CCAR-P Practice Test 20 — 15 Questions

Question 1

Which THREE strategies are effective for managing bias in AI-driven decision-making systems?

Accepted Answer

Conduct regular testing using diverse datasets to identify performance disparities.. Managing AI bias requires a combination of data-level intervention, model validation, and ongoing monitoring. Bias often originates in training data, so evaluating and cleansing datasets is a crucial first step. Continuous monitoring and testing against diverse benchmarks ensure that the model remains fair over time. These strategies are essential for enterprise governance to ensure that automated decisions are equitable, legally compliant, and aligned with organizational values.

Answer

Disable all feedback loops to prevent users from influencing the model's bias.

Answer

Use a proprietary model that hides its reasoning to prevent users from detecting bias.

Question 2

Your organization is scaling an internal library that wraps Anthropic API calls. To minimize the cognitive load on developers using this library, what is the most effective pattern to implement?

Accepted Answer

Bundle all API interaction logic into a shared, versioned SDK with built-in observability.. Providing a high-level SDK with built-in retry logic, telemetry, and standardized error handling reduces the complexity for individual developers. By abstracting away the boilerplate code required for API connectivity, developers can focus on prompt engineering and business logic. This standardization ensures that all teams use secure, performant, and observable patterns, which significantly enhances organizational productivity and reduces technical debt across various internal projects.

Answer

Require developers to write raw HTTP requests to the API in every microservice.

Answer

Mandate that all developers use a specific GUI tool for prompt testing rather than code.

Answer

Provide only documentation on how to authenticate, leaving all implementation to teams.

Question 3

Refer to the exhibit. An audit team identifies that the system message lacks specific data handling instructions for sensitive reports. As the architect, what is the best approach to communicate this to the development team?

Accepted Answer

Schedule a review meeting to explain the requirement for a system message that enforces data classification.. Addressing the system prompt configuration is a critical technical governance task. By clearly articulating the need for a system-level guardrail, the architect ensures that the development team understands the security implications. This communication approach promotes a culture of security-first development, ensuring that all API interactions are constrained by necessary policy directives before they reach production environments, thereby preventing inadvertent data leakage through improper model interaction.

Answer

Directly update the production configuration files without consulting the developers to expedite the fix.

Answer

Send an email suggesting that they use a different model that has built-in data filtering.

Answer

Ignore the finding since the model is generally helpful and unlikely to leak information.

Question 4

How should a development team manage sensitive system instructions that they do not want users to see or modify?

Accepted Answer

Store the instructions on the server and use them to build the request payload.. System instructions must be handled server-side to remain protected from client-side interference. By keeping the logic in the backend, developers ensure that users cannot inspect, modify, or inject instructions into the conversation. This pattern is fundamental to security, ensuring the integrity of the model's behavior and protecting the intellectual property of the prompt logic from malicious actors or unauthorized tampering by end-users.

Answer

Obfuscate the prompt by converting it to base64 before sending it to the client.

Answer

Ask the model to never repeat its instructions to the user.

Answer

Hardcode the prompts in the client-side JavaScript to minimize server latency.

Question 5

When designing a system for high-volume document analysis, what is the best strategy to maximize cost efficiency and developer velocity?

Accepted Answer

Adopt a queue-based architecture with Anthropic's Batch API for bulk tasks.. Using the Batch API for asynchronous processing allows the system to operate efficiently at a lower cost while simplifying the architecture. By offloading document processing from the request-response cycle, the system becomes more resilient to traffic spikes. This allows developers to design around throughput rather than latency, leading to cleaner code and fewer infrastructure challenges related to synchronous request timeouts or rate-limiting.

Answer

Execute all requests synchronously to ensure the user gets an immediate result.

Answer

Split large documents into tiny chunks and process them in parallel using individual requests.

Answer

Deploy a dedicated cluster of GPUs to run an open-source model locally.

Question 6

An enterprise wants to deploy an AI-powered customer service agent. What is the most important governance consideration when integrating with internal customer databases?

Accepted Answer

Use a service account with scoped, read-only permissions to the necessary database views.. The most important consideration is implementing a robust access control layer between the AI agent and the database. The agent should only have read-only access to a strictly defined, non-sensitive subset of data. This prevents the model from inadvertently surfacing sensitive info or executing unauthorized data modifications, ensuring that the integration adheres to the principle of least privilege and maintains corporate data integrity standards.

Answer

Ensure the model has write access to the database to update customer profiles.

Answer

Store the database connection string directly in the prompt for ease of access.

Answer

Configure the agent to query the entire production database to ensure comprehensive answers.

Question 7

An organization is evaluating the safety of an LLM-based agent. What is the 'Red Teaming' process in this context?

Accepted Answer

An adversarial testing methodology to find vulnerabilities.. Red Teaming is a structured adversarial testing approach where a dedicated team attempts to find weaknesses, bypass safety guardrails, and elicit harmful responses from an AI system. It is a vital component of the development lifecycle because it identifies edge cases and vulnerabilities that automated tests might miss. Conducting regular red teaming ensures that the system is resilient against sophisticated attacks and remains safe for production deployment.

Answer

The process of updating the model's weights.

Answer

The standard unit testing for API latency.

Answer

The automated deployment of new models.

Question 8

A project sponsor asks for a timeline estimation for a project utilizing Claude for sentiment analysis. What is the most appropriate architectural response?

Accepted Answer

Give a broad range with a disclaimer that accuracy tuning will dictate the final go-live date.. Providing a timeline for AI projects requires acknowledging the iterative nature of model performance and data integration. By focusing on milestones rather than rigid delivery dates, you maintain flexibility while providing transparency. This approach protects the project team from unreasonable pressure and allows for the necessary R&D time required to refine prompts and safety guardrails, ultimately leading to a more successful and sustainable outcome for the stakeholders.

Answer

Provide a fixed date based on a standard waterfall project model.

Answer

State that the timeline is impossible to predict and refuse to provide any estimates.

Answer

Ask the sponsor to define the date they want and agree to it immediately.

Question 9

When evaluating the performance of a new 'Orchestrator-Worker' agentic architecture, which THREE metrics provide the most insight into the system's efficiency and reliability?

Accepted Answer

Task Success Rate (TSR). Evaluating agents requires looking beyond simple accuracy to understand the operational characteristics of the loop. Task success rate measures the ultimate goal, while steps-per-task and tool accuracy pinpoint where the logic might be breaking down or becoming inefficient. These metrics collectively guide the architect in refining the agent's reasoning path.

Answer

Total number of tools defined in the schema

Answer

The model's pre-training data cutoff date

Question 10

Which THREE components are essential for a robust 'Stakeholder Communication Plan' during an LLM project rollout?

Accepted Answer

Defined channels for feedback and incident reporting.. A communication plan must be systematic, addressing reporting, escalation, and change management. By establishing clear channels for feedback, regular status updates, and defined procedures for handling model deviations, the architect ensures alignment. This is critical because LLM projects involve high ambiguity, and a well-structured plan prevents the team from feeling isolated or lost as the model behaves in unexpected ways during the production rollout phase.

Answer

A static, one-time document updated only at project end.

Answer

Strict secrecy policies to prevent stakeholders from knowing details.

Question 11

Your team is deploying an AI agent that makes automated financial decisions. What is the most critical communication to have with the legal/compliance department?

Accepted Answer

Explain the decision-making logic and the mechanisms for human oversight and auditability.. Automated financial decision-making carries significant legal and regulatory risks. Explicitly defining the 'human-in-the-loop' (HITL) requirements and ensuring compliance with financial regulations like GDPR or SOX is non-negotiable. This communication establishes the legal boundaries for the project, ensuring that the technology is implemented within the allowed regulatory framework and that all necessary audits and documentation are in place to mitigate potential liability for the organization.

Answer

Discuss the cost-effectiveness of the API versus the revenue generated by the agent.

Answer

Ask them to sign a document that absolves the development team of all legal responsibility.

Answer

Focus on the technical speed of the agent to show how much more efficient it is.

Question 12

A company is using Claude to process customer feedback. They want to ensure that if a customer mentions self-harm or illegal activities, the system immediately flags this for a human moderator. Which tool is best suited for this specific governance task?

Accepted Answer

An external Moderation API or a dedicated safety-tuned model layer.. Handling sensitive content like self-harm requires specialized safety tools that go beyond standard text classification. Anthropic and its partners provide moderation APIs and safety filters designed to detect these high-risk categories, allowing organizations to implement mandatory human intervention for critical safety events.

Answer

The 'Temperature' parameter, set to its lowest possible value.

Answer

A standard SQL database with a list of 'bad words' to block.

Answer

Increasing the 'max_tokens' to allow the model to explain the risks.

Question 13

When conducting a risk assessment for a new Claude-based customer support bot, which TWO factors should be prioritized as 'High Risk' according to Anthropic's safety guidelines?

Accepted Answer

Providing automated, unreviewed medical or legal advice.. Identifying high-risk scenarios is a core part of an architect's role in safety governance. Applications that involve high-stakes decision-making or have the potential to cause physical or financial harm require more stringent guardrails, human oversight, and rigorous red-teaming compared to low-stakes creative or administrative tasks.

Answer

Generating personalized marketing copy for a retail website.

Answer

Summarizing publicly available news articles for internal research.

Answer

Translating internal training manuals into multiple languages.

Question 14

When deploying Claude in a production environment, an architect notices that the model occasionally generates responses that are slightly biased. What is the most appropriate governance-first approach to address this?

Accepted Answer

Use a system prompt to define neutral behavior and implement bias-detection evals.. Bias in AI is an ongoing challenge that requires active management. A governance-first approach involves using a combination of model-native features, like system prompts, and external evaluation frameworks to measure and mitigate bias consistently across the application's lifecycle, rather than ignoring the problem.

Answer

Ignore the bias as long as the model's overall accuracy remains high.

Answer

Switch to a smaller model version to reduce the complexity of the outputs.

Answer

Manually rewrite every biased response before it reaches the end user.

Question 15

When integrating Anthropic's API with a CI/CD pipeline for automated testing, which security practice is mandatory to avoid credential leakage?

Accepted Answer

Use a dedicated secret management service to inject credentials at runtime.. Using a secret management service (like HashiCorp Vault or AWS Secrets Manager) to dynamically inject API keys at build time is the industry standard. Hardcoding keys or storing them in environment variables in a repository is a severe security failure. This approach ensures that secrets are never exposed in logs or version control, maintaining a tight security posture during the automated deployment of AI-powered applications.

Answer

Commit the API key to the Git repository, but encrypt it using the repository's encryption feature.

Answer

Include the API key in the Dockerfile as an ARG so it's available during the build phase.

Answer

Store the API key in a plain text file on the CI/CD runner for easy access by all pipelines.