Free Practice Questions for Anthropic CCAR-P Exam

Self-declared administrative authority inside a prompt is untrusted data, not authenticated identity or authorization evidence. Option B correctly combines independent controls across the model, runtime, authorization, and monitoring layers.

Prompt instructions establish that user content cannot override system policy. Runtime classifiers detect known and generalized attempts to bypass controls. Tool permissions are enforced outside the model and must derive from authenticated identity, role, and approved scope—not statements contained in the conversation. Audit logging records the actor, attempted override, classifier result, tool requests, and final disposition for investigation and control improvement.

Anthropic recommends input screening, hardened system prompts, safe handling of untrusted content, narrowly scoped permissions, red-team testing, and continuous monitoring. Mitigate Jailbreaks and Prompt Injections

Option A depends entirely on model behavior and provides no containment if the model fails. Option C removes the protections the attacker is attempting to defeat. Option D commits a fundamental authorization error by accepting an unverified claim as privilege elevation.

The strongest design also rate-limits repeated attempts, escalates suspicious activity, validates outputs, and requires human confirmation for consequential actions.

Study Guide references/topics: Direct prompt injection; untrusted user content; runtime classifiers; non-model authorization; scoped tools; audit logging; defense in depth.

Drafting first-pass investigative reports from semi-structured incident logs for analyst review — Yes

Computing real-time fraud scores at sub-50-millisecond latency on a streaming pipeline — No

Long-context contract review with structured clause extraction and deviation flagging — Yes

Replacing a vector index for semantic retrieval over a multi-million-document corpus — No

Routing inbound support tickets into 30 categories with reasoning for the selected route — Yes

Claude is well suited to language-intensive analysis, summarization, extraction, classification, and drafting. Investigative-report drafting, contract analysis, and support-ticket routing all require interpretation of unstructured or semi-structured language and can incorporate human review. A sub-50-millisecond fraud-scoring path requires deterministic, specialized real-time processing and should not place LLM inference on the critical path. Claude also does not replace the retrieval index used to search millions of documents; it consumes the results produced by that infrastructure. The correct architectural decision separates tasks requiring semantic language reasoning from deterministic computation and information-retrieval infrastructure. Model selection and evaluation must then confirm that the chosen Claude model satisfies quality, latency, and cost requirements.

The 80,000-token filing is a large, stable prefix reused across fourteen requests, making prompt caching the strongest optimization. The first request creates the cache; subsequent identical-prefix requests use lower-priced cache reads while retaining the complete filing, preserving the evidence available to Claude. Anthropic documents cache reads at a fraction of standard input cost and confirms that caches are isolated by organization and, on supported platforms, by workspace. Cached representations remain in memory rather than persistent storage. Options A and C may omit context through summarization or retrieval and therefore require additional quality evaluation. Option D lowers unit cost but may reduce reasoning quality. The design must preserve prefix identity, choose an appropriate TTL, and verify the tenancy configuration.

Study Guide references/topics: Prompt caching; cache isolation; stable prefixes; long-document analysis; cost optimization.

The interaction model and portability requirement are architectural decision drivers. MCP is appropriate when tools or data sources must be exposed through a standardized interface reusable across compatible AI clients. Direct API integration is often preferable for a narrow, stateless, latency-sensitive call where the application already owns the integration logic. Agent-to-agent handoff is better suited to stateful or longer-running delegation between independently responsible agents. Documentation quality and team familiarity influence implementation effort but do not determine the correct integration pattern. Encryption in transit is a mandatory security property for production integration rather than a differentiating architectural requirement; each viable approach must provide it. Anthropic distinguishes direct Messages access from stateful managed-agent infrastructure, while MCP supplies a standardized tool integration layer. Claude Platform documentation

The absence of company-specific training does not establish unbiased behavior. A foundation model may reflect demographic associations or unequal treatment patterns originating from pretraining data, model behavior, prompt framing, retrieval content, or the surrounding decision workflow. Because candidate screening can materially affect employment opportunities, the complete system must be evaluated across relevant protected groups before deployment. Appropriate measures include selection-rate differences, false-positive and false-negative rates, calibration, intersectional slices, and human override patterns. Disclosure that AI is used does not replace empirical fairness testing. Protected-class labels need not have been explicit in training data for proxy variables or inferred attributes to produce disparities. Provider policies similarly do not validate a customer’s specific implementation. Anthropic system cards document discriminatory-bias evaluations, reinforcing the need for application-level testing. Claude model system card

Model identity and version are essential diagnostic dimensions. Without them, operators cannot correlate a behavioral change with a model migration, reproduce the conditions of a failed turn, compare performance among model versions, or distinguish model drift from prompt, retrieval, and application defects. Therefore, the omission described in Option D is a genuine observability gap.

Option E is equally significant. A multi-agent execution normally crosses orchestration, model, agent, MCP, and tool boundaries. If the request-scoped correlation identifier or distributed trace context is lost at any boundary, the resulting spans cannot reliably be reconstructed into one end-to-end transaction. Anthropic’s monitoring guidance explains that distributed tracing links a user prompt to the API requests and tool executions it initiates; it also documents propagation of W3C trace context to supported subprocesses and outbound MCP requests. Claude Code Monitoring

Options A and B describe healthy telemetry coverage rather than gaps. Option C is also appropriate because recording tool interactions supports investigation, while redaction reduces the risk of exposing sensitive data in logs.

Study Guide references/topics: Integration—observability challenges at scale; distributed tracing; correlation identifiers; model-version attribution; privacy-aware tool telemetry.

===============

A shared project settings file is intended to be committed so that team-level configuration can travel with the repository. Consequently, it must never contain API keys, access tokens, passwords, or comparable secrets. Credentials should be injected at runtime through an approved secret-management mechanism, environment-specific credential provider, or delegated authentication flow. This separates distributable configuration from sensitive authentication material and supports rotation, revocation, auditing, and least privilege. Options A and B concern configuration precedence rather than secret handling. Option D is incorrect because MCP server definitions may legitimately be stored in project configuration; only their sensitive credential values must remain outside version control. Because the key was exposed, the operational response should also include immediate revocation or rotation and investigation of repository history. Claude Code: Settings files and precedence

================

Observation 1 is a direct efficiency improvement because the time required for one summarization task fell substantially. Observation 2 shows that local time savings have not yet translated into higher organizational productivity or billable output. Observation 3 is explicitly a solution-cost problem caused by unnecessary API calls. Observation 4 introduces additional human correction time and therefore partially offsets the gross efficiency gain reported in Observation 1. Option D is the only answer that keeps these value dimensions distinct. Measuring only generation speed would overstate realized value because review effort, retry costs, and downstream output must also be included. A valid post-deployment assessment should calculate net cycle time, cost per accepted summary, correction rate, and resulting business output.

Robust guardrails require both preventive enforcement and continuous empirical validation. Per-role tool allow-lists satisfy the preventive requirement by restricting each authenticated role to explicitly authorized tools. Enforcement must occur in the orchestration or permission layer before execution; relying on the model to decide whether a tool call is authorized is not an adequate security boundary. Anthropic recommends allow-list-based validation and provides permission rules and pre-tool-use controls capable of denying calls before they execute.

Adversarial evaluation with regression tracking supplies the validation component. The evaluation set should include prompt injections, indirect injections, encoded instructions, multi-turn escalation, role-confusion attempts, and requests designed to trigger unauthorized tool use. Guardrail performance must then be measured across releases so that changes to prompts, models, tools, or orchestration logic do not silently reduce protection.

Centralized logging and user feedback are useful detective and lifecycle controls, but neither prevents an unsafe action nor proves guardrail effectiveness. Periodically refreshing refusal wording is also insufficient unless the revised behavior is evaluated against defined safety criteria. The strongest design therefore combines deterministic authorization with adversarial regression testing.

Study Guide references/topics: Claude Code permissions and pre-tool enforcement; tool allow-list guidance; adversarial evaluations; regression testing; least-privilege orchestration.

===============

A steering committee needs an answer-first recommendation that states the proposed architectural decision, the business outcome it supports, and the approval or action required. After establishing that common decision frame, the document should address each stakeholder’s concerns separately.

The CFO requires implementation and operating costs, expected savings, consumption assumptions, financial exposure, and cost-control mechanisms. General counsel needs evidence concerning confidentiality, privilege, data handling, human legal review, explainability, retention, and regulatory risk. The CIO needs integration architecture, security boundaries, availability, scalability, operational ownership, technical dependencies, and lifecycle support.

Option A begins at an implementation depth unsuitable for the entire committee. Option B overweights the CFO’s concerns and delays the rationale required by the other decision-makers. Option C ignores audience-specific responsibilities and forces every stakeholder to extract relevant information from an undifferentiated narrative.

The recommended structure is: decision and executive rationale, expected outcomes, accepted trade-offs, stakeholder-specific impact sections, major risks and controls, implementation implications, success metrics, and the requested governance decision. Technical appendices can preserve component-level detail without overwhelming the principal recommendation.

Study Guide references/topics: Executive communication; stakeholder differentiation; decision-first structure; financial, legal, and technology concerns; architectural recommendations.

===============