Free Anthropic CCAR-P Practice Exam with Questions & Answers | Set: 3

Role-based access control directly supports HIPAA’s access-control and minimum-necessary principles. The retrieval and orchestration layers must verify the authenticated user’s role before protected health information enters the model context. Authorization should be applied to individual records, data sources, tools, and actions, with audit events recording the requesting identity, accessed resource, purpose, and result. Model instructions alone are not a security boundary.

Patient information must also remain within services and processing activities covered by the organization’s Business Associate Agreement. Anthropic states that PHI processing requires a HIPAA-ready organization and an accepted BAA, and that only specified eligible services and configurations are covered. Patient data must not be submitted through training, feedback, beta, third-party, or integration pathways that fall outside the applicable agreement. A BAA is not blanket authorization; architects must verify feature eligibility and disable inappropriate data-sharing mechanisms.

Reducing max_tokens, selecting a more capable model, and enabling streaming affect output length, quality, or latency. They do not establish authorization, contractual coverage, minimum-necessary access, or compliant PHI handling.

Study Guide references/topics: Anthropic Business Associate Agreement requirements; HIPAA-ready services; PHI access control; minimum necessary; eligible-service boundaries; auditability.

===============

A steering committee needs an answer-first recommendation that states the proposed architectural decision, the business outcome it supports, and the approval or action required. After establishing that common decision frame, the document should address each stakeholder’s concerns separately.

The CFO requires implementation and operating costs, expected savings, consumption assumptions, financial exposure, and cost-control mechanisms. General counsel needs evidence concerning confidentiality, privilege, data handling, human legal review, explainability, retention, and regulatory risk. The CIO needs integration architecture, security boundaries, availability, scalability, operational ownership, technical dependencies, and lifecycle support.

Option A begins at an implementation depth unsuitable for the entire committee. Option B overweights the CFO’s concerns and delays the rationale required by the other decision-makers. Option C ignores audience-specific responsibilities and forces every stakeholder to extract relevant information from an undifferentiated narrative.

The recommended structure is: decision and executive rationale, expected outcomes, accepted trade-offs, stakeholder-specific impact sections, major risks and controls, implementation implications, success metrics, and the requested governance decision. Technical appendices can preserve component-level detail without overwhelming the principal recommendation.

Study Guide references/topics: Executive communication; stakeholder differentiation; decision-first structure; financial, legal, and technology concerns; architectural recommendations.

===============

Control A directly constrains the outbound action surface. An allow-list limits which tools and destinations may receive data, while per-call review introduces an approval boundary before information leaves the controlled environment. These measures therefore address data exfiltration through outbound tool calls, making Option C correct. Anthropic’s security guidance recommends least privilege, narrowly scoped permissions, sandboxing, and limiting access to sensitive information and actions so that a compromised agent can cause minimal damage. Mitigate Jailbreaks and Prompt Injections

Control B addresses model-version drift. Running a stable adversarial evaluation set after each version change creates a consistent comparison baseline and detects regressions that might otherwise remain invisible during routine testing. This correctly maps Control B to silent quality drift, making Option E correct. Anthropic’s migration guidance repeatedly calls for workload reevaluation because instruction following, style, reasoning, and agent behavior can differ between versions. Model Migration Guide

Control A may limit the consequences of successful prompt injection, but it does not prevent or directly detect adversarial instructions in retrieved content. Control B measures behavioral performance but does not impose outbound authorization controls. Each control must therefore be mapped to the risk it most directly mitigates.

Study Guide references/topics: Tool governance; least privilege; exfiltration controls; adversarial evaluations; model-change regression testing; defense in depth.

===============

A dedicated subagent is justified when specialization is recurring and operationally valuable. Option A allows the team to encode a database-review role once, including its system prompt, triggering description, permitted tools, model, and review criteria. This improves consistency across sessions, isolates specialized context, and applies least privilege by withholding unrelated capabilities. Anthropic’s custom subagent documentation supports task-specific prompts, model selection, tool allowlists, permission modes, hooks, skills, and persistent memory. A one-time question does not justify the maintenance overhead of a reusable agent definition, while Options C and D explicitly provide no specialization requirement. The subagent should also have clear invocation conditions, evaluation cases, ownership, and lifecycle review.

Study Guide references/topics: Claude Code subagents; task specialization; context isolation; model routing; scoped permissions; reusable automation.

Yes, No, Yes, No, Yes

Least privilege requires each retained tool to be necessary for the agent’s assigned responsibility and restricted to the minimum action level needed. Catalog lookup is appropriate because vendor and SKU information is needed to prepare an accurate request. The policy-document tool is similarly justified because the agent must ground the draft in applicable procurement rules. The draft-write tool is also aligned because it writes only to a review queue, preserving the required human approval boundary.

The inbox-send tool exceeds the stated responsibility. Sending a request directly to a vendor converts a drafting assistant into an externally acting purchasing agent and bypasses the review stage. The production-database administrator tool is unrelated to procurement and introduces unnecessary destructive capability, privilege-escalation exposure, and potential data-access risk.

Anthropic’s prompt-injection guidance recommends limiting access to sensitive data and actions and applying least privilege so that a compromised agent can cause minimal damage. Claude Code also supports tool-specific allow, ask, and deny rules that are enforced outside the model. Prompt-Injection Mitigation, Claude Code Permissions

Study Guide references/topics: Capability-bloat auditing; least privilege; tool scoping; human review gates; separation of drafting and execution authority.

===============

Observation 1 is a direct efficiency improvement because the time required for one summarization task fell substantially. Observation 2 shows that local time savings have not yet translated into higher organizational productivity or billable output. Observation 3 is explicitly a solution-cost problem caused by unnecessary API calls. Observation 4 introduces additional human correction time and therefore partially offsets the gross efficiency gain reported in Observation 1. Option D is the only answer that keeps these value dimensions distinct. Measuring only generation speed would overstate realized value because review effort, retry costs, and downstream output must also be included. A valid post-deployment assessment should calculate net cycle time, cost per accepted summary, correction rate, and resulting business output.

The sponsor’s statement expresses a desired outcome but does not define an implementable requirement. Option B converts the vague request into concrete information about users, workflow triggers, expected resolutions, decision boundaries, and non-functional constraints. These findings can then be translated into measurable success criteria, evaluation cases, integration requirements, and escalation rules. Anthropic’s evaluation guidance states that an LLM application should begin with specific, measurable, achievable, and relevant success criteria. Option A prematurely treats an aspiration as a complete specification. Option C incorrectly transfers discovery responsibility entirely to the sponsor, while Option D imports assumptions from an unrelated context. Effective Claude architecture requires traceability from the business problem through requirements, evaluation measures, design decisions, and production acceptance criteria. Anthropic: Define success criteria and build evaluations

================

The required control is best implemented through layered prevention. The system prompt should explicitly classify personalized investment recommendations as out of scope, instruct Claude not to recommend particular securities or transactions, and provide standardized refusal language. Fixed refusal behavior reduces ambiguity and gives the model a clear alternative response when users request prohibited advice or attempt to reframe it indirectly.

An output classifier supplies an independent enforcement layer after generation but before delivery. It should detect prohibited recommendation language, individualized buy-or-sell instructions, portfolio allocations, and equivalent regulated content. A detected violation must block or replace the response rather than merely record it. This protects against prompt circumvention, unexpected phrasing, and occasional model noncompliance.

Increasing temperature makes responses less predictable and weakens control reliability. Session-length limits regulate volume, not content. SIEM logging is valuable for monitoring, investigation, and compliance evidence, but it is detective rather than preventative: the prohibited recommendation may already have reached the customer.

The completed design should evaluate both layers using adversarial prompts, paraphrases, multi-turn escalation, and classifier false-negative testing.

Study Guide references/topics: [Mitigating jailbreaks and prompt injections](https://docs.anthropic.com/en/docs/test-and-evaluate/strengthen-guardrails/mitigate-jailbreaks); layered guardrails; explicit scope boundaries; standardized refusals; output classification; pre-delivery enforcement.

===============

Authorization must be enforced before restricted information enters model context. The retrieval service should authenticate the user, resolve role and document permissions, and filter candidate records before prompt construction. This prevents unauthorized content from appearing in prompts, model traces, cached context, tool results, or generated responses. A system-prompt instruction is behavioral guidance, not an enforceable access-control boundary. Post-generation filtering is also inadequate because the model has already received and processed the restricted data, creating exposure through output, logging, or indirect inference. Relying on general refusal behavior provides no deterministic authorization. The correct architecture treats RBAC as an application and data-layer control, with the model receiving only information the requesting principal is entitled to access.

Study Guide references/topics: Retrieval-layer RBAC; authorization before inference; least privilege; sensitive-context isolation.

The interaction model and portability requirement are architectural decision drivers. MCP is appropriate when tools or data sources must be exposed through a standardized interface reusable across compatible AI clients. Direct API integration is often preferable for a narrow, stateless, latency-sensitive call where the application already owns the integration logic. Agent-to-agent handoff is better suited to stateful or longer-running delegation between independently responsible agents. Documentation quality and team familiarity influence implementation effort but do not determine the correct integration pattern. Encryption in transit is a mandatory security property for production integration rather than a differentiating architectural requirement; each viable approach must provide it. Anthropic distinguishes direct Messages access from stateful managed-agent infrastructure, while MCP supplies a standardized tool integration layer. Claude Platform documentation