CCAR-P Practice Test 2 — 10 Questions

Question 1

A security architect is configuring the Anthropic Console for a large enterprise. Which TWO features should be implemented to enforce centralized governance and reduce the risk of unauthorized account access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Single Sign-On (SSO) integration via SAML 2.0.. Centralized governance in the Anthropic Console involves managing how users authenticate and what permissions they have. Implementing enterprise-grade access controls ensures that only authorized personnel can generate API keys or view usage metrics, which is vital for maintaining a secure and compliant AI environment.

Answer

Automatic rotation of all API keys every 24 hours.

Answer

Real-time packet inspection of all API traffic.

Answer

Hardware Security Module (HSM) storage for all model weights.

Question 2

Which THREE strategies should be employed to securely manage sensitive data within an agentic workflow?

Accepted Answer

Apply PII masking/redaction before passing text to the LLM.. Securing agents requires a layered approach: PII masking before sending to the model keeps data private; granular access control ensures the agent only touches data it is authorized to see; and audit logging provides traceability for every decision made. These components ensure that even if the agent is compromised or hallucinates, the impact is contained, data privacy is maintained, and there is a clear record of actions taken for compliance and forensics.

Answer

Enable the model to have full administrative access to the file system.

Answer

Embed all user data directly into the system prompt for faster access.

Question 3

An architect is defining the Shared Responsibility Model for a company deploying Claude via the Messages API. Which THREE tasks are the sole responsibility of the customer (the 'User') rather than Anthropic?

Accepted Answer

Classification and sanitization of PII within input prompts.. Understanding the Shared Responsibility Model is essential for risk management in AI deployments. While Anthropic secures the base model and underlying infrastructure, the customer remains responsible for the data they input, how they configure access to the API, and the specific ways the model's output is integrated into their business processes.

Answer

Physical security of the data centers housing the TPU/GPU clusters.

Answer

Fine-tuning the base model's Constitutional AI principles.

Question 4

Refer to the exhibit. An agentic loop receives this response from the Anthropic API during a critical multi-step operation. Which strategy should the architect implement to ensure the agent completes its task successfully?

Accepted Answer

Implement exponential backoff with jitter in the orchestrator. Transient API errors like 'overloaded_error' are common in high-traffic environments. A robust agentic architecture must handle these gracefully using exponential backoff. This prevents the agent from failing the entire task due to a temporary service interruption and ensures that the long-running state of the agent's work is preserved and resumed.

Answer

Immediately terminate the agent and alert the user

Answer

Restart the entire agentic loop from the first message

Answer

Reduce the temperature of the next request to 0

Question 5

Refer to the exhibit. The monitoring system logs these safety rejections. How should you communicate this to the product owner?

Accepted Answer

Provide a report showing the effectiveness of safety guardrails in mitigating potential risk.. This situation is an opportunity to show the product owner the value of the safety guardrails in action. Presenting the logs as evidence of success—that the system is working as intended to prevent potential violations—reassures the product owner while initiating a conversation about potential refinements. This proactive reporting builds trust in the security of the application and keeps the business stakeholder informed about the protective measures in place.

Answer

Tell them the system is broken and that we need to stop the development immediately.

Answer

Keep the logs hidden to avoid making the project look like it has problems.

Answer

Ask the product owner to manually approve all output that the model generates.

Question 6

A stakeholder wants to change the project scope halfway through. How do you evaluate the impact?

Accepted Answer

Perform a formal impact analysis and present the trade-offs.. Managing scope creep involves a structured impact analysis, covering cost, timeline, and technical feasibility. The architect must ensure that the stakeholder understands the trade-offs of their request. This is vital for maintaining project alignment and ensuring that the team is not overloaded with un-resourced tasks that will derail the core objectives and negatively impact the quality of the final deliverable.

Answer

Accept the change immediately to keep the stakeholder happy.

Answer

Deny the request without explanation to prevent scope creep.

Answer

Work on the request secretly and surprise them later.

Question 7

To ensure long-term maintainability and performance of LLM-based applications, which THREE architectural patterns should architects recommend? (Select THREE)

Accepted Answer

Decouple prompt management and model selection from core application logic.. Decoupling model logic, implementing robust caching, and establishing monitoring are vital for long-term sustainability. Decoupling allows for model upgrades without massive refactoring, caching reduces latency and costs for repetitive queries, and monitoring ensures that performance degradation is caught immediately. These patterns transform 'experimental' LLM features into production-grade systems that developers can manage efficiently, reducing the technical debt typically associated with quickly-built AI integrations.

Answer

Hardcode system prompts to ensure the model behavior cannot change over time.

Answer

Use the largest available context window for every single request to maximize intelligence.

Question 8

Refer to the exhibit. The application is hitting rate limits during peak hours. What is the best architectural change to improve operational resilience?

Accepted Answer

Implement an exponential backoff strategy with jitter.. Implementing an exponential backoff strategy with jitter is the industry-standard approach for handling 429 rate-limiting errors. Unlike static retries, this approach prevents the 'thundering herd' problem, where multiple failed requests attempt to reconnect simultaneously, further stressing the service. This enhances operational stability, ensures more graceful handling of high-traffic scenarios, and improves the overall reliability of the system, which is a key requirement for professional architects.

Answer

Increase the timeout duration of the API calls indefinitely.

Answer

Bypass the API gateway and send requests directly to the model's backend IP.

Answer

Disable all retries to prevent the application from crashing.

Question 9

An enterprise client is concerned about the 'black box' nature of LLMs. Which THREE communication strategies should the architect use to build transparency and trust?

Accepted Answer

Present the results of red-teaming exercises to show how vulnerabilities are identified and patched.. Building trust with stakeholders requires moving beyond marketing claims to concrete evidence of system reliability and oversight. By demonstrating how the model reaches decisions, implementing monitoring to catch errors, and providing clear documentation on safety guardrails, the architect demystifies the technology. These strategies collectively address stakeholder anxiety by providing a tangible framework for oversight, control, and accountability within the automated system.

Answer

Promise stakeholders that the model will have a 100% accuracy rate for all inputs.

Answer

Avoid mentioning technical constraints to keep the stakeholder focused on the positive benefits.

Question 10

A team uses a CI/CD pipeline to deploy LLM applications. They want to ensure prompt changes do not degrade model performance. Which strategy best integrates evaluation into the development workflow?

Accepted Answer

Run automated evaluation scripts against a golden dataset during the CI process.. Integrating automated evaluations (Evals) into the CI/CD pipeline ensures that every code or prompt change is validated against a golden dataset. This automated gate prevents regressions from reaching production. It empowers developers to iterate quickly while maintaining a high bar for reliability, which is crucial for operational enablement in LLM-driven environments where non-deterministic model behavior can introduce subtle, hard-to-detect bugs that impact user experience.

Answer

Perform manual prompt testing by the QA team before every release.

Answer

Rely on user feedback loops in production to identify and fix issues.

Answer

Only evaluate the application after it has been deployed to the production environment.