CCAR-P Practice Test 6 — 10 Questions

Question 1

Your organization is transitioning from a legacy rule-based system to a Claude-based solution. A key stakeholder is worried about 'loss of control'. How do you address this during a steering committee meeting?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Propose an evaluation framework that includes both automated guardrails and a human-in-the-loop review process.. Address the fear of 'loss of control' by highlighting the architectural layers of governance available in modern AI. By explaining concepts like system prompts, output schemas, and automated evaluation frameworks, you demonstrate that control is not lost but rather evolved from static rules to dynamic, verifiable constraints. This helps stakeholders understand that modern AI architectures offer robust mechanisms for oversight, maintaining alignment with corporate compliance and quality standards.

Answer

Tell them that the model is smarter than the rules and they should trust it.

Answer

Suggest keeping the legacy system running in parallel indefinitely to avoid the issue.

Answer

Ignore the concern as it is purely emotional and not based on technical facts.

Question 2

An organization wants to allow non-technical business users to test Claude prompts without exposing them to raw API code. What is the most productive approach to empower these users?

Accepted Answer

Create a secure web-based UI that allows users to test prompts against specific model versions.. Building an internal 'Playground' interface that interfaces with the API allows business users to refine prompts in a safe, controlled environment. By abstracting the technical details, the organization enables subject-matter experts to contribute to prompt engineering. This collaborative approach improves productivity by shortening the feedback loop between business needs and technical implementation, ensuring that the final prompts are both effective and aligned with organizational goals.

Answer

Give every user their own API key and a Python IDE to write scripts.

Answer

Require all prompt suggestions to be submitted via a ticket system for developers to code.

Answer

Provide access to the public Anthropic Console directly for all business users.

Question 3

During a project post-mortem, stakeholders feel that the technical limitations of the LLM were not clearly explained during the planning phase. What action would have best mitigated this perception?

Accepted Answer

Conduct an expectation-setting workshop demonstrating both model strengths and known limitations.. Transparency regarding model capabilities and constraints is vital for setting realistic expectations. By providing a clear, non-technical overview of what the model can and cannot do during the initial planning phase, stakeholders can better align their business objectives with the actual technical reality, reducing disappointment and friction during later project stages and establishing a foundation of trust and professional credibility.

Answer

Provide stakeholders with the full technical whitepaper of the model's training data.

Answer

Include a disclaimer in the final project report acknowledging the potential for errors.

Answer

Ask the AI engineers to write a memo outlining the model's performance metrics.

Question 4

Which mechanism best facilitates secure, ephemeral access to Anthropic API keys for developers within a containerized CI environment?

Accepted Answer

Using a secrets management service to inject keys as environment variables at runtime.. Utilizing a secrets management service such as HashiCorp Vault or AWS Secrets Manager allows for the injection of short-lived credentials into the environment. This minimizes the risk of long-lived key exposure in logs or source control. By automating secret rotation and access control, organizations can ensure developer productivity remains high without compromising the overall security posture of the infrastructure.

Answer

Hardcoding the API keys in the source code repository with encryption.

Answer

Storing API keys in a local .env file on every developer workstation.

Answer

Distributing shared API keys via a secure internal messaging channel.

Question 5

What is the primary risk associated with 'Prompt Injection' attacks in enterprise AI?

Accepted Answer

Unauthorized control of model behavior.. Prompt injection allows attackers to override core system instructions, potentially forcing the AI to leak sensitive data, bypass safety filters, or perform unauthorized actions. This is a critical risk because it undermines the entire security model of the AI application. Enterprise systems must treat all external user input as untrusted, necessitating strong architectural controls to prevent attackers from hijacking the model's intended logic and operational behavior.

Answer

Increased latency for all users.

Answer

A reduction in model accuracy.

Answer

The model becoming permanently unavailable.

Question 6

Refer to the exhibit. An organization uses this configuration to prevent the model from continuing the conversation as the user. What is the governance benefit of this configuration?

Accepted Answer

It prevents the model from generating text as the user, reducing injection risk.. Setting the stop sequence to 'Human:' prevents the model from generating text that mimics the user's voice, which is a common technique in jailbreaking and prompt injection. By forcing the model to stop, the organization maintains clear control over the conversational flow, ensuring that the model cannot 'speak' for the user or inadvertently generate unintended content that might mislead other systems or bypass security filters.

Answer

It significantly reduces the total cost of the API call by limiting output length.

Answer

It improves the creativity of the model by forcing it to summarize more frequently.

Answer

It allows the model to handle more complex logic by processing it in smaller chunks.

Question 7

A developer wants to monitor prompt effectiveness in production without logging sensitive user data. What is the best practice?

Accepted Answer

Implement a PII redaction layer before sending prompts to the telemetry store.. Data masking and PII redaction are essential to maintaining privacy while gaining operational insights. By cleaning inputs before they leave the environment or logging only non-sensitive metadata, developers can adhere to compliance standards. This practice allows for effective monitoring and improvement of prompt performance while protecting user data, which is a fundamental requirement for professional-grade, enterprise-compliant AI applications today.

Answer

Log all raw prompt and completion strings to a plaintext file.

Answer

Ask users to opt-in to full data logging in their settings.

Answer

Only log the model's response and discard the input user prompt.

Question 8

Refer to the exhibit. An architect reviews this API request log. Despite the 'Ignore all previous safety instructions' directive, Claude refuses to provide instructions for bypassing the firewall. Which safety mechanism is primarily responsible for this refusal?

Accepted Answer

Constitutional AI (CAI) and RLHF during the model's training phase.. Claude's resilience to prompt injection and malicious instructions is not accidental; it is the result of Anthropic's unique training methodology. This ensures that even when a user explicitly commands the model to ignore its rules, the model maintains its commitment to safety and refuses to generate harmful or illegal content.

Answer

The external Python-based regex filter applied to the API output.

Answer

The 'max_tokens' parameter being set to a value low enough to truncate the response.

Answer

A hardcoded list of forbidden words in the Anthropic Messages API gateway.

Question 9

A stakeholder expresses concern about data privacy regarding the inputs sent to Claude. What is the most appropriate way to address this?

Accepted Answer

Provide documentation regarding data handling, encryption, and the Anthropic data processing agreement.. Addressing data privacy requires a formal, evidence-based approach that references established security frameworks and contractual terms. By explaining the data processing agreement and the security controls in place—such as encryption and data retention policies—you provide the stakeholder with the necessary assurance to move forward. This professional response treats privacy as a standard architectural requirement rather than an afterthought, reinforcing trust in the system's design and organizational compliance.

Answer

Tell them privacy is not an issue because all data is automatically deleted.

Answer

Suggest they talk to the legal department and wait for a response.

Answer

Ask them to sign a waiver stating they are responsible for any data leaks.

Question 10

An organization is building an internal CLI tool that uses Anthropic's API. They want to improve developer productivity by implementing robust error handling and monitoring. Which TWO strategies should they implement? (Select TWO)

Accepted Answer

Implement exponential backoff logic for handling 429 and 5xx API responses.. Implementing exponential backoff and structured logging are foundational for operational reliability. Exponential backoff gracefully handles rate-limiting and transient errors, preventing pipeline failures. Structured logging allows teams to parse API metrics, latency, and token usage, providing visibility into costs and performance. These practices directly improve developer experience by reducing time spent troubleshooting intermittent failures and optimizing API resource consumption in automated workflows.

Answer

Store API keys as plain text in the CLI configuration file for ease of developer access.

Answer

Set the maximum token limit to 4096 for all requests to ensure uniform response times.

Answer

Disable all request retries to ensure the CLI tool fails fast during network issues.