CCDV-F practice › Security and Safety · Question 90 of 92
Security and Safety
A team argues broad agent credentials are acceptable because the agent is internal-only. Is that reasoning sound?
Show answer and explanation
Answer: B — No — internal-only describes network reachability, not what the agent does with content it processes
Indirect injection arrives through documents and tool results, not through the network edge. An internal agent reading an uploaded file is exactly as reachable as an external one.
Keep going
More Security and Safety questions
- An agent processes a scraped webpage that contains hidden text instructing it to email…
- An autonomous agent runs with the full API credentials of the engineer who launched it…
- A support agent's tool output routinely includes customer phone numbers and partial card…
- Where should a production application's Claude API key actually live?
- A retrieved document contains embedded text targeting the model, while a user in chat…