# Applied AI — Advanced Level — Session 5 # Validation quiz: MCP in depth **Instructor:** Yann Isola **Format:** 10 MCQs (multiple choice questions) — only one correct answer per question. **Recommended passing threshold:** 8/10 (certification level). **Duration:** 15 min. --- **Q1.** In MCP architecture, what is the relationship between clients and servers? - A. A client can connect to several servers simultaneously - B. A server requires a dedicated client: the relationship is strictly 1:1, and it is the host that instantiates one client per server - C. Servers communicate directly with each other to share context - D. Client and server are the same process, logically separated **Answer: B.** 1:1 isolation is a deliberate security choice: each server is a separate process with its dedicated client; only the host has the overview. (A describes the role of the host, not the client; C is explicitly prohibited by the security model; D confuses stdio-subprocess with process merging.) --- **Q2.** What message format is used by MCP on all its transports? - A. Protocol Buffers (protobuf) - B. XML-RPC - C.JSON-RPC 2.0 - D.GraphQL **Answer: C.** All MCP messages are JSON-RPC 2.0: requests (with `id`), responses (even `id`, `result` or `error`) and notifications (without `id`). --- **Q3.** A developer adds `print("étape 2 OK")` in his MCP server in stdio transport, to debug. Consequence? - A. None: the message appears in the host logs - B. JSON-RPC stream on stdout is corrupted, client fails to parse messages; logs should go to stderr - C. The message is automatically converted to MCP notification - D. The server restarts properly **Answer: B.** In stdio, stdout is reserved for the JSON-RPC stream (one JSON message per line). Any parasitic writing corrupts it. stderr remains available for logging. --- **Q4.** What transport do you recommend for a multi-tenant enterprise MCP server, serving hundreds of users authenticated via OAuth 2.1? - A. stdio, for minimum latency - B. SSE (Server-Sent Events), the current standard for remote - C. Streamable HTTP, which replaces SSE for remote servers - D. Raw WebSocket, only bidirectional transport **Answer: C.** Streamable HTTP is the common remote transport: POST to a single endpoint, response flow possible, sessions via `Mcp-Session-Id`, standard web authentication. SSE alone is depreciated (trap B). stdio (A) is reserved for single-user local. --- **Q5.** Central certification question: What fundamentally distinguishes the three MCP primitives? - A. The data format: text for Prompts, JSON for Tools, binary for Resources - B. The invocation controller: the model for Tools, the application for Resources, the user for Prompts - C. Transport: Tools in stdio, Resources in HTTP, Prompts in both - D. The meaning of the data: Tools in writing, Resources in reading, Prompts in reading/writing **Answer: B.** This is THE discriminating criterion: *model-controlled* / *application-controlled* / *user-controlled*. D is the attractive trap: read/write is a frequent correlation, not the criterion — a search triggered by the model is a Tool even though it is reading. ---**Q6.** The agent must be able to search for a customer by name in the CRM when the conversation requires it, on their own initiative. What primitive? - A. Resource, because it is a read-only operation - B. Prompt, because the search starts from a user request - C. Tool, because it is the model which dynamically decides to trigger the search - D. Notification, because the CRM pushes the data **Answer: C.** Classic exam trap: “reading ⇒ Resource” is wrong. The criterion is the controller: here the model decides during the reasoning ⇒ Tool, with a JSON Schema describing the argument `nom`. --- **Q7.** What is the purpose of capacity negotiation during the `initialize` handshake? - A. To encrypt the connection between client and server - B. To allow a client and a server of different versions to cooperate on the intersection of what they support, without breaking compatibility - C. To measure transport latency before opening the session - D. To authenticate the user to the server **Answer: B.** Client and server each declare their capabilities (tools, resources, prompts, subscriptions, sampling...). The protocol can thus evolve: each person only uses what the other has declared. Neither encryption (A), nor authentication (D) — these come under transport. --- **Q8.** An MCP server exposes `rembourser_commande`. The business requirement: block any reimbursement greater than $500. Where to place this control so that it resists a prompt injection? - A. In the agent's prompt: "never refund more than $500" - B. In the description of the Tool, so that the model limits itself - C. In server code, which refuses and returns an escalation status regardless of what the model requests - D. In the user interface, hiding the amount field **Answer: C.** Defense in depth: a check in the prompt or description (A, B) is only a suggestion, which can be bypassed if the model is manipulated. The server-side guardrail is applied mechanically. (A and B remain useful as a complement, never alone.) --- **Q9.** A dashboard should automatically refresh when a configuration file changes on the server side. What MCP mechanism? - A. Query `resources/read` in a loop every second (polling) - B. Subscribe via `resources/subscribe`; the server issues `notifications/resources/updated` and the host rereads the resource - C. Expose the file as a Tool that the model calls regularly - D. Use `notifications/tools/list_changed` **Answer: B.** This is the resource subscription pattern — provided that the client has declared the corresponding capacity in the handshake. A (polling) wastes; C gives the model an infrastructure responsibility; D is about dynamic tool registration, not resources. --- **Q10.** Your client aggregates two MCP servers: one returns dates in the format `15/03/2026`, the other `27 Mar 2026`. What is good architectural practice? - A. Let the model interpret the formats: LLMs understand dates - B. Standardize at the integration boundary to a canonical format (ISO 8601) in the server or client, never rely on the model to guess - C. Reject the third-party server until it adopts your format - D. Convert all dates to Unix timestamps in prompts**Answer: B.** The standardization of heterogeneous data (dates, currencies, units) is done in code, at the border — the MCP server plays the role of anti-corruption layer. Counting on model (A) introduces silent errors (ambiguity 03/04: April 3 or March 4?); This is unrealistic with third-party servers; D degrades readability without addressing the substance. --- ## Scale and remediation | Score | Reading | |---|---| | 9–10 | Certification level achieved on this module | | 7–8 | Review missed questions; reread Block 3 (primitives) if Q5/Q6 failed | | ≤ 6 | Resume the complete guide + repeat Exercise 3 before continuing | **Most discriminating questions for the exam:** Q5, Q6 (primitive controller) and Q4 (transport). Any errors on these three should trigger a focused review.