CCAR-P Governance, Safety, and Risk Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a single organization-wide API key for all departments to share.

  Why it's wrong here

  A shared API key is a significant security flaw. It prevents granular auditing, makes revocation impossible without impacting the entire company, and violates the principle of least privilege. If the key is leaked, the entire organization's AI usage and security posture are immediately compromised.

• ✓

  Use separate API keys for each project with specific rate limits and usage quotas.

  Why this is correct

  Granular, project-specific keys allow for precise control and oversight. By enforcing usage quotas and rate limits, the organization can manage costs and limit the impact of any potential security breach to a single project, directly adhering to the principle of least privilege in a production environment.

• ✗

  Provide all developers with unrestricted access to the master organization API key.

  Why it's wrong here

  Unrestricted access to a master key is a major governance failure. It provides far more privilege than any single developer needs and creates an unacceptable risk profile. This practice undermines all security efforts, as a single malicious or compromised developer could control the entire AI ecosystem.

• ✗

  Rotate all team keys daily to ensure the highest level of security.

  Why it's wrong here

  While daily rotation sounds secure, it creates operational instability and increases the risk of service disruption. Efficient governance focuses on secure secret management and least-privilege scoping rather than extreme rotation cycles, which often lead to brittle infrastructure and increased administrative overhead without proportional security gains.