Team Wants Connect Production Question Explained
This worked AI Engineer Interview practice question tests Reliability and Safety. Try the answer first, then review why C is the best choice.
Short answer
The correct answer is C. Admit it with scoped credentials, filesystem and network isolation to exactly what the tool needs, pinned version, and gateway-side schema validation — or not at all..
Untrusted code gets least privilege enforced by the runtime, and an unclear update policy means today's audit doesn't cover tomorrow's version — pin it. The key is to match the exact action in the prompt to the tool, command, or concept that performs that action directly. Here, C. Admit it with scoped credentials, filesystem and network isolation to exactly what the tool needs, pinned version, and gateway-side schema validation — or not at all. is the only option that satisfies the scenario without adding unrelated behavior.
The Question
A team wants to connect a production agent to three third-party MCP servers. One requests filesystem access beyond the directory its tool needs, and its update policy is unclear. What is the admission decision?
Why C is correct
Untrusted code gets least privilege enforced by the runtime, and an unclear update policy means today's audit doesn't cover tomorrow's version — pin it. The key is to match the exact action in the prompt to the tool, command, or concept that performs that action directly. Here, C. Admit it with scoped credentials, filesystem and network isolation to exactly what the tool needs, pinned version, and gateway-side schema validation — or not at all. is the only option that satisfies the scenario without adding unrelated behavior.
Why the other options are wrong
Option A does not match the requirement in the prompt. The correct answer is C because Untrusted code gets least privilege enforced by the runtime, and an unclear update policy means today's audit doesn't cover tomorrow's version — pin it.
Option B does not match the requirement in the prompt. The correct answer is C because Untrusted code gets least privilege enforced by the runtime, and an unclear update policy means today's audit doesn't cover tomorrow's version — pin it.
Option D does not match the requirement in the prompt. The correct answer is C because Untrusted code gets least privilege enforced by the runtime, and an unclear update policy means today's audit doesn't cover tomorrow's version — pin it.
Key idea: Reliability and Safety
Every question is a production situation an AI engineer interviewer can put to you: a failing endpoint, a cost spike, an agent that loops, an eval that disagrees with users. The best answer is almost always the one that measures or contains the problem before it changes the model or the prompt. If you miss a question, note which habit it tests: decompose before you fix, put the security boundary where the side effect happens, and trust an eval only after you check what it covers. The 12 open-ended questions with answer guides are at aijobprep.app/questions/ai-engineer.html.
Ready to test the full skill?
Take the free AI Engineer Interview quiz and find the exact basics to review next. No signup required.
Practice related questions
Same skill area or adjacent concept. Use these after reviewing the explanation.