CCAR-P Practice Questions

Question 1

An architect needs to build an agent that handles complex, multi-step data migrations where each step depends on the output of the previous one. Which approach is most robust for ensuring the agent doesn't lose track of the long-term goal during execution?

Accepted Answer

Plan-and-Execute Pattern. For multi-dependency tasks, a Plan-and-Execute pattern is superior because it separates the high-level strategy from the low-level tool interactions. By maintaining an explicit plan that is updated after each step, the agent can track its progress against the original goal and adjust its future actions based on the results of completed tasks.

Answer

Reactive Tool Calling (ReAct)

Answer

Zero-shot prompting with all tools

Answer

Few-shot prompting with migration examples

Answer

Parallel Sub-tasking

Question 2

Which governance risk is most directly mitigated by using 'Versioned' model identifiers (e.g., 'claude-3-5-sonnet-20240620') instead of the generic 'claude-3-5-sonnet' alias in production?

Accepted Answer

The risk of 'Model Drift' where behavior changes unexpectedly after an update.. Model versioning is a critical practice for ensuring the stability and predictability of AI applications. Using a specific versioned identifier prevents 'model drift', where updates to the underlying model could change its behavior, safety profile, or output format, potentially breaking production workflows or governance checks.

Answer

The risk of exceeding the monthly API budget due to unexpected usage.

Answer

The risk of a 'Man-in-the-Middle' attack intercepting the API key.

Answer

The risk of data residency violations in the US-EAST-1 region.

Question 3

Which governance model best minimizes the risk of 'shadow AI' usage within a large corporation?

Accepted Answer

Implement a centralized enterprise-approved AI service portal with clear usage policies.. Centralized oversight combined with a standardized, approved AI service catalog ensures that business units use vetted, secure, and compliant tools. This approach provides governance without completely stifling innovation, as teams can request new tools through a formal process. By creating a 'path of least resistance' through managed services, organizations can effectively prevent employees from using unauthorized, non-compliant tools that threaten the firm's security and data privacy posture.

Answer

Restrict all internet access to prevent employees from reaching AI websites.

Answer

Require employees to sign a manual waiver every time they use an unauthorized tool.

Answer

Trust individual departments to manage their own AI security and compliance audits.

Question 4

Refer to the exhibit. An application frequently hits rate limits during peak hours. What is the most robust way to improve operational reliability?

Accepted Answer

Implement exponential backoff with jitter in the API client layer.. Handling rate limits through exponential backoff is a standard practice to maintain system stability. When the API returns a rate limit error, the client should wait for the specified duration or use a backoff strategy before retrying. This approach prevents overwhelming the service, respects API quotas, and ensures that the application recovers gracefully from traffic spikes, ultimately leading to a more resilient and professional-grade production architecture.

Answer

Catch the error and retry the request immediately in a loop.

Answer

Increase the timeout duration for all API calls in the application.

Answer

Switch to a synchronous architecture to serialize all API requests.

Question 5

What is the primary role of an AI Safety Committee in an enterprise architecture?

Accepted Answer

To oversee ethical standards and risk-based governance.. An AI Safety Committee acts as the governance body responsible for overseeing the ethical and safe deployment of AI systems. This committee establishes policies, reviews high-risk use cases, and ensures compliance with legal and safety standards. Their role is critical in bridging the gap between technical implementation and organizational values, ensuring that safety is not an afterthought but a central component of the entire AI development lifecycle.

Answer

To handle daily technical debugging of model latency.

Answer

To directly write all production system prompts.

Answer

To manage the cloud provider's physical data centers.

Question 6

A developer is concerned about the high token cost and latency of an agent that has access to 50 different tools. What is the most effective architectural change to optimize this system?

Accepted Answer

Dynamically inject tools based on intent classification. Model performance and cost are directly impacted by the size of the system prompt and tool definitions. By implementing a dynamic tool selection mechanism, the architect can ensure that only the tools relevant to the user's current intent are loaded into the context, significantly reducing the prompt overhead for every turn.

Answer

Switch from JSON to XML tool definitions

Answer

Compress the tool descriptions into single words

Answer

Force the model to use only one tool per turn

Question 7

When designing an agent capable of multi-step tool use, what is the most important property to maintain across steps?

Accepted Answer

Synchronization between the agent's world model and the environment.. Ensuring state consistency is the most important property. Each tool call changes the environment, and the agent must understand the new state to plan the next step. If the state becomes inconsistent—e.g., the agent thinks a file was deleted but it wasn't—the agent's plan will fail. Architecting for state observability ensures that the model always has an accurate 'world model' to work from.

Answer

The exact same temperature parameter for every step.

Answer

The model's internal memory of its own personality.

Answer

Using the same model provider for every single step.

Question 8

During a pilot, a user discovers the AI can be 'prompt-injected' to reveal internal system instructions. What should be your immediate communication response?

Accepted Answer

Acknowledge the finding, explain the mitigation plan, and provide an updated timeline for testing.. Immediate, transparent, and proactive communication is the hallmark of a professional architect. By acknowledging the issue, explaining the fix (such as improved system message structure or input sanitization), and outlining the testing process, you maintain stakeholder trust. This response demonstrates that the team is on top of security and that the system is being actively hardened against threats, which is essential for maintaining project momentum during sensitive pilot phases.

Answer

Downplay the issue as a minor curiosity and claim it is common for all LLMs.

Answer

Issue an immediate apology to all users and take the system offline for a security audit.

Answer

Blame the user for testing the system in a way it was not intended to be used.

Question 9

An agent is engaged in a multi-hour troubleshooting session involving dozens of tool calls and thousands of lines of log data. The architect notices that the agent is starting to 'forget' early symptoms of the problem. Which strategy best addresses this while managing token costs?

Accepted Answer

Implementing a recursive summarization buffer. Managing context in long-running agentic sessions requires a balance between detail and capacity. A summarization strategy combined with a sliding window allows the agent to retain the 'gist' of historical turns while keeping the most recent, high-fidelity data available. This prevents context overflow while maintaining the logical continuity of the troubleshooting process.

Answer

Truncating the oldest messages once the limit is reached

Answer

Switching to a model with a 1-million token window

Answer

Storing all tool results in an external vector database

Question 10

An enterprise is deploying Claude for high-stakes financial analysis. Which TWO governance controls should be implemented to mitigate the risk of model hallucinations and ensure factual accuracy?

Accepted Answer

Implement Retrieval-Augmented Generation (RAG) to ground responses in internal trusted knowledge bases.. Mitigating hallucination risk requires a multi-layered approach involving technical constraints and validation processes. Implementing robust Retrieval-Augmented Generation (RAG) grounds the model's responses in verified source documents, while secondary verification steps add a deterministic layer to the output. These controls are essential in financial services where incorrect data can lead to severe regulatory penalties, financial loss, and significant reputational damage to the organization.

Answer

Increase the temperature parameter to 1.5 to maximize response creativity.

Answer

Require human intervention for every prompt sent to the API to guarantee zero errors.

Answer

Disable all safety filters to allow the model to process complex financial jargon.

Question 11

A security architect is configuring the Anthropic Console for a large enterprise. Which TWO features should be implemented to enforce centralized governance and reduce the risk of unauthorized account access?

Accepted Answer

Single Sign-On (SSO) integration via SAML 2.0.. Centralized governance in the Anthropic Console involves managing how users authenticate and what permissions they have. Implementing enterprise-grade access controls ensures that only authorized personnel can generate API keys or view usage metrics, which is vital for maintaining a secure and compliant AI environment.

Answer

Automatic rotation of all API keys every 24 hours.

Answer

Real-time packet inspection of all API traffic.

Answer

Hardware Security Module (HSM) storage for all model weights.

Question 12

Which THREE strategies should be employed to securely manage sensitive data within an agentic workflow?

Accepted Answer

Apply PII masking/redaction before passing text to the LLM.. Securing agents requires a layered approach: PII masking before sending to the model keeps data private; granular access control ensures the agent only touches data it is authorized to see; and audit logging provides traceability for every decision made. These components ensure that even if the agent is compromised or hallucinates, the impact is contained, data privacy is maintained, and there is a clear record of actions taken for compliance and forensics.

Answer

Enable the model to have full administrative access to the file system.

Answer

Embed all user data directly into the system prompt for faster access.

Question 13

An architect is defining the Shared Responsibility Model for a company deploying Claude via the Messages API. Which THREE tasks are the sole responsibility of the customer (the 'User') rather than Anthropic?

Accepted Answer

Classification and sanitization of PII within input prompts.. Understanding the Shared Responsibility Model is essential for risk management in AI deployments. While Anthropic secures the base model and underlying infrastructure, the customer remains responsible for the data they input, how they configure access to the API, and the specific ways the model's output is integrated into their business processes.

Answer

Physical security of the data centers housing the TPU/GPU clusters.

Answer

Fine-tuning the base model's Constitutional AI principles.

Question 14

Refer to the exhibit. An agentic loop receives this response from the Anthropic API during a critical multi-step operation. Which strategy should the architect implement to ensure the agent completes its task successfully?

Accepted Answer

Implement exponential backoff with jitter in the orchestrator. Transient API errors like 'overloaded_error' are common in high-traffic environments. A robust agentic architecture must handle these gracefully using exponential backoff. This prevents the agent from failing the entire task due to a temporary service interruption and ensures that the long-running state of the agent's work is preserved and resumed.

Answer

Immediately terminate the agent and alert the user

Answer

Restart the entire agentic loop from the first message

Answer

Reduce the temperature of the next request to 0

Question 15

Refer to the exhibit. The monitoring system logs these safety rejections. How should you communicate this to the product owner?

Accepted Answer

Provide a report showing the effectiveness of safety guardrails in mitigating potential risk.. This situation is an opportunity to show the product owner the value of the safety guardrails in action. Presenting the logs as evidence of success—that the system is working as intended to prevent potential violations—reassures the product owner while initiating a conversation about potential refinements. This proactive reporting builds trust in the security of the application and keeps the business stakeholder informed about the protective measures in place.

Answer

Tell them the system is broken and that we need to stop the development immediately.

Answer

Keep the logs hidden to avoid making the project look like it has problems.

Answer

Ask the product owner to manually approve all output that the model generates.

Claude Certified Architect - Professional CCAR-P practice test

Three ways to study

Study CCAR-P by domain

Study CCAR-P by topic

Developer Productivity and Operational Enablement practice questions

Advanced Agentic Architecture practice questions

Governance, Safety, and Risk Management practice questions

Stakeholder Communication and Lifecycle Management practice questions

CCAR-P fundamentals practice questions

CCAR-P scenario practice questions

CCAR-P troubleshooting practice questions

Claude Certified Architect - Professional practice questions