CCAR-P Governance, Safety, and Risk Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Utilize regional endpoints in AWS Bedrock or GCP Vertex AI located in EU regions.

  Why this is correct

  Regional endpoints in cloud provider environments guarantee that both the inference traffic and the underlying model compute operations are physically restricted to the selected geography. This architecture prevents cross-border data transfers, directly satisfying legal requirements for data sovereignty and internal compliance protocols for handling European citizen data.

• ✗

  Enable cross-region inference to ensure high availability across global data centers.

  Why it's wrong here

  Cross-region inference dynamically routes traffic to any available global capacity to maintain performance during peak demand or outages. This behavior is fundamentally incompatible with strict data residency requirements because it may send sensitive EU data to US-based servers for processing, resulting in a serious regulatory violation.

• ✗

  Configure the standard Anthropic Console with an EU-based billing address.

  Why it's wrong here

  Setting a billing address in the Anthropic Console does not change the physical location of the API infrastructure or data storage. The standard Anthropic SaaS offering primarily operates out of US-based regions, meaning that prompt data would still be processed outside of the EU regardless of the company's headquarters.

• ✗

  Implement client-side encryption for all prompts using AWS KMS keys.

  Why it's wrong here

  While encryption at rest and in transit is a vital security layer, it does not address the physical location of the data processing environment. Even with customer-managed keys, the model must decrypt the prompt within the compute memory of the server, which may still be located in a non-EU region.