CCAR-P Governance, Safety, and Risk Management Practice Test 2 — 15 Questions

Question 1

When conducting a risk assessment for a new Claude-based customer support bot, which TWO factors should be prioritized as 'High Risk' according to Anthropic's safety guidelines?

Accepted Answer

Providing automated, unreviewed medical or legal advice.. Identifying high-risk scenarios is a core part of an architect's role in safety governance. Applications that involve high-stakes decision-making or have the potential to cause physical or financial harm require more stringent guardrails, human oversight, and rigorous red-teaming compared to low-stakes creative or administrative tasks.

Answer

Generating personalized marketing copy for a retail website.

Answer

Summarizing publicly available news articles for internal research.

Answer

Translating internal training manuals into multiple languages.

Question 2

Refer to the exhibit. The user is attempting to trick the model into revealing sensitive information by claiming a high-clearance role. This is an example of which security threat, and how does the 'system' prompt help mitigate it?

Accepted Answer

Prompt injection (jailbreaking); the system prompt establishes a higher-priority context.. Social engineering and role-playing are common techniques used in prompt injection attacks to bypass security constraints. The system prompt is a powerful governance tool because it sets the foundational rules and persona for the model, which are prioritized by Claude's reasoning engine over conflicting instructions found in the user messages.

Answer

Man-in-the-middle attack; the system prompt encrypts the secret code name.

Answer

Denial of Service (DoS); the system prompt limits the tokens used to hide the secret.

Answer

Data poisoning; the system prompt cleans the training data in real-time.

Question 3

An architect needs to implement a 'Red Teaming' process for a new Claude deployment. What is the primary objective of this activity in the context of AI governance and safety?

Accepted Answer

To adversarialy test the model to find safety gaps and potential for misuse.. Red Teaming is a proactive safety practice where a group of testers tries to find vulnerabilities, biases, or ways to make the model fail. This is a critical component of risk management, as it identifies potential issues before they can affect real users in a production environment.

Answer

To optimize the model's latency and throughput for high-volume traffic.

Answer

To automate the generation of unit tests for the application's UI components.

Answer

To verify that the model's billing and usage credits are being tracked correctly.

Question 4

When deploying Claude in a production environment, an architect notices that the model occasionally generates responses that are slightly biased. What is the most appropriate governance-first approach to address this?

Accepted Answer

Use a system prompt to define neutral behavior and implement bias-detection evals.. Bias in AI is an ongoing challenge that requires active management. A governance-first approach involves using a combination of model-native features, like system prompts, and external evaluation frameworks to measure and mitigate bias consistently across the application's lifecycle, rather than ignoring the problem.

Answer

Ignore the bias as long as the model's overall accuracy remains high.

Answer

Switch to a smaller model version to reduce the complexity of the outputs.

Answer

Manually rewrite every biased response before it reaches the end user.

Question 5

A company is using Claude to process customer feedback. They want to ensure that if a customer mentions self-harm or illegal activities, the system immediately flags this for a human moderator. Which tool is best suited for this specific governance task?

Accepted Answer

An external Moderation API or a dedicated safety-tuned model layer.. Handling sensitive content like self-harm requires specialized safety tools that go beyond standard text classification. Anthropic and its partners provide moderation APIs and safety filters designed to detect these high-risk categories, allowing organizations to implement mandatory human intervention for critical safety events.

Answer

The 'Temperature' parameter, set to its lowest possible value.

Answer

A standard SQL database with a list of 'bad words' to block.

Answer

Increasing the 'max_tokens' to allow the model to explain the risks.

Question 6

Which governance risk is most directly mitigated by using 'Versioned' model identifiers (e.g., 'claude-3-5-sonnet-20240620') instead of the generic 'claude-3-5-sonnet' alias in production?

Accepted Answer

The risk of 'Model Drift' where behavior changes unexpectedly after an update.. Model versioning is a critical practice for ensuring the stability and predictability of AI applications. Using a specific versioned identifier prevents 'model drift', where updates to the underlying model could change its behavior, safety profile, or output format, potentially breaking production workflows or governance checks.

Answer

The risk of exceeding the monthly API budget due to unexpected usage.

Answer

The risk of a 'Man-in-the-Middle' attack intercepting the API key.

Answer

The risk of data residency violations in the US-EAST-1 region.

Question 7

An organization requires strict adherence to data residency requirements for PII processed by Claude. Which strategy best ensures that customer prompts and completions remain within a specific geographic boundary while utilizing Anthropic's API?

Accepted Answer

Configure the API client to target region-specific endpoints and verify regional data residency settings.. Implementing region-specific API endpoints combined with Data Residency configurations ensures that data processing and storage occur within authorized borders. This approach is critical for regulatory compliance in jurisdictions like the EU. By limiting the scope of model interaction to regional infrastructure, architects prevent the inadvertent cross-border transfer of sensitive data, thereby aligning with global privacy governance frameworks and minimizing legal exposure for the enterprise.

Answer

Enable global load balancing across all available Anthropic regions to optimize latency.

Answer

Encrypt all outgoing prompts using a third-party gateway before sending to Anthropic.

Answer

Anonymize all data locally and rely on Anthropic's general model training to handle PII.

Question 8

An enterprise is deploying Claude for high-stakes financial analysis. Which TWO governance controls should be implemented to mitigate the risk of model hallucinations and ensure factual accuracy?

Accepted Answer

Implement Retrieval-Augmented Generation (RAG) to ground responses in internal trusted knowledge bases.. Mitigating hallucination risk requires a multi-layered approach involving technical constraints and validation processes. Implementing robust Retrieval-Augmented Generation (RAG) grounds the model's responses in verified source documents, while secondary verification steps add a deterministic layer to the output. These controls are essential in financial services where incorrect data can lead to severe regulatory penalties, financial loss, and significant reputational damage to the organization.

Answer

Increase the temperature parameter to 1.5 to maximize response creativity.

Answer

Require human intervention for every prompt sent to the API to guarantee zero errors.

Answer

Disable all safety filters to allow the model to process complex financial jargon.

Question 9

Refer to the exhibit. An audit of an Anthropic API configuration reveals the policy shown. What is the primary governance concern with this implementation?

Accepted Answer

The safety settings expose the organization to content moderation and liability risks.. The configuration explicitly disables core safety filters for harassment and hate speech. In an enterprise context, this creates significant legal and brand risk. Governance frameworks mandate that safety guardrails remain enabled to protect the organization from generating or facilitating harmful content. By explicitly setting these to 'block_none', the organization bypasses essential protections that are designed to uphold safety standards and ethical AI usage requirements.

Answer

The temperature setting is too high for professional administrative tasks.

Answer

The max_tokens limit is too low, restricting the capability of the system.

Answer

The system prompt is too generic, leading to poor model performance.

Question 10

Which governance model best minimizes the risk of 'shadow AI' usage within a large corporation?

Accepted Answer

Implement a centralized enterprise-approved AI service portal with clear usage policies.. Centralized oversight combined with a standardized, approved AI service catalog ensures that business units use vetted, secure, and compliant tools. This approach provides governance without completely stifling innovation, as teams can request new tools through a formal process. By creating a 'path of least resistance' through managed services, organizations can effectively prevent employees from using unauthorized, non-compliant tools that threaten the firm's security and data privacy posture.

Answer

Restrict all internet access to prevent employees from reaching AI websites.

Answer

Require employees to sign a manual waiver every time they use an unauthorized tool.

Answer

Trust individual departments to manage their own AI security and compliance audits.

Question 11

A healthcare provider is using Claude to summarize patient clinical notes. Which governance control is most critical to prevent potential HIPAA violations?

Accepted Answer

Ensure that a Business Associate Agreement (BAA) is in place and strictly enforced.. The most critical control is ensuring that all data processed by the API is encrypted in transit and at rest, and that the organization has a Business Associate Agreement (BAA) with Anthropic. Without a BAA, the provider cannot legally process PHI. This legal framework, supported by technical encryption, is the foundational requirement for any healthcare entity utilizing cloud-based AI services to maintain regulatory compliance.

Answer

Use a custom model fine-tuned on public medical journals to avoid using patient data.

Answer

Implement a strict 24-hour limit on the storage of all processed clinical summaries.

Answer

Anonymize all patient notes by removing names before sending them to the API.

Question 12

Which approach best aligns with the principle of 'least privilege' when providing API access to internal teams?

Accepted Answer

Use separate API keys for each project with specific rate limits and usage quotas.. Least privilege is best enforced by utilizing scoped API keys and rate limits mapped to specific project requirements. By isolating access, an architect ensures that a compromise in one department does not cascade across the entire organization. This structure allows for granular monitoring and easier revocation, forming a robust foundation for organizational security and minimizing the blast radius of any potential credential leakage or misuse.

Answer

Create a single organization-wide API key for all departments to share.

Answer

Provide all developers with unrestricted access to the master organization API key.

Answer

Rotate all team keys daily to ensure the highest level of security.

Question 13

An enterprise wants to deploy an AI-powered customer service agent. What is the most important governance consideration when integrating with internal customer databases?

Accepted Answer

Use a service account with scoped, read-only permissions to the necessary database views.. The most important consideration is implementing a robust access control layer between the AI agent and the database. The agent should only have read-only access to a strictly defined, non-sensitive subset of data. This prevents the model from inadvertently surfacing sensitive info or executing unauthorized data modifications, ensuring that the integration adheres to the principle of least privilege and maintains corporate data integrity standards.

Answer

Ensure the model has write access to the database to update customer profiles.

Answer

Store the database connection string directly in the prompt for ease of access.

Answer

Configure the agent to query the entire production database to ensure comprehensive answers.

Question 14

Which THREE strategies are effective for managing bias in AI-driven decision-making systems?

Accepted Answer

Conduct regular testing using diverse datasets to identify performance disparities.. Managing AI bias requires a combination of data-level intervention, model validation, and ongoing monitoring. Bias often originates in training data, so evaluating and cleansing datasets is a crucial first step. Continuous monitoring and testing against diverse benchmarks ensure that the model remains fair over time. These strategies are essential for enterprise governance to ensure that automated decisions are equitable, legally compliant, and aligned with organizational values.

Answer

Disable all feedback loops to prevent users from influencing the model's bias.

Answer

Use a proprietary model that hides its reasoning to prevent users from detecting bias.

Question 15

What is the primary role of a 'Model Card' in the context of enterprise AI governance?

Accepted Answer

A comprehensive summary of the model's performance, limitations, and intended usage.. Model Cards are essential documentation that provides transparency into a model's intended use, limitations, performance benchmarks, and known biases. For an enterprise architect, they serve as the technical source of truth for assessing whether a model is fit for a specific business use case. This documentation is critical for risk management, ensuring that deployments are grounded in a clear understanding of the model's capabilities and boundaries.

Answer

A list of all API keys associated with the model for billing purposes.

Answer

A tool for automatically deploying the model to production environments.

Answer

A physical card used for multi-factor authentication to access the API.