CCAR-P Governance, Safety, and Risk Management Practice Test 3 — 15 Questions

Question 1

When designing an LLM application, what is the best strategy for managing 'system instructions' (system prompts) to prevent unauthorized alteration?

Accepted Answer

Store the system prompt in a centralized, secured configuration service.. System instructions should be stored in a secured, backend configuration service that is injected at runtime, rather than being hardcoded or exposed to the client-side. This architecture ensures that the system prompt is immutable from the user's perspective. By centralizing the storage and management of these instructions, architects provide a secure, auditable method for updating behavior without exposing the underlying logic to potential client-side manipulation or injection attacks.

Answer

Hardcode the system prompt directly in the client-side JavaScript for speed.

Answer

Allow users to modify the system prompt to customize their experience.

Answer

Use a public Git repository to store the system prompts for transparency.

Question 2

Refer to the exhibit. An organization uses this configuration to prevent the model from continuing the conversation as the user. What is the governance benefit of this configuration?

Accepted Answer

It prevents the model from generating text as the user, reducing injection risk.. Setting the stop sequence to 'Human:' prevents the model from generating text that mimics the user's voice, which is a common technique in jailbreaking and prompt injection. By forcing the model to stop, the organization maintains clear control over the conversational flow, ensuring that the model cannot 'speak' for the user or inadvertently generate unintended content that might mislead other systems or bypass security filters.

Answer

It significantly reduces the total cost of the API call by limiting output length.

Answer

It improves the creativity of the model by forcing it to summarize more frequently.

Answer

It allows the model to handle more complex logic by processing it in smaller chunks.

Question 3

When integrating Anthropic's API with a CI/CD pipeline for automated testing, which security practice is mandatory to avoid credential leakage?

Accepted Answer

Use a dedicated secret management service to inject credentials at runtime.. Using a secret management service (like HashiCorp Vault or AWS Secrets Manager) to dynamically inject API keys at build time is the industry standard. Hardcoding keys or storing them in environment variables in a repository is a severe security failure. This approach ensures that secrets are never exposed in logs or version control, maintaining a tight security posture during the automated deployment of AI-powered applications.

Answer

Commit the API key to the Git repository, but encrypt it using the repository's encryption feature.

Answer

Include the API key in the Dockerfile as an ARG so it's available during the build phase.

Answer

Store the API key in a plain text file on the CI/CD runner for easy access by all pipelines.

Question 4

An organization is deploying Claude for a customer support chatbot. They need to ensure that PII is not processed or stored by the model. Which approach best aligns with Anthropic’s safety governance standards?

Accepted Answer

Use an anonymization layer to mask PII before the API call.. Implementing data redaction at the application layer before sending requests to the API ensures that sensitive data never enters the model's processing pipeline. This defense-in-depth strategy is crucial for regulatory compliance like GDPR or HIPAA, as it minimizes the risk of PII leakage. Organizations should always prioritize data minimization when working with LLMs to reduce the liability surface area and maintain strict control over data governance protocols.

Answer

Instruct the model via the system prompt to ignore PII.

Answer

Enable logging for all prompts to monitor PII usage.

Answer

Rely on the model's internal safety filters.

Question 5

Refer to the exhibit. An application developer is testing a model endpoint. Which security control should be prioritized to prevent the specific risk demonstrated in the exhibit?

Accepted Answer

Implement prompt engineering guardrails and input validation.. The exhibit illustrates a prompt injection attempt aimed at extracting sensitive system instructions. To mitigate this, developers should implement strict input validation and use robust system prompt design. Applying these controls is vital because prompt injection can lead to unauthorized data exposure, policy bypasses, and reputational damage. Governance frameworks must mandate rigorous red-teaming and input sanitization to protect the integrity of the model's operational logic against adversarial inputs.

Answer

Increase the temperature setting to 1.0.

Answer

Reduce max_tokens to 10.

Answer

Add a user authentication layer to the API.

Question 6

A company is integrating Claude into a high-stakes automated decision-making system. Which TWO practices should be implemented to align with Anthropic’s Responsible AI principles?

Accepted Answer

Implement human-in-the-loop oversight for model outputs.. Integrating LLMs into high-stakes environments requires a focus on human-in-the-loop (HITL) oversight and continuous monitoring. These practices help manage hallucinations and maintain accountability. Without these safeguards, automated systems can produce biased or incorrect outcomes without human correction. Implementing these protocols ensures that AI governance remains aligned with human values and organizational safety goals, reducing the risk of unintended consequences in critical decision-making processes.

Answer

Allow the model to finalize decisions without human review.

Answer

Only use the most advanced model available for all tasks.

Answer

Disable all system logs to preserve user privacy.

Question 7

An organization is conducting a risk assessment for an AI application. They are concerned about 'model drift' over time. Which governance action is most appropriate to manage this risk?

Accepted Answer

Conduct periodic evaluation against a golden dataset.. Model drift refers to the degradation of model performance as the environment or data distribution changes. Periodic re-evaluation against a baseline 'golden dataset' is a standard governance practice to ensure the model remains reliable. This proactive monitoring allows teams to detect performance drops, adjust system prompts, or re-train/update the model, ensuring that the AI remains safe and effective for its original intended use case.

Answer

Increase the system prompt complexity.

Answer

Switch to a different model provider immediately.

Answer

Automate user feedback loops for real-time retraining.

Question 8

What is the primary role of an AI Safety Committee in an enterprise architecture?

Accepted Answer

To oversee ethical standards and risk-based governance.. An AI Safety Committee acts as the governance body responsible for overseeing the ethical and safe deployment of AI systems. This committee establishes policies, reviews high-risk use cases, and ensures compliance with legal and safety standards. Their role is critical in bridging the gap between technical implementation and organizational values, ensuring that safety is not an afterthought but a central component of the entire AI development lifecycle.

Answer

To handle daily technical debugging of model latency.

Answer

To directly write all production system prompts.

Answer

To manage the cloud provider's physical data centers.

Question 9

A firm is building a financial advisor chatbot. Which safety measure is most critical for preventing the model from providing unauthorized investment advice?

Accepted Answer

Deploy a guardrail layer to filter prohibited topics.. In financial contexts, providing unauthorized advice can lead to legal liability and significant user harm. Implementing a rigid system prompt that explicitly defines the model's limitations, combined with a deterministic 'guardrail' layer that checks for prohibited topics, is essential. This multi-layered approach ensures the model stays within its operational scope, protecting the firm from regulatory risk and ensuring users receive consistent, safe, and accurate information.

Answer

Always set temperature to 0.0 for every query.

Answer

Retrain the model on only financial regulations.

Answer

Add a disclaimer at the end of every response.

Question 10

Which document is essential for an organization to maintain when preparing for an AI audit?

Accepted Answer

An up-to-date AI Risk Register.. An AI audit requires proof of governance, testing, and safety measures. An AI Risk Register, which documents identified risks, their potential impact, and the mitigation strategies in place, is essential. It provides auditors with a clear history of how the organization identifies, assesses, and manages its AI-related risks, demonstrating a mature approach to safety and compliance that satisfies both internal and external oversight requirements.

Answer

A list of all model parameters and hyperparameters.

Answer

The raw training data files for the LLM.

Answer

A transcript of every single user interaction.

Question 11

Refer to the exhibit. The model's response to the user's request is a safety violation. How should the architecture be updated to improve safety?

Accepted Answer

Implement an input-side content moderation guardrail.. The exhibit shows a clear attempt to elicit malicious code, which constitutes a security risk. To improve safety, the organization must implement a content filtering service that sits between the user and the API. This layer inspects requests against a taxonomy of prohibited activities, such as cyberattacks or illegal actions, before they reach the model. This is an essential architectural pattern for protecting against harmful inputs in enterprise AI systems.

Answer

Change the model to a smaller, less capable version.

Answer

Require the user to log in with MFA.

Answer

Increase the frequency of system prompt updates.

Question 12

An organization is evaluating the safety of an LLM-based agent. What is the 'Red Teaming' process in this context?

Accepted Answer

An adversarial testing methodology to find vulnerabilities.. Red Teaming is a structured adversarial testing approach where a dedicated team attempts to find weaknesses, bypass safety guardrails, and elicit harmful responses from an AI system. It is a vital component of the development lifecycle because it identifies edge cases and vulnerabilities that automated tests might miss. Conducting regular red teaming ensures that the system is resilient against sophisticated attacks and remains safe for production deployment.

Answer

The process of updating the model's weights.

Answer

The standard unit testing for API latency.

Answer

The automated deployment of new models.

Question 13

What is the primary risk associated with 'Prompt Injection' attacks in enterprise AI?

Accepted Answer

Unauthorized control of model behavior.. Prompt injection allows attackers to override core system instructions, potentially forcing the AI to leak sensitive data, bypass safety filters, or perform unauthorized actions. This is a critical risk because it undermines the entire security model of the AI application. Enterprise systems must treat all external user input as untrusted, necessitating strong architectural controls to prevent attackers from hijacking the model's intended logic and operational behavior.

Answer

Increased latency for all users.

Answer

A reduction in model accuracy.

Answer

The model becoming permanently unavailable.

Question 14

Which governance practice is most effective for managing 'Third-Party Model Risk'?

Accepted Answer

Conducting vendor due diligence and establishing SLAs.. Managing third-party model risk involves creating a clear vendor management strategy that includes rigorous due diligence, transparency requirements, and contractual guarantees regarding safety and performance. By treating AI providers as critical vendors, organizations ensure that the model provider is held accountable for their platform's safety. This allows the organization to align the provider's capabilities with their own internal risk tolerance and compliance requirements.

Answer

Allowing free access to all models.

Answer

Only using internal models.

Answer

Relying on public trust instead of contracts.

Question 15

When implementing AI safety policies, which THREE components should be included to ensure effective operationalization?

Accepted Answer

Clearly defined prohibited use cases.. Operationalizing safety policy requires a combination of clear guidelines, technical enforcement, and feedback mechanisms. Without all three, policies remain abstract documents that are difficult to follow. Effective governance requires that these policies are baked into the CI/CD pipeline, audited regularly, and enforced by technical tools like guardrails, ensuring that the organization can maintain a consistent safety posture across all AI applications and development teams.

Answer

The ability to ignore rules during testing.

Answer

Complete removal of human oversight.