CCAR-P Practice Question: Developer Productivity and Operational Enablement
A platform team wants every service to call Claude through a single internal gateway that injects the system prompt, enforces token budgets, and emits OpenTelemetry traces. A developer proposes having each service call the Anthropic Messages API directly and centralizing only the API key in a shared vault. What is the strongest architectural reason to reject the developer's proposal?
⚠ Common exam trap
The trap here is assuming that centralizing the API key alone delivers the same governance as centralizing the call path.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Centralizing the API key without centralizing the call path removes the single point where prompt policy, token budgets, and traces can be enforced.
A shared secret protects only the credential, not the behavior around it. The gateway is valuable because it is the one place where system prompts are injected, token budgets are enforced, and OpenTelemetry spans are produced. Routing every service through it keeps those controls consistent and auditable, whereas direct Messages API calls scatter policy across many codebases and make drift inevitable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Direct client calls cannot use streaming responses, so latency-sensitive features would break.
Why it's wrong here
The Anthropic Messages API supports streaming from any client that implements server-sent events, including direct service calls. Streaming is not limited to gateway-mediated traffic. This makes the statement factually wrong as a reason to reject the proposal. The actual architectural deficiency is the loss of centralized policy, tracing, and token accounting that the gateway would otherwise enforce.
- ✗
The Anthropic Messages API rejects requests that originate from more than one client ID per key.
Why it's wrong here
There is no such restriction; an API key can be used by many clients concurrently, subject to rate limits. Inventing a client-ID restriction misstates how the API works. The genuine concern is governance, not a protocol limitation. A gateway centralizes prompt injection, budget enforcement, and trace emission, which per-service direct calls cannot guarantee consistently.
- ✓
Centralizing the API key without centralizing the call path removes the single point where prompt policy, token budgets, and traces can be enforced.
Why this is correct
The gateway exists to be the chokepoint where system prompts are injected, budgets are checked, and spans are emitted. If services call the Messages API directly, those controls fragment across codebases and drift. A shared key protects the credential but does nothing for policy or observability. Centralizing the call path is what makes the controls reliable and auditable across every service.
- ✗
A shared vault secret cannot be rotated without redeploying every consuming service.
Why it's wrong here
Rotation of a vault secret is normally handled dynamically by the vault agent and does not require redeploying consumers, so this is not the decisive objection. The developer's proposal could still rotate keys. The real problem is that per-service direct calls bypass centralized policy enforcement, observability, and budget control, which is exactly what the gateway was meant to provide.
About these practice questions
Courseiva writes every CCAR-P question from scratch — 262 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Anthropic exam blueprint
This CCAR-P practice question is part of Courseiva's free Anthropic certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCAR-P exam.