CCAR-P Multiple Select — 30 Questions

Question 1

A security architect is configuring the Anthropic Console for a large enterprise. Which TWO features should be implemented to enforce centralized governance and reduce the risk of unauthorized account access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Single Sign-On (SSO) integration via SAML 2.0.. Centralized governance in the Anthropic Console involves managing how users authenticate and what permissions they have. Implementing enterprise-grade access controls ensures that only authorized personnel can generate API keys or view usage metrics, which is vital for maintaining a secure and compliant AI environment.

Answer

Automatic rotation of all API keys every 24 hours.

Answer

Real-time packet inspection of all API traffic.

Answer

Hardware Security Module (HSM) storage for all model weights.

Question 2

Which THREE strategies should be employed to securely manage sensitive data within an agentic workflow?

Accepted Answer

Apply PII masking/redaction before passing text to the LLM.. Securing agents requires a layered approach: PII masking before sending to the model keeps data private; granular access control ensures the agent only touches data it is authorized to see; and audit logging provides traceability for every decision made. These components ensure that even if the agent is compromised or hallucinates, the impact is contained, data privacy is maintained, and there is a clear record of actions taken for compliance and forensics.

Answer

Enable the model to have full administrative access to the file system.

Answer

Embed all user data directly into the system prompt for faster access.

Question 3

An architect is defining the Shared Responsibility Model for a company deploying Claude via the Messages API. Which THREE tasks are the sole responsibility of the customer (the 'User') rather than Anthropic?

Accepted Answer

Classification and sanitization of PII within input prompts.. Understanding the Shared Responsibility Model is essential for risk management in AI deployments. While Anthropic secures the base model and underlying infrastructure, the customer remains responsible for the data they input, how they configure access to the API, and the specific ways the model's output is integrated into their business processes.

Answer

Physical security of the data centers housing the TPU/GPU clusters.

Answer

Fine-tuning the base model's Constitutional AI principles.

Question 4

To ensure long-term maintainability and performance of LLM-based applications, which THREE architectural patterns should architects recommend? (Select THREE)

Accepted Answer

Decouple prompt management and model selection from core application logic.. Decoupling model logic, implementing robust caching, and establishing monitoring are vital for long-term sustainability. Decoupling allows for model upgrades without massive refactoring, caching reduces latency and costs for repetitive queries, and monitoring ensures that performance degradation is caught immediately. These patterns transform 'experimental' LLM features into production-grade systems that developers can manage efficiently, reducing the technical debt typically associated with quickly-built AI integrations.

Answer

Hardcode system prompts to ensure the model behavior cannot change over time.

Answer

Use the largest available context window for every single request to maximize intelligence.

Question 5

An enterprise client is concerned about the 'black box' nature of LLMs. Which THREE communication strategies should the architect use to build transparency and trust?

Accepted Answer

Present the results of red-teaming exercises to show how vulnerabilities are identified and patched.. Building trust with stakeholders requires moving beyond marketing claims to concrete evidence of system reliability and oversight. By demonstrating how the model reaches decisions, implementing monitoring to catch errors, and providing clear documentation on safety guardrails, the architect demystifies the technology. These strategies collectively address stakeholder anxiety by providing a tangible framework for oversight, control, and accountability within the automated system.

Answer

Promise stakeholders that the model will have a 100% accuracy rate for all inputs.

Answer

Avoid mentioning technical constraints to keep the stakeholder focused on the positive benefits.

Question 6

A company is integrating Claude into a high-stakes automated decision-making system. Which TWO practices should be implemented to align with Anthropic’s Responsible AI principles?

Accepted Answer

Implement human-in-the-loop oversight for model outputs.. Integrating LLMs into high-stakes environments requires a focus on human-in-the-loop (HITL) oversight and continuous monitoring. These practices help manage hallucinations and maintain accountability. Without these safeguards, automated systems can produce biased or incorrect outcomes without human correction. Implementing these protocols ensures that AI governance remains aligned with human values and organizational safety goals, reducing the risk of unintended consequences in critical decision-making processes.

Answer

Allow the model to finalize decisions without human review.

Answer

Only use the most advanced model available for all tasks.

Answer

Disable all system logs to preserve user privacy.

Question 7

Which THREE factors should be prioritized when selecting an Anthropic model for a production-grade application?

Accepted Answer

Latency requirements of the specific user task.. Balancing performance, latency, and cost is fundamental to operational enablement. A professional architect must consider the specific requirements of the task—whether high-level reasoning or rapid response—to ensure that the chosen model delivers value efficiently. These factors dictate the system's scalability and overall budget, making them the primary drivers for architectural decisions when building and maintaining reliable AI-powered solutions in a corporate environment.

Answer

The total number of parameters in the model.

Answer

Whether the model is open-source or proprietary.

Question 8

Which TWO practices best improve the maintainability of large-scale prompt libraries? (Choose TWO)

Accepted Answer

Store prompts in external configuration files or a dedicated prompt management system.. Managing large prompt libraries requires modularity and version control to ensure consistency. By treating prompts as code and decoupling them from application logic, teams can implement standardized testing and deployment workflows. This separation allows developers to iterate on prompt performance independently of the software release cycle, reducing the risk of regressions and enabling rapid experimentation within established operational guardrails.

Answer

Hardcode all prompt versions directly into the application source code.

Answer

Combine prompts and business logic into monolithic classes for better encapsulation.

Answer

Avoid using variables in prompts to ensure absolute predictability.

Question 9

A retail company is building a governance program for a customer-facing Claude agent that can issue refunds and update order records. The risk committee wants controls that limit the blast radius of a compromised or misbehaving agent. (Choose two.)

Accepted Answer

Require human approval for refunds above a defined monetary threshold before the action is executed.. Blast-radius reduction requires preventive controls that bound what the agent can execute. Least-privilege tool scopes with per-action authorization shrink the callable action set, and threshold-based human approval stops high-value refunds before they happen. Logging, policy publication, and periodic transcript review are detective or administrative measures that document or discourage misuse but do not constrain the agent's real-time capabilities, so they fail the risk committee's objective.

Answer

Enable verbose debug logging of every prompt and response for later forensic review.

Answer

Schedule quarterly reviews of the agent's conversation transcripts to identify emerging misuse patterns.

Answer

Publish an acceptable use policy that prohibits employees from manipulating the agent.

Question 10

A fintech company's risk committee is operationalizing a governance program for Claude-powered customer support agents. They must demonstrate to regulators that model behavior changes are tracked, attributable, and reversible. Which TWO practices best satisfy this requirement? (Choose two.)

Accepted Answer

Run a fixed regression suite against each candidate model version and archive the scored results before promoting it.. Attributable, reversible model change management requires two things working together: a frozen, dated artifact in production and comparable evidence captured before promotion. Pinning to dated model identifiers supplies the frozen artifact and the rollback target, while a fixed regression suite run against each candidate supplies the before-and-after evidence. Together they let the risk committee answer what changed, who approved it, and how to undo it.

Answer

Route every request through a gateway that logs the full request and response payloads with the model identifier attached.

Answer

Enable prompt caching on all production requests so that previously validated prompts are reused verbatim.

Answer

Store the system prompt in a version-controlled repository and require pull-request review before it is merged.

Question 11

A hospital network is drafting its AI risk register for a Claude-based discharge-summary assistant. The governance lead wants entries that describe residual risk after existing controls are applied, and that can be assigned an owner and a review cadence. Which TWO characteristics must each risk register entry have to meet this standard? (Choose two.)

Accepted Answer

A residual risk rating that reflects the effect of the controls already in place.. An operational risk register entry must state the exposure that remains after controls and must have someone accountable for watching it on a schedule. Residual rating captures what is actually at stake post-mitigation, while owner and review interval ensure the entry is revisited and acted upon as the assistant and its clinical context change.

Answer

A verbatim copy of the vendor's model card and system prompt.

Answer

A list of every employee who has ever accessed the assistant.

Answer

A projected cost saving attributed to deploying the assistant.

Question 12

You are preparing a go-live readiness review for a Claude-powered advisory assistant used by field staff. The steering committee wants assurance that operational ownership is clear before launch. Which two artifacts are most essential to demonstrate that the lifecycle handover from project to operations is complete? (Choose two.)

Accepted Answer

A documented service ownership agreement naming the accountable team, support hours, and service level objectives.. A complete handover requires both a named owner and the operational procedures that owner will follow. The service ownership agreement establishes accountability, support hours, and service level objectives, while the signed runbook documents incident response, escalation, and maintenance. Together they give the steering committee confidence that the assistant will be sustained after the project team transitions away, rather than drifting without ownership or support coverage.

Answer

A list of all stakeholders who attended the project kickoff meeting.

Answer

A complete archive of every prompt version ever tested during development.

Answer

A slide deck summarizing the assistant's key features for the marketing team.

Question 13

An architect wants to improve the coherence of an agent that frequently makes 'leaps of logic' or misses obvious errors in its tool outputs. Which TWO techniques directly address this behavior?

Accepted Answer

Chain-of-Thought (CoT) in the assistant turns. Coherence in agents is improved by forcing the model to externalize its reasoning and critique its own work. Chain-of-thought encourages the model to plan before acting, while self-reflection allows it to catch and correct its own mistakes in a subsequent turn, leading to much more reliable agentic behavior.

Answer

Increasing the frequency of tool calls

Answer

Reducing the temperature to exactly 0.0

Answer

Using the 'tool_choice' parameter to force tool use

Question 14

When implementing AI safety policies, which THREE components should be included to ensure effective operationalization?

Accepted Answer

Clearly defined prohibited use cases.. Operationalizing safety policy requires a combination of clear guidelines, technical enforcement, and feedback mechanisms. Without all three, policies remain abstract documents that are difficult to follow. Effective governance requires that these policies are baked into the CI/CD pipeline, audited regularly, and enforced by technical tools like guardrails, ensuring that the organization can maintain a consistent safety posture across all AI applications and development teams.

Answer

The ability to ignore rules during testing.

Answer

Complete removal of human oversight.

Question 15

An organization is building an internal CLI tool that uses Anthropic's API. They want to improve developer productivity by implementing robust error handling and monitoring. Which TWO strategies should they implement? (Select TWO)

Accepted Answer

Implement exponential backoff logic for handling 429 and 5xx API responses.. Implementing exponential backoff and structured logging are foundational for operational reliability. Exponential backoff gracefully handles rate-limiting and transient errors, preventing pipeline failures. Structured logging allows teams to parse API metrics, latency, and token usage, providing visibility into costs and performance. These practices directly improve developer experience by reducing time spent troubleshooting intermittent failures and optimizing API resource consumption in automated workflows.

Answer

Store API keys as plain text in the CLI configuration file for ease of developer access.

Answer

Set the maximum token limit to 4096 for all requests to ensure uniform response times.

Answer

Disable all request retries to ensure the CLI tool fails fast during network issues.

Question 16

When designing an agentic system, which TWO of these 'observability' metrics are most crucial for monitoring the health of the agent's reasoning process?

Accepted Answer

Total Step Count per Task.. Tracking 'Step count per task' and 'Tool call success rate' provides immediate visibility into whether the agent is diverging or struggling. An unusually high step count indicates potential infinite loops or circular reasoning. A low tool call success rate reveals integration failures or ambiguous tool definitions. By monitoring these, you can detect system degradation before it impacts the end-user, allowing for proactive debugging and iterative improvements to the agent's core instruction set.

Answer

Average latency of the user's internet connection.

Answer

The color profile of the agent's UI dashboard.

Answer

Number of times the user clicks the refresh button.

Question 17

An autonomous agent is designed to browse the web and perform research. Which TWO mechanisms are most critical for preventing infinite loops and excessive API consumption during autonomous tool-calling cycles?

Accepted Answer

Implementing a maximum iteration counter. In autonomous agentic loops, the risk of 'stuck' states or recursive logic is high. Implementing both hard iteration limits and state-based detection ensures the system remains within operational bounds. These safeguards are essential for production-grade agents to prevent runaway costs and to provide a predictable user experience in non-deterministic environments.

Answer

Increasing the context window size

Answer

Using a lower temperature setting

Answer

Enabling prompt caching for tool definitions

Question 18

A developer enablement team is building an internal prompt playground so engineers can iterate on Claude prompts without writing API code. They want the playground to reflect production behavior and avoid surprising cost overruns. (Choose two.)

Accepted Answer

Pin the playground to the same model version and system prompt that production uses, so experiments reflect real behavior.. A playground is only useful if its results predict production, so the model version and system prompt must match what ships. Cost safety comes from automated controls: per-user quotas and usage dashboards. Together these give engineers fast, trustworthy iteration without exposing the organization to unbounded spend. Unlimited keys, disabled streaming, and ticket-gated testing each fail either the parity goal or the velocity goal.

Answer

Disable streaming in the playground to reduce token consumption.

Answer

Require engineers to file a ticket for every prompt test so usage is reviewed before execution.

Answer

Give every engineer an unlimited personal API key so experimentation is never blocked.

Question 19

A developer enablement group is standing up a shared Claude integration library that dozens of internal teams will consume. They want to reduce duplicated work and prevent each team from re-implementing fragile request handling. Which TWO practices best improve developer productivity across those consuming teams? (Choose two.)

Accepted Answer

Publish a typed client library that encapsulates authentication, retries, and error normalization behind a small, stable interface.. A typed client library with a small stable interface centralizes fragile request handling so teams do not each reinvent retries and error normalization. Runnable examples and integration tests lower the cost of adoption and document the recommended patterns. Together these reduce duplicated work and support questions, which is exactly what a developer enablement group is trying to achieve.

Answer

Give every team direct access to the raw HTTP layer and encourage them to call the API without the shared library.

Answer

Keep the client API undocumented so teams are forced to read the source code and understand every internal detail.

Answer

Require every consuming team to write its own request wrapper so each can tune retries to its own latency profile.

Question 20

A platform team is standardizing how internal teams integrate Claude. Leadership wants faster onboarding, fewer production incidents, and clear accountability for cost. Which TWO practices best support these goals? (Choose two.)

Accepted Answer

Publish a golden-path reference implementation with sample prompts, error handling, and a checklist for going to production.. A golden-path reference implementation accelerates onboarding and reduces incidents by giving teams proven patterns, while per-service tagging with a shared usage dashboard makes cost attributable and accountable. Freezing model versions, allowing full tooling autonomy, and centralizing one shared key each work against at least one of the stated goals, so they are not the right practices here.

Answer

Route all Claude traffic through a single shared API key managed by the platform team to simplify billing.

Answer

Let each team choose its own SDK, logging format, and retry strategy to maximize autonomy.

Answer

Mandate that all teams use the same model version and freeze upgrades for a year to reduce variability.