CCAR-P Governance, Safety, and Risk Management Practice Test 4 — 15 Questions

Question 1

An organization discovers that their AI application is producing biased outputs on certain demographic groups. What is the correct governance step to take first?

Accepted Answer

Suspend the affected functionality to perform a root cause analysis.. The first step in addressing bias is to pause the specific application or feature until a root cause analysis can be performed. Continuing to use an AI that is known to exhibit bias causes ongoing harm and creates legal and reputational risk. Once the system is stabilized, the team can then perform a systematic audit, update the model instructions or data, and re-validate before moving back into a production state.

Answer

Immediately delete all historical user data.

Answer

Publish a press release explaining the bias.

Answer

Ignore the bias if the system is highly profitable.

Question 2

An organization is deploying a customer-facing chatbot using Claude 3.5 Sonnet and needs to ensure the model adheres to ethical guidelines without relying solely on manual moderation. Which core Anthropic safety framework is primarily responsible for the model's ability to self-correct based on a predefined set of principles during its training phase?

Accepted Answer

Constitutional AI. Claude's safety is built on Constitutional AI, which uses a set of principles to guide the model's self-improvement during training. This approach reduces the need for human-annotated safety data and allows for more transparent and steerable AI behavior compared to traditional RLHF. Architects must understand how this foundation impacts model responses to ambiguous or harmful prompts in enterprise production environments.

Answer

Reinforcement Learning from Human Feedback (RLHF)

Answer

Retrieval-Augmented Generation (RAG) Filtering

Answer

Differential Privacy Injection

Question 3

A security architect is performing red-teaming on a new Claude-powered application. They are specifically testing for 'jailbreaking' attempts where a user tries to bypass safety filters by using roleplay or adversarial framing. Which TWO strategies are most effective for mitigating this specific risk at the architectural level?

Accepted Answer

Implementing a robust, immutable System Prompt. Mitigating adversarial attacks requires a multi-layered approach that combines model-native features with external validation. Using a strong system prompt sets clear boundaries that the model prioritizes, while implementing an independent moderation layer provides a final check on outputs. These strategies ensure that even if one layer is bypassed, the overall system remains resilient against malicious intent.

Answer

Increasing the temperature parameter to 1.0

Answer

Reducing the max_tokens limit for all users

Answer

Switching from Claude 3.5 Sonnet to Claude 3 Haiku

Question 4

Refer to the exhibit. Which component in this API request represents the primary governance layer for preventing model bypass of organizational policies?

Accepted Answer

The system parameter instructions. The system parameter serves as the primary governing instruction set for Claude, establishing the operational boundaries and persona before user input is processed. By defining safety constraints and behavioral rules within this field, architects can implement a foundational layer of protection that limits the model's susceptibility to certain prompt injection techniques and ensures consistent adherence to enterprise safety guidelines.

Answer

The model version string

Answer

The metadata object fields

Answer

The user role in the messages array

Question 5

Under the shared responsibility model for AI safety, which task is the primary responsibility of the customer when using Anthropic's APIs?

Accepted Answer

Monitoring and filtering application-specific user inputs. Anthropic manages the safety of the base model through training and infrastructure, but customers are responsible for how they implement the model in their specific context. This includes monitoring end-user behavior and ensuring that the application's specific use case complies with overall usage policies. Understanding this division is essential for establishing clear accountability and risk management procedures.

Answer

Conducting the base model's pre-training safety audits

Answer

Patching the underlying hardware infrastructure

Answer

Developing the Constitutional AI principles

Question 6

An enterprise wants to minimize the risk of PII (Personally Identifiable Information) being processed by Claude while maintaining low latency. Which architectural approach provides the best balance of safety and performance?

Accepted Answer

Using a local PII detection script before the API call. Managing PII risk requires a proactive approach that stops sensitive data before it reaches the model. Using a local, lightweight regex or NLP-based scanner for PII detection allows for immediate filtering without the latency of a secondary LLM call. This ensures that the organization maintains its privacy standards while providing a fast, responsive experience for the end user.

Answer

Sending all data to a second LLM for PII scrubbing

Answer

Asking Claude to ignore all PII in the system prompt

Answer

Relying on the base model's default safety filters

Question 7

A large enterprise is setting up its governance framework for Anthropic API usage. Which THREE features provided by the Anthropic Console are essential for maintaining auditability and administrative control?

Accepted Answer

Audit Logs for API key usage and console activity. Governance in an enterprise context requires tools that provide visibility into usage and restrict access to authorized personnel. Features like audit logs, SSO, and granular member roles allow administrators to track who is using the model and for what purpose. These tools are the backbone of a compliant AI strategy, ensuring that all activities are documented and secure.

Answer

Direct access to the model's weight files

Answer

Automatic prompt optimization for all users

Question 8

A fintech company wants to use Claude to generate personalized financial advice for retail customers. The compliance team mandates that all AI-generated advice must be traceable to a specific model version and configuration for audit purposes. Which governance control best satisfies this requirement?

Accepted Answer

Enable logging of all API requests and responses with model version and configuration metadata.. The correct control is logging API requests and responses with model version and configuration metadata. This creates a detailed audit trail that links each output to the exact model version and settings used, enabling full traceability. Other options improve security or oversight but fail to provide the required technical record for auditing AI-generated financial advice.

Answer

Implement a human review step where a compliance officer approves each piece of advice before it is sent.

Answer

Restrict API access to a whitelist of IP addresses and require multi-factor authentication.

Answer

Use a single, static prompt template that never changes and is stored in version control.

Question 9

A startup is using Claude to generate marketing copy. The legal team is concerned about potential copyright infringement if the model reproduces copyrighted text. Which governance measure should the startup implement to best mitigate this risk?

Accepted Answer

Use a plagiarism detection tool to scan all generated content before publication.. The plagiarism detection tool is the most direct mitigation because it actively checks generated content against known copyrighted works and flags potential matches. This allows human review and modification before publication. Other options either do not prevent infringement or are ineffective, such as disclaimers or temperature adjustments.

Answer

Include a disclaimer that any resemblance to existing works is coincidental.

Answer

Set the model's temperature to zero to ensure deterministic outputs.

Answer

Fine-tune Claude on the startup's own proprietary content to avoid using external data.

Question 10

A multinational corporation is using Claude to process employee feedback surveys. The data includes sensitive personal opinions. The governance team must ensure that the AI system complies with the EU's General Data Protection Regulation (GDPR). Which control is most critical to address the 'right to explanation' requirement for automated decision-making?

Accepted Answer

Implement a mechanism to provide a human-readable explanation of how the AI arrived at its conclusions for each individual.. The right to explanation under GDPR requires that individuals receive meaningful information about the logic of automated decisions. Implementing a mechanism to generate human-readable explanations for each individual directly fulfills this. Other controls like anonymization, consent, or data residency address different aspects of GDPR but not the specific transparency requirement.

Answer

Obtain explicit consent from all employees before processing their feedback with AI.

Answer

Anonymize all employee feedback before processing to remove personal identifiers.

Answer

Store all data within the EU to comply with data residency requirements.

Question 11

A multinational bank runs a Claude-powered assistant that drafts internal credit memos. Auditors require the bank to prove that every generated memo can be traced to the exact human who requested it, the data sources the model retrieved, and the decision it influenced. Which governance capability should the architect implement first to satisfy this requirement?

Accepted Answer

Enable structured audit logging that records request identity, retrieved source references, and downstream model output identifiers for each Claude invocation.. The requirement is evidentiary lineage: for each generated memo, the bank must show the requesting human, the retrieved sources, and the output that influenced a decision. Structured audit logging is the only control that binds identity, retrieval context, and output reference into a reviewable record. Filtering, caching, and spend dashboards address confidentiality, efficiency, and cost respectively, none of which reconstruct the chain of custody auditors demand.

Answer

Configure automatic prompt caching to reduce latency and cost for repeated credit memo templates.

Answer

Deploy a content moderation layer that filters sensitive financial terms before prompts are sent to Claude.

Answer

Set up a dashboard that tracks aggregate token consumption and monthly API spend per business unit.

Question 12

A retail company is building a governance program for a customer-facing Claude agent that can issue refunds and update order records. The risk committee wants controls that limit the blast radius of a compromised or misbehaving agent. (Choose two.)

Accepted Answer

Require human approval for refunds above a defined monetary threshold before the action is executed.. Blast-radius reduction requires preventive controls that bound what the agent can execute. Least-privilege tool scopes with per-action authorization shrink the callable action set, and threshold-based human approval stops high-value refunds before they happen. Logging, policy publication, and periodic transcript review are detective or administrative measures that document or discourage misuse but do not constrain the agent's real-time capabilities, so they fail the risk committee's objective.

Answer

Enable verbose debug logging of every prompt and response for later forensic review.

Answer

Schedule quarterly reviews of the agent's conversation transcripts to identify emerging misuse patterns.

Answer

Publish an acceptable use policy that prohibits employees from manipulating the agent.

Question 13

A software company is using Claude to generate code snippets for internal projects. The security team is concerned that the model might inadvertently suggest code with known vulnerabilities. Which governance control should be implemented to best mitigate this risk?

Accepted Answer

Integrate a static application security testing (SAST) tool into the CI/CD pipeline to scan all AI-generated code before merging.. Integrating SAST into the CI/CD pipeline is the most effective control because it automatically scans all AI-generated code for known vulnerabilities before merging. This provides a consistent, scalable, and early detection mechanism. Manual review and fine-tuning are helpful but less reliable, and restricting scope does not address the core risk of vulnerable code.

Answer

Require developers to manually review all AI-generated code for security issues.

Answer

Restrict Claude's access to only generate code for non-critical components.

Answer

Fine-tune Claude on a dataset of secure code examples to reduce the likelihood of generating vulnerable code.

Question 14

A fintech startup wants to use Claude to generate marketing copy that references competitor products by name and makes performance comparisons. Legal counsel asks the architect which governance step is most appropriate before this capability goes live.

Accepted Answer

Establish a documented review process that classifies the use case against Anthropic's Usage Policies and applicable advertising regulations before deployment.. The scenario involves a potentially sensitive use case: comparative advertising that names competitors. Governance best practice is to classify the use case against Anthropic's usage policies and relevant advertising regulations through a documented review before deployment. Sampling parameters, proofreading, and caching affect style, quality, and cost, and none of them determine whether the activity is permitted or lawful.

Answer

Increase the model's temperature setting so the copy sounds more creative and varied.

Answer

Enable prompt caching to lower the cost of generating large volumes of marketing variants.

Answer

Add a spell-check and grammar pass to the generated marketing copy before publication.

Question 15

A fintech company's risk committee is operationalizing a governance program for Claude-powered customer support agents. They must demonstrate to regulators that model behavior changes are tracked, attributable, and reversible. Which TWO practices best satisfy this requirement? (Choose two.)

Accepted Answer

Run a fixed regression suite against each candidate model version and archive the scored results before promoting it.. Attributable, reversible model change management requires two things working together: a frozen, dated artifact in production and comparable evidence captured before promotion. Pinning to dated model identifiers supplies the frozen artifact and the rollback target, while a fixed regression suite run against each candidate supplies the before-and-after evidence. Together they let the risk committee answer what changed, who approved it, and how to undo it.

Answer

Route every request through a gateway that logs the full request and response payloads with the model identifier attached.

Answer

Enable prompt caching on all production requests so that previously validated prompts are reused verbatim.

Answer

Store the system prompt in a version-controlled repository and require pull-request review before it is merged.