centrally controlled policy. Editor themes are personal preferences and do not materially establish a secure environment. Allowing each engineer to select an arbitrary model can undermine consistency when model choice affects behavior, cost, or approved-use requirements. Storing a shared API key in a committed project file is a serious credential-management failure. Claude Code documentation identifies .claude/settings.json as the shared project file and managed settings as the highest-precedence organizational policy layer. Claude Code: Settings files and precedence

================

An Architecture Decision Record is designed to preserve a significant architectural choice in a concise, durable, and reviewable form. The context explains the problem, constraints, and forces that shaped the decision. The decision section records the selected approach. Alternatives demonstrate that other viable options were evaluated, while consequences identify benefits, costs, limitations, operational obligations, and residual risks. The date and authors establish accountability and historical sequence.

This structure supports audit because a reviewer can trace why a model, integration pattern, retrieval architecture, security boundary, or deployment approach was chosen. It also supports onboarding by preventing new team members from interpreting intentional design choices as arbitrary implementation details.

A slide deck may communicate a decision at a meeting but is weak as the sole authoritative record when it lacks written rationale. A code comment is too localized and may not capture system-level implications or rejected alternatives. A verbal conversation creates no durable evidence and depends entirely on individual memory.

The ADR should be version-controlled, linked to affected requirements and implementation artifacts, assigned an owner, and reviewed when its assumptions or operating conditions materially change.

Study Guide references/topics: Architecture Decision Records; decision context; alternatives; consequences; auditability; onboarding; lifecycle review.

===============

Yes, Yes, Yes, No, No

Dense vector retrieval represents semantic similarity, making it suitable for matching paraphrases and conceptually related language even when the query and source do not share identical words. Sparse lexical retrieval, including BM25-style matching, retains strong sensitivity to exact tokens and is therefore valuable for identifiers, product codes, technical names, and uncommon terminology.

Structured query retrieval is appropriate when the required operation depends on explicit fields, predicates, joins, counts, grouping, or aggregation over a relational schema. In that situation, generating or invoking a constrained database query is more precise than approximating the operation through semantic similarity.

Hybrid retrieval is not identical to dense retrieval. It combines semantic and lexical candidate sets, typically followed by rank fusion or reranking. Anthropic’s contextual-retrieval guidance explains that semantic search captures meaning and paraphrases, while BM25 captures exact terminology; combining them improves coverage. Contextual Retrieval, Contextual Retrieval Cookbook

Random sampling is not a relevance strategy. It provides no systematic relationship between the query and selected evidence, producing unstable coverage and preventable hallucination risk. Production Q & A requires deterministic or evaluated relevance mechanisms, access filters, suitable indexes, and measurable retrieval metrics such as recall at k.

Study Guide references/topics: Dense retrieval; sparse retrieval; structured queries; hybrid search; rank fusion; retrieval evaluation; production RAG design.

===============

Implementation-ready documentation must provide both executable specifications and preserved architectural reasoning. Option A supplies the contracts an implementation team needs to build components independently: configuration schemas, accepted inputs, produced outputs, validation requirements, and integration boundaries. These details prevent teams from inventing incompatible assumptions about data structures, tool behavior, error handling, or component ownership.

Option B complements the technical contracts with a decision log. Recording the selected design, underlying constraints, alternatives considered, and reasons for rejection enables implementers to distinguish deliberate architectural decisions from accidental omissions. It also prevents previously rejected approaches from being reintroduced without new evidence.

A high-level business narrative in Option C may explain purpose but cannot direct component-level implementation. Contact information in Option D provides an escalation route, but documentation is not sufficient if routine progress still depends on the architect’s availability. Option E records activity rather than a decision; a model list without the selected model and selection rationale leaves critical cost, latency, capability, and evaluation assumptions unresolved.

A strong handoff package should permit implementation, testing, and support teams to proceed while escalating only genuinely new architectural questions.

Study Guide references/topics: Architecture documentation; interface contracts; configuration schemas; Architecture Decision Records; implementation handoff; decision traceability.

===============

A complete handoff package must help different stakeholders understand, operate, troubleshoot, and evolve the Claude-based solution. An architecture overview explains the system’s structure and responsibilities, while Architecture Decision Records document important decisions, alternatives, and trade-offs. Component-level diagrams provide implementation context without forcing maintainers to reconstruct dependencies from source code. Operational runbooks and an on-call playbook enable reliable incident detection, diagnosis, escalation, and recovery. Documenting known limitations is particularly important for Claude applications because model behavior can vary with prompts, context, input distribution, and external dependencies. Options B, C, and D each provide only a partial or temporary understanding of the system. They would create knowledge gaps, increase operational risk, and make future maintenance dependent on individuals rather than durable organizational documentation.

================

Option B is the only configuration establishing the contractual, data-handling, and audit foundations needed for a HIPAA-eligible deployment. Anthropic requires an eligible commercial organization to activate the HIPAA-ready configuration and accept a Business Associate Agreement. A standard Enterprise subscription is not automatically covered merely because it is an enterprise product. Anthropic BAA Guidance

Zero Data Retention may be required for particular covered services, including eligible Claude Code configurations, and is enabled per organization for qualified accounts. Audit logging supports access review, configuration monitoring, incident investigation, and compliance evidence. Anthropic provides audit logs for Enterprise organizations. Claude Code Legal and Compliance, Access Audit Logs

Options A and D use consumer or personal accounts without the required contractual framework. Option C incorrectly treats the elimination of audit evidence as a substitute for a BAA and compliant configuration.

The signed BAA remains the authoritative source for covered products and features. The customer must also configure access control, minimum-necessary data use, workforce policies, retention, integrations, incident response, and vendor-risk controls. The configuration supports compliance; it does not independently guarantee it.

Study Guide references/topics: HIPAA readiness; BAA; ZDR; PHI handling; audit logging; eligible services; shared compliance responsibility.

===============

Credentials must never be supplied as prompt content. Prompts can be retained in traces, debugging output, caches, or logs, and model output may inadvertently expose included secrets. Credentials should instead be resolved server-side through an approved secret store or delegated authentication mechanism. Option C is also a serious gap because post-response RBAC occurs after unauthorized data has already entered model context. Authorization must be enforced before retrieval and prompt construction. Options A, D, and E describe appropriate controls: least-privilege service identities, per-user scoped OAuth, and encrypted transport. Anthropic’s prompt-leak guidance recommends excluding unnecessary sensitive information, while Claude Code security relies on permission-based enforcement rather than natural-language instructions alone. Reduce prompt leak

Project scope is designed for configuration that must be shared by everyone working in a repository. Committing the approved configuration provides versioning, review history, repeatable onboarding, and consistent MCP and permission behavior across the monorepo. User scope is intended primarily for individual preferences and personal rules, so independently maintained user files create configuration drift. Local scope affects only one person in one project and is therefore unsuitable for team-wide distribution. A lead architect’s local configuration cannot establish a shared environment. Claude Code documentation specifically describes .claude/settings.json as the shared project settings file that teams check into source control. Security-critical policies that must not be overridden should additionally be enforced through managed organizational settings rather than relying exclusively on repository configuration. Claude Code: Settings files and precedence

================

A minimal reproduction and MCP status inspection are foundational diagnostic actions because they produce direct, interpretable evidence. A minimal reproduction removes unrelated prompts, tools, settings, hooks, and repository state while changing one variable at a time. This determines whether the failure follows a particular configuration, server, command, model request, or project artifact. It also creates a reproducible evidence package if escalation later becomes necessary.

MCP inspection addresses a common Claude Code failure domain. `claude mcp list` displays configured servers and their health states, including connected, authentication-required, pending-approval, and failed-to-connect conditions. `claude mcp get < name > ` provides server-specific details, while `/mcp` exposes status within an interactive session. These checks distinguish model behavior from transport, authentication, configuration, and workspace-trust failures.

Increasing temperature reduces repeatability and introduces additional variation, making root-cause isolation more difficult. Filing a support ticket before collecting local evidence reverses the appropriate diagnostic sequence. An immediate rollback may eventually be used as a controlled version comparison, but it changes the environment before a baseline has been captured and is therefore not a primary toolkit action.

Study Guide references/topics: [Managing and diagnosing MCP servers](https://docs.anthropic.com/en/docs/claude-code/mcp); minimal reproducible cases; controlled-variable troubleshooting; authentication and connection-state diagnostics.

===============