Twenty questions covering all five exam domains, roughly in proportion to their official weights (Fundamentals 16%, Architecture 14%, Interactions & Execution 26%, Security & Governance 24%, Use Cases & Ecosystem 20%). Aim for at least 80% before booking the exam.
📝 Check your knowledge
1. What integration problem does MCP primarily solve? A Slow LLM inference B The N×M problem of custom integrations between AI apps and external systems C Lack of GPU availability D Prompt token limits
💡 MCP standardizes how AI applications connect to external tools and data, so N apps and M systems need one shared protocol instead of N×M bespoke integrations. (Fundamentals)
2. Which MCP primitive is model-controlled? A Resources B Prompts C Tools D Roots
💡 Tools are model-controlled: the LLM discovers and invokes them (with human-in-the-loop approval). Resources are application-driven and prompts are user-controlled. (Fundamentals)
3. Which three primitives do MCP servers expose? A Tools, resources, and prompts B Tools, sampling, and roots C Resources, sessions, and schemas D Prompts, models, and agents
💡 Servers provide tools (functions for the model), resources (context/data), and prompts (templated messages/workflows). Sampling and roots are client-side primitives. (Fundamentals)
4. What is the correct cardinality between MCP clients and servers? A One client, many servers B Each client connects to exactly one server (1:1); a host runs many clients C Many-to-many D One client per host maximum
💡 Every client maintains a dedicated 1:1 relationship with a single server. The host creates and manages one client instance per server it connects to. (Architecture)
5. Which transport would a remote MCP server most likely use? A stdio B Streamable HTTP C gRPC D WebRTC only
💡 Streamable HTTP is the standard transport for remote servers. stdio is for local servers launched as subprocesses; gRPC and WebRTC are not standard MCP transports. (Architecture)
6. Can an MCP server read the host's full conversation or see data from other connected servers? A Yes, all context is shared by design B Yes, but only after user consent C No — the host enforces isolation; servers receive only the context sent to them D Only servers using the stdio transport can
💡 A core design principle: servers cannot read the whole conversation or "see into" other servers. The host aggregates context and enforces isolation between clients. (Architecture)
7. A client sends tools/call with a tool name that the server does not expose. How does the server respond? A A result with isError: true B A JSON-RPC protocol error (invalid params, e.g. -32602) C A list_changed notification D It ignores the request
💡 An unknown tool is a protocol error, returned as a JSON-RPC error object. isError: true is reserved for errors during the execution of a valid tool. (Interactions)
8. A tool's external API call times out during execution. What should the server return? A A JSON-RPC protocol error B Nothing; it should close the connection C A successful JSON-RPC response whose result has isError: true and an explanatory message D An elicitation request
💡 Execution failures are reported in-band as tool results with isError: true, so the model can see the error and self-correct. Protocol errors are for malformed or invalid requests. (Interactions)
9. A server wants an LLM completion but has no API key. Which client primitive does it use? A Sampling B Elicitation C Prompts D Roots
💡 Sampling (sampling/createMessage) lets the server request a completion through the client, which controls model access and permissions. Note: Sampling was deprecated in the 2026-07-28 revision — new implementations should integrate with LLM provider APIs directly. (Interactions)
10. How does a client learn that a server's tool list changed? A It must reconnect B Via a notifications/tools/list_changed notification, then re-fetching tools/list C Tool lists can never change D Via the ping response
💡 The server emits notifications/tools/list_changed and the client re-fetches tools/list. In the 2026-07-28 revision, the client must first open a subscriptions/listen stream to receive change notifications. (Interactions)
11. Which primitive would a server use to ask the user for a missing parameter mid-operation? A Sampling B Roots C Elicitation D Progress
💡 Elicitation lets a server request structured input from the user via the client — either an in-band form or, for sensitive data, an out-of-band URL flow. The user can accept, decline, or cancel. (Interactions)
12. Which participant is responsible for obtaining user consent before a tool call? A The server B The LLM C The host D The registry
💡 The host is the policy enforcement point: it enforces security policies, obtains explicit user consent before invoking tools, and controls permissions. Servers never present consent UIs. (Security)
13. "Tool poisoning" refers to: A Rate-limiting a tool until it fails B Malicious instructions hidden in tool descriptions that manipulate the model C Sending malformed JSON to crash a server D Stealing OAuth tokens
💡 Tool descriptions are injected into model context, so a malicious server can hide instructions there. The spec's Tool Safety principle: treat tool descriptions as untrusted unless they come from a trusted server. (Security)
14. Why must an MCP server reject tokens that were not issued specifically for it? A To reduce latency B To prevent token passthrough and confused-deputy attacks C Tokens for other services are always expired D The JSON-RPC spec forbids them
💡 Token passthrough is an explicitly forbidden anti-pattern: servers MUST validate the token audience and MUST NOT accept or forward tokens issued for other services. Accepting them breaks audit trails and lets one compromised service unlock others. (Security)
15. A stdio-based server should write its logs to: A stdout B stderr — never stdout C The tools/call result D The client's console
💡 stdout carries only valid MCP JSON-RPC messages; anything else corrupts the stream. Servers MAY write logs to stderr, which the client can capture, forward, or ignore. (Security / Observability)
16. How should a client treat tool annotations such as readOnlyHint and destructiveHint? A As guarantees enforced by the protocol B As untrusted hints unless they come from a trusted server C As mandatory fields every tool must declare D As instructions for the LLM only
💡 Annotations are optional behavior hints. Clients MUST NOT rely on them for security decisions unless the server is trusted — a malicious server can label a destructive tool readOnlyHint: true. (Security)
17. MCP protocol versions are: A Semantic version numbers (1.2.3) B Date-based strings (e.g. 2026-07-28) agreed between client and server C Implicit and never communicated D Tied to the model version
💡 Versions use YYYY-MM-DD strings, incremented only on backwards-incompatible changes. Older revisions negotiated the version during the initialize handshake; the stateless 2026-07-28 revision declares it per request in _meta. (Ecosystem)
18. Who governs the Model Context Protocol today? A Anthropic, as a proprietary standard B The Agentic AI Foundation (AAIF) under the Linux Foundation, via an open maintainer structure C A consortium of cloud vendors with paid membership D The W3C
💡 Anthropic donated MCP to the Linux Foundation's Agentic AI Foundation in December 2025. Changes are proposed through SEPs (Specification Enhancement Proposals), and the spec is Apache 2.0 licensed. The AAIF also issues the MCPA certification. (Ecosystem)
19. What is the official MCP Registry? A A package manager that hosts and executes MCP server code B A centralized metadata repository of publicly available MCP servers, described via server.json C A private directory for enterprise-only servers D A runtime that proxies all MCP traffic
💡 The registry stores metadata (not code) about public servers in standardized server.json files, with reverse-DNS names verified via GitHub/DNS/HTTP challenges. It is intended for downstream aggregators and is still in preview. (Ecosystem)
20. An organization starting MCP adoption should pilot with: A Write-capable automation across all teams B Low-risk, read-only servers in a controlled host C Unvetted community servers with full permissions D Direct model-to-database connections
💡 Start with least-privilege, read-only integrations in a host you control, then expand scope as governance, auditing, and consent flows mature. (Use Cases)