Claude Certification Blog
Prompt injection and guardrails: what the four Claude exams actually test
Security appears on all four Claude certification tracks, under four different names, at weights ranging from 15% of the paper to no named domain at all. Knowing which one you are sitting decides how much of this you need.
Prompt injection and guardrails are examined on the Claude certification exams, but not evenly and not under a shared name. CCDV-F has a Security and Safety domain worth 8.1% of the paper. CCAR-P has Governance, Safety and Risk Management worth 14%. CCAO-F covers the same territory as Governance, Risk and Responsible Use, worth 15%. CCAR-F has no security domain whatsoever — the material is folded into questions about which tools an agent holds and what its permissions allow. Study “security” as one subject and you will over-prepare for one track and under-prepare for another.
Where it sits on each track
| Track | Where security lives | Weight | What it is called there |
|---|---|---|---|
| CCAO-F | Domain 6 — Governance, Risk and Responsible Use | 15% | Authorisation, policy and responsible use |
| CCDV-F | Domain 7 — Security and Safety | 8.1% | Application security, guardrails, hooks, secrets |
| CCAR-F | No security domain | — | Carried inside tool distribution and permissions |
| CCAR-P | Domain 5 — Governance, Safety and Risk Management | 14% | Guardrail placement, review routing, controls |
The CCAR-F row is the one worth pausing on. A track built entirely around agents, tools and Claude Code has no domain called security — and yet the questions that decide whether an agent should hold a destructive capability, or whether a permission mode is the right one for an unattended run, are asking a security question in a tool-design voice. If you are sitting CCAR-F, you will not find this material by searching for the word. See the published domain weights for what each track actually allocates.
The one idea being tested
Across all four tracks the examinable idea is the same, and it is not a list of attacks. It is that content which reached the model is not the same thing as an instruction you gave the model. A retrieved document, a tool result, a file read from a repository, a web page fetched mid-task — every one of them arrives as text in the same window as your instructions, and none of them carries a label saying so.
That is why the correct answers so rarely involve writing better instructions. Once the boundary is the problem, telling the model to respect the boundary is asking the thing that cannot tell the difference to tell the difference. The controls that work are the ones that sit outside the conversation.
Where a guardrail actually goes
CCAR-P names three placements explicitly and CCDV-F assumes them. A candidate who can put a control at the right one of these three can answer most of the security items on either paper without knowing a single attack technique.
Input screening catches what should never have been processed. Output screening catches what should never be published or parsed. Tool-call authorisation catches what should never happen — and it is the only one of the three positioned where an effect on the world is still preventable. When a scenario describes damage that has already occurred, work backwards through those three and find the one that was missing.
Fail-closed is a choice, and the exam expects you to have made it
When a check cannot reach a verdict — the service is down, the input will not parse, the policy says nothing about this case — something has to happen anyway. Fail-closed means the action stops. Fail-open means it proceeds unchecked. Either can be right for a given system; the failure is leaving it to whatever the code happens to do, which is what a scenario about a validator timing out is usually probing.
The distractor that catches people
The recurring wrong answer on security items is the same one that appears across configuration questions and agent design questions: an instruction offered as a control. It reads well, it is genuinely good practice, and it is not an answer to a question about a requirement that must hold every time.
A useful test on any option is to ask what happens on the run where the model gets it wrong. If the answer is “the rule is violated and nothing notices,” the option was guidance. If the answer is “the call does not execute,” it was a control. Wording strength is irrelevant to that distinction, which is why an option that says never more firmly is not a better option.
The same shape applies to the availability of a capability. An agent that does not hold a destructive tool cannot be talked into using one, and no instruction about restraint achieves the same thing. That is a tool-distribution decision on CCAR-F and a security decision on CCDV-F, and it is the identical judgment either way — see tool use and structured output for how the contract side of that is examined.
Identity, secrets and keys
CCDV-F publishes this as its own skill at 1.6% of the exam — roughly one item on a 53-item paper. That is small enough to skip and easy enough that skipping it is a poor trade. CCAR-P reaches the same material from the architecture side, through an objective on analysing authentication and authorisation requirements to identify gaps.
The examinable content is unglamorous and stable: a credential belongs somewhere the application reads it from rather than somewhere a person pasted it; an identity used by an automated process should carry the narrowest set of permissions that lets the process work; and a key that has been exposed is replaced rather than reasoned about. Nothing here is specific to Claude, which is exactly why it is worth twenty minutes rather than an afternoon.
What is not on the exam
None of the four guides asks you to construct an attack, and no item requires you to recognise a specific payload. The out-of-scope lists are worth reading directly — our guide to what the exams exclude covers them per track — but the short version for this topic is that the examinable skill is architectural. Where does untrusted content enter, what can it reach, and which control stands between it and an effect.
That is good news for preparation. You are not being asked to keep up with a threat landscape; you are being asked whether you can point at the boundary in a described system. The systems in the scenarios are small enough to hold in your head, and the answer is nearly always the option that changes what is possible rather than what is requested.
Key takeaways
- Check your track before you study this. CCDV-F names it at 8.1% and CCAR-P at 14%; CCAO-F calls it governance at 15%; CCAR-F has no security domain at all.
- The idea is the trust boundary. Tool results, retrieved documents and files are content that reached the model, not instructions you gave it.
- Three placements, in order. Screen the input, screen the output, authorise the tool call — and only the third can stop an effect.
- An instruction is not a control. Ask what happens on the run where the model gets it wrong; if nothing notices, the option was guidance.
- Decide fail-closed or fail-open deliberately. A scenario about a check that times out is testing whether you chose at all.
- Do not study attacks. No track asks you to write a payload; every track asks you to find the boundary.
The fastest way to find out whether this lands is a timed mock
Security items are short, and they punish the reflex to pick the most responsible-sounding sentence. Full-length mocks weighted to your track's real blueprint will tell you in one sitting whether you are choosing controls or choosing wording. Our claude certification study guide covers how to sequence them.
See the CCDV-F blueprintQuestions
Frequently asked
The follow-up questions people search next.
Do the Claude certification exams test prompt injection?
Two of the four name it directly. CCDV-F has a Security and Safety domain worth 8.1% of the paper, and CCAR-P has Governance, Safety and Risk Management worth 14%. CCAO-F covers the same ground under Governance, Risk and Responsible Use, and CCAR-F has no security domain — the material appears inside tool design and configuration questions instead.
What does a guardrail question actually ask?
Almost always where the control belongs and whether it decides or merely advises. The three placements are screening what comes in, screening what goes out, and authorising a tool call before it runs. An option that adds an instruction telling the model to be careful is the recurring wrong answer.
Do I need to know how to write an injection payload?
No. None of the four guides asks you to construct an attack. What is examined is recognising that a tool result, a retrieved document or a file is untrusted content that reached the model, and choosing the structural control that contains it.
What does fail-closed mean on the exam?
That when a control cannot reach a decision — the checker is unavailable, the input is unparseable, the policy is silent — the action does not proceed. Fail-open means it proceeds anyway. Scenarios that describe a check timing out are usually testing which default you chose and whether you chose it deliberately.
Is secrets management really examined?
On CCDV-F, yes: Identity, Secrets and Key Management is a published skill worth 1.6% of the exam, which is roughly one item. CCAR-P reaches the same material through an objective on authentication and authorisation requirements. It is small, and it is also the easiest mark on the security material to secure.
Keep reading
Related posts
Not affiliated with, or endorsed by, Anthropic or Pearson VUE. Details are summarised from publicly published program information and can change — always confirm against the official exam guide before booking.