CCAR-P Governance, Safety, and Risk Management Practice Question
An organization requires strict adherence to data residency requirements for PII processed by Claude. Which strategy best ensures that customer prompts and completions remain within a specific geographic boundary while utilizing Anthropic's API?
⚠ Common exam trap
Candidates often assume that simply 'enabling encryption' satisfies data residency. Data residency specifically requires ensuring the data physically stays within defined geographic boundaries, which requires endpoint configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the API client to target region-specific endpoints and verify regional data residency settings.
Implementing region-specific API endpoints combined with Data Residency configurations ensures that data processing and storage occur within authorized borders. This approach is critical for regulatory compliance in jurisdictions like the EU. By limiting the scope of model interaction to regional infrastructure, architects prevent the inadvertent cross-border transfer of sensitive data, thereby aligning with global privacy governance frameworks and minimizing legal exposure for the enterprise.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable global load balancing across all available Anthropic regions to optimize latency.
Why it's wrong here
Global load balancing explicitly contradicts data residency requirements by routing traffic to the lowest-latency node, which may reside outside the designated jurisdiction. This introduces unacceptable compliance risk by potentially routing PII through unauthorized geographical zones, violating strict data sovereignty mandates imposed by local privacy regulators.
- ✗
Encrypt all outgoing prompts using a third-party gateway before sending to Anthropic.
Why it's wrong here
While client-side encryption adds a layer of security, it does not address the physical location of the data processing environment. Anthropic must still decrypt the prompt to generate a completion, meaning the processing location remains the primary factor in satisfying residency-based governance mandates.
- ✓
Configure the API client to target region-specific endpoints and verify regional data residency settings.
Why this is correct
Targeting region-specific endpoints ensures that the API request is handled by infrastructure physically located within the required jurisdiction. When coupled with data residency settings, this architecture guarantees that neither prompts nor completions are stored in non-compliant regions, effectively addressing both processing and storage governance concerns.
- ✗
Anonymize all data locally and rely on Anthropic's general model training to handle PII.
Why it's wrong here
Relying on model training to handle PII is a violation of data governance principles. Even if anonymized, the risk of data leakage or re-identification remains high. Furthermore, this does not satisfy residency laws, as the processing infrastructure location remains undefined and potentially outside the required jurisdiction.
About these practice questions
This CCAR-P question is part of Courseiva's 262-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Anthropic exam blueprint
This CCAR-P practice question is part of Courseiva's free Anthropic certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCAR-P exam.