CCAR-P Governance, Safety, and Risk Management Practice Question
An architect is defining the Shared Responsibility Model for a company deploying Claude via the Messages API. Which THREE tasks are the sole responsibility of the customer (the 'User') rather than Anthropic?
⚠ Common exam trap
Candidates often assume that cloud providers or model vendors handle data privacy filtering and output correctness out of the box, confusing provider responsibilities with customer duties.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Classification and sanitization of PII within input prompts.
Understanding the Shared Responsibility Model is essential for risk management in AI deployments. While Anthropic secures the base model and underlying infrastructure, the customer remains responsible for the data they input, how they configure access to the API, and the specific ways the model's output is integrated into their business processes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Classification and sanitization of PII within input prompts.
Why this is correct
Customers are responsible for identifying and managing the sensitivity of the data they send to the model. Anthropic does not automatically know which data points constitute PII for a specific business context, so the customer must implement their own redaction or classification logic before calling the Messages API.
- ✗
Physical security of the data centers housing the TPU/GPU clusters.
Why it's wrong here
The physical security of the hardware and the environment where the models are trained and hosted is the responsibility of Anthropic and its cloud infrastructure partners. Customers have no control over data center access or hardware maintenance, as these are managed at the platform and infrastructure layers.
- ✗
Fine-tuning the base model's Constitutional AI principles.
Why it's wrong here
Constitutional AI principles are baked into the model's core during the training and RLHF phases by Anthropic researchers. Customers cannot modify these foundational safety guardrails; instead, they must use system prompts and external moderation tools to layer their own specific business rules on top of the model.
- ✓
Implementing Identity and Access Management (IAM) for API key usage.
Why this is correct
The customer is responsible for ensuring that API keys are stored securely and that only authorized applications or developers can access the Claude endpoints. Failure to manage IAM properly can lead to unauthorized usage, data leaks, and unexpected costs, all of which fall under the customer's operational domain.
- ✓
Monitoring model outputs for internal policy compliance and accuracy.
Why this is correct
While Claude has built-in safety filters, the customer must verify that the model's responses align with their specific industry regulations and internal brand guidelines. This includes setting up human-in-the-loop reviews or automated evaluation pipelines to catch hallucinations or policy violations that are specific to the enterprise.
About these practice questions
Courseiva writes every CCAR-P question from scratch — 262 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Anthropic exam blueprint
This CCAR-P practice question is part of Courseiva's free Anthropic certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCAR-P exam.