Free Practice Questions for Anthropic CCAR-P Exam

Option D defines a measurable performance characteristic rather than a business capability. The requirement specifies a percentile-based latency threshold—under 800 milliseconds at the 95th percentile—and ties that threshold to the expected workload volume. It therefore describes how well the system must operate under defined conditions.

Options A, B, and C are functional requirements. They describe actions the solution must perform: extracting fields and creating a downstream record, producing an editable draft, and assigning tickets to categories. Functional requirements define observable system behaviors or outputs.

A strong non-functional requirement must include a metric, threshold, measurement method, and operating condition. For Option D, the architect should further define whether latency is measured end-to-end or only at the model API, the test duration, concurrency, input-size distribution, cache state, timeout behavior, geographic region, and treatment of failed requests. Without those details, teams may report incompatible results while claiming to satisfy the same requirement.

Non-functional requirements for Claude solutions commonly address latency, availability, throughput, cost, privacy, security, recoverability, observability, scalability, and regulatory compliance.

Study Guide references/topics: Structured discovery; functional requirements; non-functional requirements; p95 latency; workload conditions; measurable acceptance criteria.

===============

Self-declared administrative authority inside a prompt is untrusted data, not authenticated identity or authorization evidence. Option B correctly combines independent controls across the model, runtime, authorization, and monitoring layers.

Prompt instructions establish that user content cannot override system policy. Runtime classifiers detect known and generalized attempts to bypass controls. Tool permissions are enforced outside the model and must derive from authenticated identity, role, and approved scope—not statements contained in the conversation. Audit logging records the actor, attempted override, classifier result, tool requests, and final disposition for investigation and control improvement.

Anthropic recommends input screening, hardened system prompts, safe handling of untrusted content, narrowly scoped permissions, red-team testing, and continuous monitoring. Mitigate Jailbreaks and Prompt Injections

Option A depends entirely on model behavior and provides no containment if the model fails. Option C removes the protections the attacker is attempting to defeat. Option D commits a fundamental authorization error by accepting an unverified claim as privilege elevation.

The strongest design also rate-limits repeated attempts, escalates suspicious activity, validates outputs, and requires human confirmation for consequential actions.

Study Guide references/topics: Direct prompt injection; untrusted user content; runtime classifiers; non-model authorization; scoped tools; audit logging; defense in depth.

Per-user, scope-restricted OAuth tokens directly eliminate the shared-credential weakness. Each token represents a distinct user or delegated identity, carries only the permissions required for that user’s role, and can be revoked independently. This supports least privilege, limits the blast radius of credential compromise, and enables authorization decisions to be tied to a specific principal instead of an undifferentiated shared API key.

Actor attribution in tool-call logs directly resolves the second finding. Each audit event should record the authenticated user, delegated service identity, session or request identifier, tool name, authorization decision, relevant resource, timestamp, and outcome. This establishes accountability and permits incident investigators to reconstruct who initiated a consequential action.

Moving credentials into a server-side secret store is sound secret-management practice, but it does not by itself correct the shared-identity problem: a centrally stored key can still represent every user as the same principal. Schema validation protects downstream processing, while retrieval-layer RBAC protects information access; neither addresses the two specific audit findings.

These controls should be reinforced by short-lived tokens, server-side authorization enforcement, sensitive-field redaction, and tamper-resistant audit-log retention.

Study Guide references/topics: [Claude Code security](https://docs.anthropic.com/en/docs/claude-code/security); [MCP authentication and OAuth] (https://docs.anthropic.com/en/docs/claude-code/mcp); least privilege; identity propagation; auditable tool execution.

===============

Robust guardrails require both preventive enforcement and continuous empirical validation. Per-role tool allow-lists satisfy the preventive requirement by restricting each authenticated role to explicitly authorized tools. Enforcement must occur in the orchestration or permission layer before execution; relying on the model to decide whether a tool call is authorized is not an adequate security boundary. Anthropic recommends allow-list-based validation and provides permission rules and pre-tool-use controls capable of denying calls before they execute.

Adversarial evaluation with regression tracking supplies the validation component. The evaluation set should include prompt injections, indirect injections, encoded instructions, multi-turn escalation, role-confusion attempts, and requests designed to trigger unauthorized tool use. Guardrail performance must then be measured across releases so that changes to prompts, models, tools, or orchestration logic do not silently reduce protection.

Centralized logging and user feedback are useful detective and lifecycle controls, but neither prevents an unsafe action nor proves guardrail effectiveness. Periodically refreshing refusal wording is also insufficient unless the revised behavior is evaluated against defined safety criteria. The strongest design therefore combines deterministic authorization with adversarial regression testing.

Study Guide references/topics: Claude Code permissions and pre-tool enforcement ; tool allow-list guidance ; adversarial evaluations; regression testing; least-privilege orchestration.

===============

Option C addresses both components responsible for the excessive cost. Anthropic prompt caching allows stable, repeatedly submitted prompt material—such as system instructions, tool definitions, and reusable background information—to be placed in a consistent prefix. After that prefix is written to the cache, qualifying subsequent requests can reuse it at the lower cache-read cost instead of repeatedly processing the same content at the standard input-token rate.

Retrieval must be optimized separately. Supplying an entire document collection or excessively deep search results increases cost, consumes context capacity, and may reduce answer quality by surrounding the relevant evidence with distracting material. Retrieval should select the smallest set of authoritative passages that provides sufficient evidence for the current query. This typically requires relevance scoring, deduplication, metadata filtering, reranking, and explicit token-budget limits.

Increasing retrieval depth or expanding the repeated system prompt directly worsens the identified cost driver. Moving every request to a heavier model changes the unit economics but does not correct inefficient context construction. The recommended optimization therefore combines prefix caching with query-specific context pruning, followed by evaluation to confirm that reduced context does not lower task accuracy.

Study Guide references/topics: [Prompt caching](https://docs.anthropic.com/en/docs/build-with-claude/prompt-caching); [effective context engineering] (https://www.anthropic.com/engineering/effective-context-engineering-for-ai-agents); retrieval precision; token-cost analysis; cache-prefix stability.

===============

The evaluation metrics must map directly to the two stated requirements. Role-based access-control enforcement rate, tested against a red-team dataset, measures whether requests from unauthorized identities, roles, or access paths are consistently denied. It converts the privacy and authorization requirement into an observable security metric and exposes bypass conditions that ordinary functional tests may miss. Because the requirement says patient data must never reach unauthorized roles, the acceptance threshold should be effectively 100% enforcement across representative and adversarial cases.

Per-query token cost directly measures compliance with the financial constraint. The metric should include uncached input, cache reads and writes where applicable, output tokens, thinking tokens, and any other billable components attributed to the request. Results can then be compared with the defined ceiling across normal, boundary, and worst-case inputs.

Anthropic’s evaluation guidance identifies privacy preservation and price as distinct success criteria and emphasizes that criteria must be specific, measurable, and relevant to the application. Define Success Criteria and Build Evaluations

BLEU may assess textual similarity but does not test authorization or cost. Throughput and percentile latency are valuable operational metrics, yet neither directly answers the two requirements in the scenario.

Study Guide references/topics: Multidimensional evaluation; privacy preservation; authorization testing; red-team datasets; token-cost measurement; requirement-to-metric traceability.

===============

The procedure should have one authoritative implementation and one accountable owner. Packaging it as a compliance-owned Skill allows the instructions, examples, templates, and prohibited patterns to be maintained together. Referencing that same Skill from all three workflows ensures that updates propagate consistently without requiring separate prompt changes. Embedding copies in multiple system prompts or allowing workflow teams to rewrite the procedure creates configuration drift and inconsistent regulatory behavior. A retrieval corpus is appropriate for searchable reference material, but the requirement concerns a fixed operational procedure that Claude must follow, making a Skill the stronger abstraction. The Skill should be versioned, reviewed, tested, and released through a controlled publication process. Claude Code Skills

Over-refusal and hallucination are characteristic model-behavior risks. An overly broad safety response can reject a legitimate request even when the surrounding application operates correctly. A plausible but unsupported answer is a groundedness failure arising from probabilistic generation and inadequate source adherence. These risks require model-specific evaluations, grounding instructions, citations, verification, and calibrated fallback behavior. Expired certificates, database timeouts, and load-balancer misconfiguration are conventional distributed-system failures that should be addressed through infrastructure monitoring, retries, health checks, and configuration management. Distinguishing these categories matters because ordinary software remediation will not resolve behavioral failures, while prompt changes will not repair infrastructure. Anthropic’s hallucination guidance recommends auditable citations and supporting evidence for generated claims. Reducing hallucinations

Model identity and version are essential diagnostic dimensions. Without them, operators cannot correlate a behavioral change with a model migration, reproduce the conditions of a failed turn, compare performance among model versions, or distinguish model drift from prompt, retrieval, and application defects. Therefore, the omission described in Option D is a genuine observability gap.

Option E is equally significant. A multi-agent execution normally crosses orchestration, model, agent, MCP, and tool boundaries. If the request-scoped correlation identifier or distributed trace context is lost at any boundary, the resulting spans cannot reliably be reconstructed into one end-to-end transaction. Anthropic’s monitoring guidance explains that distributed tracing links a user prompt to the API requests and tool executions it initiates; it also documents propagation of W3C trace context to supported subprocesses and outbound MCP requests. Claude Code Monitoring

Options A and B describe healthy telemetry coverage rather than gaps. Option C is also appropriate because recording tool interactions supports investigation, while redaction reduces the risk of exposing sensitive data in logs.

Study Guide references/topics: Integration—observability challenges at scale; distributed tracing; correlation identifiers; model-version attribution; privacy-aware tool telemetry.

===============

A delivery team needs implementation-level direction rather than an executive architecture summary. Component responsibilities establish ownership and boundaries, while interface contracts define schemas, accepted inputs, outputs, errors, and behavioral expectations. Sequence diagrams show how components interact across dominant and failure flows. Configuration tables with defaults prevent inconsistent assumptions between environments. Operational runbooks ensure that deployment, recovery, monitoring, and routine maintenance are addressed during implementation rather than improvised after release. Options B, C, and D omit one or more elements required to translate architectural intent into a buildable and supportable system. The guide should enable normal delivery work without continuous dependence on undocumented knowledge held by the architect.

Study Guide references/topics: Implementation documentation; component contracts; sequence diagrams; configuration management; operational readiness.