Q26 of 60 — CCA Practice Exam

Multi-Agent Research System

Your multi-agent research system deploys subagents that autonomously write intermediate findings to disk. After a production incident, you discover that one subagent attempted to overwrite a configuration file in /etc/research-config/ — corrupting the environment for all downstream agents. Post-mortem shows the agent retried the operation three times before failing, because it received no feedback explaining why the writes were rejected. You need a hook-based solution that both prevents the write and stops the retry loop. Which implementation most effectively addresses both failure modes?

A. Configure a PreToolUse hook matched to Write that checks tool_input.file_path; if it starts with /etc, return permissionDecision: 'deny' inside hookSpecificOutput and include a systemMessage explaining that system directories are protected.

B. Configure a PostToolUse hook matched to Write that detects writes to /etc after they complete and triggers a rollback function to restore the original file, then logs the violation for operator review.

C. Strengthen the system prompt for each research subagent with an explicit instruction: "Never write to system directories such as /etc. If a write is blocked, do not retry." This is the lowest-overhead solution and requires no hook infrastructure.

D. Configure a PreToolUse hook without a matcher field so it intercepts all tool calls, then inside the callback return permissionDecision: 'deny' for any file_path starting with /etc. Omit systemMessage to keep the response payload minimal.