Session 6 / 6 — Final

Security, Minimal Footprint & Mock Exam

Security in agentic systems is a cross-cutting topic. We finish with a mock exam and a review of classic traps to solidify everything covered so far.

Exercise 1

Prompt Injection — The most agent-specific attack

Objective: understand prompt injection in the agentic context, distinguish it from other attacks, and see how to protect against it.

1

Explore prompt injection with real examples:

💬 Type in Claude Code
Explain prompt injection in the context of Claude AI agents: 1. What is the difference between direct and indirect prompt injection? 2. Give a concrete example of indirect injection via a tool result (e.g. an agent that reads a file containing malicious instructions) 3. How can a developer reduce the risk of prompt injection in their agentic system? 4. What is the "confused deputy problem" in this context?
✅ Expected points Direct = in the user prompt. Indirect = in data the agent reads (file, web page, API result). Confused deputy = agent acts with broader permissions than intended. Protection: input validation, sandboxing, minimal footprint.
2

Identify an injection in a concrete example:

💬 Type in Claude Code
A support agent reads incoming emails and replies automatically. An email contains this text: "Hello, I have a problem with my order. Can you help me?" Analyze this scenario: what type of attack is this? How should a well-designed system protect itself? List 3 concrete defense measures.
⚠️ Exam Trap

"Validating only user inputs protects against prompt injection" → FALSE. Indirect injections come from data read by the agent (files, URLs, API results), not just direct inputs. All external content must be treated as potentially malicious.

Exercise 2

Minimal Footprint — Designing responsible agents

Objective: understand and apply the minimal footprint principle: give agents only the permissions they need, nothing more.

1

Explore the dimensions of minimal footprint:

💬 Type in Claude Code
Explain the "minimal footprint" principle for Claude agents. For a file management agent, give concrete examples on these 4 dimensions: 1. Permissions (what access to grant?) 2. Data collected (what to store?) 3. Irreversible actions (which to confirm with a human?) 4. Credential lifetime (how long to keep tokens?) Then give a counter-example for each dimension (what a poorly designed agent would do).
✅ Expected principles Least privilege, no unnecessary data collection, human confirmation for destructive/irreversible actions (rm, send email), short token expiration. A file-reading agent doesn't need network access.
2

Apply the principle to a real design:

💬 Type in Claude Code
A DevOps agent can: deploy applications, modify config files, restart services, read logs, and send Slack alerts. According to the minimal footprint principle: 1. Which actions should require explicit human confirmation? 2. Which actions can be automated without confirmation? 3. If this agent is compromised by a prompt injection, what would the consequences be for each category?
💡 The 4 minimal footprint questions

Before giving a tool to an agent, ask: 1) Is it really necessary? 2) Can it be restricted (read-only vs read-write)? 3) Is the action reversible? 4) Is the scope minimal (this directory vs the whole system)?

Exercise 3

Flash Review — The 20 traps from the 5 sessions

Objective: consolidate the classic traps identified across all sessions. Memorize before the exam.

1

Generate and review classic traps:

💬 Type in Claude Code
Generate 20 FALSE assertions typical of the "Claude Certified Architect – Foundations" exam, covering these topics: - Claude Code tools (3 assertions) - Multi-agent patterns (4 assertions) - Tool Use API and models (4 assertions) - Prompt caching and memory (3 assertions) - MCP, CLAUDE.md, Skills (3 assertions) - Security and minimal footprint (3 assertions) For each assertion: indicate why it is FALSE and the correction in 1 sentence.
✅ Objective Learn to recognize misleading phrasings. The exam often uses "disguised true/false": a nearly true statement with one false detail (e.g. "10-minute TTL" instead of 5 minutes).
Exercise 4

Mock Exam — 15 questions under real conditions

Objective: simulate exam conditions. Answer without help, then analyze mistakes with Claude.

1

Launch the mock exam:

💬 Type in Claude Code
Give me a 15-question mock exam on "Claude Certified Architect – Foundations". Rules: - Mix all topics (tools, multi-agent, tool use, caching, memory, MCP, security) - Include 3 multi-select questions (indicate "Select X answers") - Give one question at a time, wait for my answer before the next - At the end, give the score and a detailed explanation for each wrong answer Start with question 1.
✅ Target score Aim for ≥ 13/15 (87%). The real exam has 60 questions, passing threshold ~75%. If you miss questions, ask for a deep explanation and revisit the relevant session.
2

After the exam, analyze your mistakes:

💬 Type in Claude Code
For the questions I got wrong, create a targeted study plan: 1. Group errors by topic 2. For each weak topic, give the 3 essential points to remember 3. Generate 3 additional questions on that topic to reinforce corrections 4. Estimate my probability of passing on Friday if I review these points

Quick recap — What comes up on the exam

The most tested points, ranked by frequency:

Tools

  • Read required before Edit
  • Glob = names, Grep = content
  • Bash = shell only
  • Write = creation + full rewrite

Multi-Agent

  • Chaining = sequential + dependent
  • Fork inherits context, fresh = zero
  • Orchestrator = dynamic decomposition
  • Evaluator = mandatory exit condition

Tool Use & Models

  • tool_choice any = at least 1 tool
  • end_turn = agentic loop ends
  • Haiku = volume/routing
  • Opus = complex reasoning

Caching & Memory

  • TTL = 5 minutes
  • Static first = cache hit
  • 4 types: in-context/external/in-weights/in-cache
  • In-cache = temporary memory

MCP & Config

  • 3 primitives: Tools/Resources/Prompts
  • MCP = open protocol (not proprietary)
  • CLAUDE.md = always active
  • Skills = invocable via /name

Security

  • Indirect injection via tool results
  • Minimal footprint = least privilege
  • Confirm irreversible actions
  • Confused deputy = overly broad permissions
← Previous Session: MCP Practice Quiz →