CCAR-P Practice Test 15 — 15 Questions

Question 1

A healthcare provider is using Claude to summarize patient clinical notes. Which governance control is most critical to prevent potential HIPAA violations?

Accepted Answer

Ensure that a Business Associate Agreement (BAA) is in place and strictly enforced.. The most critical control is ensuring that all data processed by the API is encrypted in transit and at rest, and that the organization has a Business Associate Agreement (BAA) with Anthropic. Without a BAA, the provider cannot legally process PHI. This legal framework, supported by technical encryption, is the foundational requirement for any healthcare entity utilizing cloud-based AI services to maintain regulatory compliance.

Answer

Use a custom model fine-tuned on public medical journals to avoid using patient data.

Answer

Implement a strict 24-hour limit on the storage of all processed clinical summaries.

Answer

Anonymize all patient notes by removing names before sending them to the API.

Question 2

An organization is conducting a risk assessment for an AI application. They are concerned about 'model drift' over time. Which governance action is most appropriate to manage this risk?

Accepted Answer

Conduct periodic evaluation against a golden dataset.. Model drift refers to the degradation of model performance as the environment or data distribution changes. Periodic re-evaluation against a baseline 'golden dataset' is a standard governance practice to ensure the model remains reliable. This proactive monitoring allows teams to detect performance drops, adjust system prompts, or re-train/update the model, ensuring that the AI remains safe and effective for its original intended use case.

Answer

Increase the system prompt complexity.

Answer

Switch to a different model provider immediately.

Answer

Automate user feedback loops for real-time retraining.

Question 3

A stakeholder group wants to use the Claude API for a new public-facing application. What is the first thing you should discuss with them?

Accepted Answer

The scope of safety guardrails and moderation policies required for public usage.. Before any technical implementation, understanding the regulatory and safety requirements of a public-facing application is the most important step. Public exposure introduces significant risks related to brand reputation, security, and potential legal issues. Starting the conversation here ensures that all safety guardrails, including content filtering and misuse protection, are properly addressed, which is essential for a safe and successful public release of AI-powered tools.

Answer

The choice of programming language for the application frontend.

Answer

The implementation of rate limits to optimize the API cost structure.

Answer

The timeline for the marketing launch of the new application.

Question 4

Refer to the exhibit. An application developer is testing a model endpoint. Which security control should be prioritized to prevent the specific risk demonstrated in the exhibit?

Accepted Answer

Implement prompt engineering guardrails and input validation.. The exhibit illustrates a prompt injection attempt aimed at extracting sensitive system instructions. To mitigate this, developers should implement strict input validation and use robust system prompt design. Applying these controls is vital because prompt injection can lead to unauthorized data exposure, policy bypasses, and reputational damage. Governance frameworks must mandate rigorous red-teaming and input sanitization to protect the integrity of the model's operational logic against adversarial inputs.

Answer

Increase the temperature setting to 1.0.

Answer

Reduce max_tokens to 10.

Answer

Add a user authentication layer to the API.

Question 5

An organization is deploying Claude to provide automated coding assistance. To manage the risk of generating insecure code or violating open-source licenses, which governance step is most effective?

Accepted Answer

Implementing a mandatory 'Human-in-the-Loop' review and automated SAST scanning.. Risk management for AI-generated code requires a multi-layered approach. While the model is highly capable, it may occasionally suggest patterns that contain vulnerabilities or mimic copyrighted code. Integrating automated security scanning into the development lifecycle ensures that AI-generated artifacts meet the same standards as human-written code.

Answer

Disabling the model's ability to output code blocks entirely.

Answer

Relying on Claude's internal safety training to prevent all insecure code generation.

Answer

Requiring all developers to use Claude only for writing documentation, not logic.

Question 6

A firm is building a financial advisor chatbot. Which safety measure is most critical for preventing the model from providing unauthorized investment advice?

Accepted Answer

Deploy a guardrail layer to filter prohibited topics.. In financial contexts, providing unauthorized advice can lead to legal liability and significant user harm. Implementing a rigid system prompt that explicitly defines the model's limitations, combined with a deterministic 'guardrail' layer that checks for prohibited topics, is essential. This multi-layered approach ensures the model stays within its operational scope, protecting the firm from regulatory risk and ensuring users receive consistent, safe, and accurate information.

Answer

Always set temperature to 0.0 for every query.

Answer

Retrain the model on only financial regulations.

Answer

Add a disclaimer at the end of every response.

Question 7

Under the shared responsibility model for AI safety, which task is the primary responsibility of the customer when using Anthropic's APIs?

Accepted Answer

Monitoring and filtering application-specific user inputs. Anthropic manages the safety of the base model through training and infrastructure, but customers are responsible for how they implement the model in their specific context. This includes monitoring end-user behavior and ensuring that the application's specific use case complies with overall usage policies. Understanding this division is essential for establishing clear accountability and risk management procedures.

Answer

Conducting the base model's pre-training safety audits

Answer

Patching the underlying hardware infrastructure

Answer

Developing the Constitutional AI principles

Question 8

Refer to the exhibit. Which component in this API request represents the primary governance layer for preventing model bypass of organizational policies?

Accepted Answer

The system parameter instructions. The system parameter serves as the primary governing instruction set for Claude, establishing the operational boundaries and persona before user input is processed. By defining safety constraints and behavioral rules within this field, architects can implement a foundational layer of protection that limits the model's susceptibility to certain prompt injection techniques and ensures consistent adherence to enterprise safety guidelines.

Answer

The model version string

Answer

The metadata object fields

Answer

The user role in the messages array

Question 9

A project stakeholder is concerned about the latency of Claude 3.5 Sonnet responses in a high-throughput production application. How should the architect manage this communication?

Accepted Answer

Provide latency metrics and propose streaming to improve perceived performance.. Addressing performance concerns requires a blend of technical transparency and expectation management. By quantifying latency through benchmarking and offering specific optimization strategies like streaming or prompt engineering, the architect establishes trust. This process is crucial because stakeholders often perceive latency as a failure of the model rather than a facet of network or inference configuration, and proactive communication prevents unnecessary escalations while keeping project timelines intact.

Answer

Dismiss the concern as latency is inherent to LLMs.

Answer

Immediately switch to Claude 3 Haiku for all requests.

Answer

Request the stakeholder to increase their budget for higher rate limits.

Question 10

During a project milestone review, a stakeholder asks why the Anthropic model output occasionally varies. How do you explain this in a way that manages expectations?

Accepted Answer

Explain that LLMs use probabilistic sampling, which creates variance.. Explaining the concept of 'temperature' and probabilistic nature of LLMs is essential to manage expectations. By framing variation as a feature that allows for creative and diverse responses, the architect aligns the stakeholder with the technology's strengths. This is crucial for avoiding frustration when stakeholders expect deterministic software-like behavior from generative AI models, which can lead to misaligned quality assessments.

Answer

State it is a bug and that a patch will be deployed.

Answer

Suggest setting the temperature to 0 for all future requests.

Answer

Ignore the concern as it is common knowledge in AI.

Question 11

An enterprise client is integrating Claude for automated financial reporting. The stakeholders are concerned about data privacy and the potential for model hallucinations leading to inaccurate balance sheets. As the lead architect, how should you best manage these stakeholder expectations regarding output reliability?

Accepted Answer

Establish a formal verification workflow that routes model-generated reports through a human-in-the-loop audit process.. Effective stakeholder management requires transparent communication regarding the limitations of LLMs. By implementing a human-in-the-loop review process and establishing strict system prompts, you mitigate risk while defining clear success metrics. This approach transforms abstract concerns into a structured governance model, ensuring that stakeholders understand the distinction between deterministic software and probabilistic generative AI, thereby aligning project delivery with business expectations for accuracy and compliance.

Answer

Guarantee that the Claude model will achieve 100% accuracy through prompt engineering and iterative fine-tuning.

Answer

Restrict stakeholder access to the model outputs until the system has completed a six-month stabilization period.

Answer

Shift the responsibility for output accuracy entirely to the legal department by requiring a disclaimer on all generated documents.

Question 12

A stakeholder wants to incorporate 'real-time' news data into your Claude-based assistant. What is the most important architectural communication point to convey?

Accepted Answer

Explain that real-time data requires an external search index and retrieval system, increasing system complexity.. Communicating the limitations of LLM knowledge cut-offs and the complexities of real-time data integration is essential for project success. By framing this as a RAG-based architectural requirement, you manage expectations regarding latency, data accuracy, and the cost of building an up-to-date retrieval pipeline. This helps the stakeholder understand that 'real-time' is not a native model feature but a complex system design requirement that warrants specific investment and architectural rigor.

Answer

Confirm that Claude has access to the internet and can browse live sites directly.

Answer

Recommend the stakeholder use a different LLM that is always up to date.

Answer

Tell the stakeholder it will take two days to implement for all news sources.

Question 13

Which THREE practices most effectively support a 'Prompt Engineering as Code' workflow for enterprise teams? (Select THREE)

Accepted Answer

Storing prompts in text files within the same repository as the application code.. Managing prompts as versioned assets, automating evaluation pipelines, and enforcing peer reviews enable scalable and safe prompt lifecycle management. When prompts are treated like software, teams gain the ability to rollback, audit changes, and ensure that modifications do not degrade performance. This professionalizes the development process, reducing the risk of unexpected model behavior and allowing teams to deploy LLM-powered features with confidence and speed.

Answer

Using hardcoded prompt strings in the production environment for maximum speed.

Answer

Mandating manual review for every single request made by the production model.

Question 14

Which TWO actions should an architect take during the 'Design Phase' to ensure long-term model governance with stakeholders?

Accepted Answer

Define clear evaluation criteria for model quality and latency.. Effective governance requires early alignment on metrics and clear documentation of model limitations. By defining success criteria and establishing recurring review cadences, the architect ensures that stakeholders remain informed as the project matures. This approach is critical because LLM behaviors can evolve, and maintaining visibility into performance drifts or safety guardrail effectiveness is essential for long-term project success and continued stakeholder trust in the AI implementation.

Answer

Grant stakeholders direct access to the Anthropic console.

Answer

Avoid mentioning model limitations to prevent project delays.

Answer

Focus solely on technical implementation without documentation.

Question 15

A stakeholder demands that your team integrate Anthropic models into a sensitive financial system. How do you address the 'data privacy' concern?

Accepted Answer

Provide documentation on data encryption, retention, and compliance.. Addressing privacy concerns requires explaining the data security architecture, including data processing, storage, and retention policies. The architect must demonstrate that the implementation aligns with enterprise security standards. This is essential because stakeholder trust is the foundation of any deployment involving sensitive data; without clear documentation and assurance regarding privacy, the project will likely be blocked or experience significant delays during the security review phase.

Answer

Claim that privacy is guaranteed by Anthropic and no further action is needed.

Answer

Ask them to sign a waiver saying they take responsibility for data leaks.

Answer

Agree to use the data for model training to improve performance.