CCAR-P Governance, Safety, and Risk Management Practice Question
A fintech company wants to use Claude to generate personalized financial advice for retail customers. The compliance team mandates that all AI-generated advice must be traceable to a specific model version and configuration for audit purposes. Which governance control best satisfies this requirement?
⚠ Common exam trap
Many candidates confuse security controls like IP whitelisting or human review with audit traceability, which specifically requires capturing model version and configuration in logs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable logging of all API requests and responses with model version and configuration metadata.
The correct control is logging API requests and responses with model version and configuration metadata. This creates a detailed audit trail that links each output to the exact model version and settings used, enabling full traceability. Other options improve security or oversight but fail to provide the required technical record for auditing AI-generated financial advice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement a human review step where a compliance officer approves each piece of advice before it is sent.
Why it's wrong here
Human review adds a layer of oversight but does not create a technical traceability record linking the advice to the model version and configuration. It may even introduce subjective changes that obscure the original AI output. The requirement is for traceability, not approval, so this control does not satisfy the audit mandate.
- ✗
Restrict API access to a whitelist of IP addresses and require multi-factor authentication.
Why it's wrong here
Access controls like IP whitelisting and MFA protect against unauthorized use but do not provide traceability of generated advice to a specific model version and configuration. They are security measures, not audit trail mechanisms. The compliance team's requirement is about reconstructing how advice was generated, which these controls do not address.
- ✓
Enable logging of all API requests and responses with model version and configuration metadata.
Why this is correct
This control directly provides an audit trail linking each piece of advice to the exact model version and configuration used. By capturing request and response data along with metadata, the company can reconstruct how any advice was generated, satisfying traceability requirements. It is the most direct and reliable method to meet the compliance mandate without altering the model's behavior.
- ✗
Use a single, static prompt template that never changes and is stored in version control.
Why it's wrong here
While versioning prompts is good practice, it does not capture the model version or runtime configuration. The requirement is to trace advice to the specific model version and configuration, which a static prompt alone cannot provide. This approach also lacks the request/response logging needed for a complete audit trail, making it insufficient for the stated compliance need.
About these practice questions
One of 262 original CCAR-P practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Anthropic exam blueprint
This CCAR-P practice question is part of Courseiva's free Anthropic certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCAR-P exam.