Free Anthropic CCAR-P Practice Questions

Question 1

A managed agent deployment for claims triage has grown from 6 tools to 34 tools over 18 months as product teams added capabilities. Triage accuracy has declined from 91 percent to 78 percent, and average tool selection latency has increased by 2.3 seconds. A junior engineer has proposed adding a tool router agent in front of the current agent to filter the tool list per request.

Which two findings should you present to justify capability decomposition before adding the router? (Choose two.)

Each correct answer presents part of the solution.

1. Tool descriptions overlap across multiple claim categories within the agent's tool set.
2. Several tools have not been invoked across the most recent 90 days of traffic.
3. The 34 tools serve four distinct claim-workflow domains within the triage scope.
4. The router pattern is well documented across publicly available agent literature.
5. The proposed router introduces an additional model call on every incoming request.

Question 2

You are comparing patterns for a batch document-classification job that follows fixed steps: extract metadata, classify, summarize, and persist.

Which pattern is the best fit and why?

1. A workflow pattern, because agentic patterns do not support tool invocations and therefore cannot execute the persist step that writes results to the downstream store.
2. An agentic pattern, because the open-ended planning capability of agents produces more consistent structured outputs than a fixed workflow graph on classification tasks.
3. An agentic pattern, because agents are categorically more accurate than workflows and therefore always preferable regardless of step predictability.
4. A workflow pattern, because the steps are well-defined and predictable per-request token cost is preferred over flexibility.

Question 3

A platform team operates a self-hosted multi-agent system on Kubernetes that orchestrates seven specialized agents for invoice processing. The team spends approximately 40 percent of engineering capacity on infrastructure maintenance, message bus reliability, and agent state recovery. The CFO has asked you to evaluate moving to managed agent infrastructure to reclaim engineering capacity. The security officer requires that all customer financial data remain within an approved network boundary.

Which factor should most heavily influence your recommendation?

1. Whether the current seven agents map cleanly to the patterns supported by managed agents.
2. Whether managed agents reduce per-invoice token costs across the existing processing volume.
3. Whether managed agents support the current bus topology used by the platform team.
4. Whether managed agent data handling satisfies the network boundary required by security.

Question 4

You are selecting a pattern for a compliance Q&A assistant that must answer policy questions with citations to the authoritative internal source set. Latency, cost, and audit predictability are prioritized.

Which pattern is the best fit?

1. Augmented LLM with retrieval-augmented generation over the indexed authoritative corpus and citation rendering on each response.
2. Multi-agent orchestration with a planner, researcher, and writer agent for every query.
3. A pure agent loop with open web-browsing tools to surface the most current policy information, without constraining retrieval to the authoritative internal corpus.
4. A static prompt with the entire policy corpus concatenated into every request.

Question 5

You are a solution architect designing a Claude-based assistant with access to 60 internal tools across multiple business domains. Loading every tool definition on every request increases token usage and time to first response.

Which design pattern best addresses this issue without sacrificing capability breadth?

1. Apply progressive tool discovery so a curated initial subset is exposed and additional tools are loaded on demand based on the task.
2. Use a separate model call to summarize all 60 tool definitions before each user turn.
3. Increase the maximum context length and load all 60 tool definitions on every request, accepting the higher token cost and latency as necessary for full capability.
4. Hard-code a fixed set of five tools per request to reduce token usage, regardless of whether those tools are relevant to the current task.

Question 6

You are reviewing a customer-support agent's configuration. Each candidate tool falls into one of four categories: (1) required to complete defined tasks; (2) frequently used and reduces hand-offs; (3) occasionally useful for unrelated work; (4) speculative future utility.

Which categories should typically remain in the agent configuration?

1. Only category 3, because occasionally useful tools for unrelated work provide broader coverage and should take priority over tools required for the agent's defined tasks.
2. Only category 4, because speculative future-utility tools provide the most flexibility and should be configured even when no defined task currently requires them.
3. Categories 1 and 2 only, because they map to defined tasks and the agent's regular hand-offs.
4. All four categories, because broader tool access is categorically better for agent performance regardless of whether the tools map to defined tasks or regular hand-offs.

Question 7

You are reviewing a peer's draft system prompt that contains contradictory instructions: one section says to never speculate beyond the supplied source, and another says to confidently fill in any gaps.

Which response is most appropriate?

1. Add a priority instruction directing the model to evaluate all instructions and apply whichever appears most contextually appropriate on each request.
2. Remove or rewrite the gap-filling instruction so the prompt consistently constrains the model to source-supported content.
3. Increase temperature so output randomness masks the contradiction.
4. Keep both instructions and rely on the model to decide which one to follow on each request.

Question 8

A document analysis service processes legal filings averaging 80,000 tokens each. Each filing is queried by attorneys an average of 14 times during a case. The current architecture sends the full filing on every query. The CFO has asked you to reduce per-query costs while preserving response quality. The security officer requires that filing contents not be stored outside Fabrikam's tenancy.

Which optimization approach should you recommend?

1. Summarize each filing once at intake and run all subsequent queries against the summary.
2. Cache the filing as the prompt prefix for reuse across the 14 queries per case.
3. Index filings in a vector store and retrieve only the relevant passages per query.
4. Move the workload to a smaller Claude model to reduce the per-token cost paid.

Question 9

You are designing the prompt for a ticket-triage classifier with thirty well-defined categories and clear category descriptions in the prompt.

Which technique is most appropriate as the starting point?

1. a prompt that demands the model invent new categories when the supplied ones do not fit
2. a chain-of-thought prompt for a routing decision that does not require multi-step reasoning
3. a zero-shot prompt that specifies the categories with their descriptions and the required output format
4. a prompt with no category descriptions, expecting the model to infer the category set

Question 10

You are designing a content moderation classifier that processes high volumes of user-generated comments under a tight per-message latency budget using well-defined classification labels.

Which model selection best aligns with the workload?

1. Opus, because every moderation decision requires maximum reasoning depth regardless of classification complexity.
2. Haiku, because its latency and cost profile align with high-volume classification workloads that require limited reasoning depth.
3. Sonnet, because larger general-purpose models are preferred even when workload latency requirements are strict.
4. Sonnet with extended thinking enabled, because deeper reasoning should be applied to every moderation request to improve edge-case handling.

Question 11

You are configuring tool permissions for a Claude-based assistant. The assistant's defined responsibilities require read access to a knowledge base and write access to a draft queue, and nothing else.

Which scoping design best applies least privilege?

1. Allow access to all tools with read permissions globally and restrict write permissions to the draft-queue tool, without scoping to only the specific tools required for defined tasks.
2. Per-role allow-list of exactly the read-knowledge-base and write-draft-queue tools, enforced at the orchestration layer.
3. Allow access to every tool in the catalog and rely on the model to decline tools it should not use.
4. Disable all tools entirely to achieve a minimal permission surface, accepting that the assistant can no longer perform the read-knowledge-base or write-draft-queue tasks it was designed for.

Question 12

A Claude architect is designing a HIPAA-compliant pipeline that processes patient records.

Which two design decisions directly support HIPAA compliance requirements? (Choose two.)

1. Setting max_tokens to a low value to minimize the volume of text generated per request.
2. Selecting the highest-capability Claude model to maximize diagnostic accuracy.
3. Enforcing role-based access controls so that PHI is retrievable only by authorized personnel.
4. Ensuring patient data is never included in training feedback loops sent to the model provider without a BAA in place.
5. Using streaming responses to reduce perceived latency for clinical users.

Question 13

After a prompt template update, several previously passing test cases now produce unexpected outputs.

Which test type is specifically designed to detect this category of failure?

1. Integration tests that validate cross-component pipeline behavior.
2. Adversarial tests that probe for prompt-injection vulnerabilities.
3. Regression tests scored against a stable reference set of known-good behavior.
4. Smoke tests that confirm high-level system availability after the change.

Question 14

You are building an ethics review checklist for deployments supported by artificial intelligence (AI).

Which two checks belong on the list? (Choose two.)

Each correct answer presents a complete solution.

1. Confirm that vendor licensing terms permit the planned production use of the model.
2. Verify that outputs do not rely on generalizations about people that the underlying data does not support.
3. Confirm that high-impact decisions retain human accountability rather than being attributed to the model.
4. Restrict ethics review to outputs that exceed a defined model-confidence threshold.
5. Confirm that latency and throughput targets are met across supported user populations.

Question 15

You are investigating an MCP server that fails on first launch but succeeds on subsequent runs. The system permission dialogs appeared on first launch.

Which response is most appropriate?

1. Recognize the first-run permission grant as the cause, document the expected behavior in onboarding guidance, and confirm that subsequent runs succeed.
2. Reinstall the operating system to clear all permission state without first confirming whether the one-time permission grant caused the failure.
3. Disable operating-system permission dialogs entirely, accept the resulting security implications, and proceed without confirming whether the failure recurs.
4. Treat the first-run failure as a permanent fault, replace the MCP server, and do not verify whether subsequent runs succeed.

Question 16

A pilot AI assistant for procurement specialists shows 89 percent first-response acceptance, but follow-up surveys reveal that specialists frequently override the assistant's vendor recommendations after consulting unrelated criteria the assistant did not consider. The pilot owner wants to ship the assistant as is, given the strong acceptance rate.

Which two discernment-competency observations should you raise BEFORE approving the launch? (Choose two.)

Each correct answer presents part of the solution.

1. The acceptance rate alone proves readiness for general production use.
2. The survey response rate may not be statistically representative of all specialists.
3. The unconsidered criteria represent a scope gap in the assistant's input space.
4. Acceptance does not establish whether recommendations remain correct after specialist review.
5. The pilot duration was probably too short to demonstrate reliability across the full year.

Question 17

You are integrating human review into a high-volume classification pipeline where reviewing every output is infeasible.

Which sampling strategy best balances throughput with quality oversight?

1. No sampling, relying entirely on user complaints to reveal quality and safety problems after they affect users.
2. Risk-stratified sampling that reviews all low-confidence and high-impact outputs and a smaller random sample of high-confidence routine outputs.
3. Inverse sampling that reviews only high-confidence routine outputs and skips low-confidence and high-impact outputs.
4. Universal review of every output regardless of confidence or throughput impact.

Question 18

You are responding to an adversarial input pattern in which users include text claiming admin authority and instructing the model to bypass safety restrictions.

Which combination of controls most effectively mitigates this attack pattern?

1. Trusting that the model will intrinsically recognize and reject all bypass attempts without prompt-level instructions, runtime classifiers, scoped permissions, or audit logging.
2. Prompt-level instructions that treat user content as untrusted data, runtime classifiers that detect override attempts, scoped tool permissions that cannot be elevated by user content, and audit logging of attempts.
3. Removing all safety restrictions and guardrails to eliminate the attack surface that bypass attempts target, accepting that this makes the assistant unrestricted for all inputs.
4. Granting users any privilege level they assert in their message content, on the assumption that cooperative behavior requires honoring self-declared authority without independent verification.

Question 19

A research summarization assistant has been deployed for six months. A user has flagged that a generated summary contained a fabricated citation. The product team has asked whether the incident requires architectural action or whether it is an isolated case.

Which two Diligence-competency actions should you take? (Choose two.)

Each correct answer presents part of the solution.

1. Sample recent summaries to estimate the fabrication frequency across the population.
2. Disable the assistant immediately for all current users without any prior diagnostic analysis.
3. Review whether citation-grounding controls exist anywhere in the current generation pipeline.
4. Communicate to users that the assistant does not fabricate output as a matter of design.
5. Treat the incident as an anecdotal isolated case and take no further investigative action.

Question 20

You are preparing a HIPAA-eligible deployment for a healthcare customer.

Which configuration supports HIPAA compliance using Anthropic-offered tools?

1. Claude Free with no contractual addendum, since consumer products meet HIPAA requirements out of the box.
2. Claude Enterprise with a signed Business Associate Agreement, Zero Data Retention enabled, and audit logging configured for compliance tracking.
3. Disabling all audit logging so that no PHI is recorded in any log store, on the assumption that the absence of logs satisfies HIPAA requirements without a signed BAA.
4. An ad-hoc personal Claude account used by individual clinicians for PHI-related tasks, with no Business Associate Agreement, no Zero Data Retention, and no audit logging configured.

Question 21

You are an architect supporting the iteration phase of a deployed Claude-based system.

Which activity most directly fits this phase?

1. Rebuild the entire system architecture from scratch at the start of every iteration cycle regardless of what production telemetry, evaluations, and stakeholder feedback indicate is needed.
2. Stop measuring production outcomes once the deployment has successfully launched, treating the go-live milestone as the end of the evaluation and iteration cycle.
3. Discard the evaluation framework and reference set once the deployment is in production, accepting that future iterations will have no structured basis for measuring the impact of changes.
4. Review production telemetry, sampled output evaluations, and stakeholder feedback to identify the highest-impact change for the next cycle, then plan the change against the evaluation framework.

Question 22

You are defining where human review must remain in a planned automated pipeline.

Which placement reflects sound human-in-the-loop design?

1. Place a human reviewer only after the irreversible action has already executed, making the review a post-hoc audit rather than a meaningful pre-action check or approval gate.
2. Place a human reviewer between the model's output and any high-impact, irreversible action, with explicit criteria for what the reviewer must check before approval.
3. Place a human reviewer in the loop for a randomly selected sample of requests, without defining criteria for what the reviewer should check or which output categories require mandatory review.
4. Remove all human review steps from the pipeline to maximize throughput, accepting that high-impact and irreversible actions will be taken without any human approval or oversight.

Question 23

You are compiling guardrail tactics for a customer-facing assistant.

Which two tactics belong on the guardrail list? (Choose two.)

Each correct answer presents a complete solution.

1. Embed approved override phrases that let trusted users relax guardrails on demand.
2. Lower sampling temperature globally to reduce the chance of off-policy completions.
3. Validate the model output against a structured schema before downstream actions are taken.
4. Layer prompt-level guardrails with runtime content checks rather than relying on either alone.
5. Rely on a single hardened system prompt that enumerates every disallowed behavior.

Question 24

You are defining transparency practices for a customer-facing assistant whose responses are materially shaped by AI.

Which transparency practice most directly supports responsible deployment?

1. Misrepresent the AI's role in producing responses in order to make the assistant feel more trustworthy or more human, undermining informed user consent and organizational transparency.
2. Refuse to answer any user question about how the responses were produced or whether AI was involved, treating the AI's role as confidential operational information.
3. Disclose AI involvement to end users in line with the organization's transparency policy and provide a documented path to reach a human when needed.
4. Disclose AI involvement only to internal staff and operators while withholding that information from the end users whose interactions are materially shaped by the AI system.

Question 25

You are selecting a model for a new production workload and must complete the upstream steps before testing candidate models empirically.

Which two steps must be completed BEFORE running a representative sample on a candidate model? (Choose two.)

Each correct answer presents part of the solution.

1. Select the lightest model that consistently meets the quality bar across the sample.
2. Retest the model choice when a new model version becomes available.
3. Choose a candidate model based on the requirements profile and known capabilities.
4. Define the quality bar, latency tolerance, and expected volume for the workload.
5. Sign off the production rollout plan with the platform and security teams.

Question 26

You are reviewing an integration specification for security gaps.

Which two findings constitute valid security gaps in the specification? (Choose two.)

Each correct answer presents a complete solution.

1. Tool calls execute server-side under a least-privilege service principal scoped to the requested action.
2. Service credentials are placed in the prompt context, where they can leak into logs and traces.
3. Role-based access control is enforced only at the response-rendering layer after the model accesses restricted data.
4. Per-user OAuth tokens are exchanged with scope-restricted permissions and refreshed within the active session.
5. Tool inputs and outputs are encrypted in transit using transport-layer security between services.

Question 27

When communicating an architectural decision to a security and compliance reviewer, which content set is most aligned with that audience's primary concerns?

1. Feature delivery schedule, roadmap dependencies, and scope boundaries for the product manager.
2. Implementation timeline, component interfaces, and deployment sequence for the engineering team.
3. Threat model, control mappings, residual-risk acceptance criteria, and audit traceability.
4. Decision rationale, business outcomes, and high-level risk summary for executive review.

Question 28

An engineer inadvertently commits an API key to the repository by placing it in .claude/settings.json.

Which configuration design principle was violated?

1. Project-scope configuration should always override user-scope configuration.
2. Managed configuration must be applied before project-scope configuration is read.
3. Credentials must be resolved at runtime from a secret store and never stored in version-controlled files.
4. MCP server definitions must reside in environment variables to prevent scope conflicts.

Question 29

You are rolling out monitoring for a Claude-based deployment and must complete the specification steps before instrumenting the deployment.

Which two steps must be completed BEFORE instrumenting the deployment to emit metrics and traces? (Choose two.)

Each correct answer presents part of the solution.

1. Define the metrics and the slices the deployment will monitor across normal and adversarial traffic.
2. Tune the alert thresholds based on observed normal-state distributions to reduce false positives.
3. Define the service-level objectives (SLOs) and the error budgets the deployment will be held to.
4. Build the dashboards that surface metrics across slices at the cadence the team operates on.
5. Document the dashboards, alerts, and runbooks for the on-call rotation that will respond.

Question 30

An operations engineer reports that a Claude-based pipeline began returning malformed JSON responses after a scheduled maintenance window, causing downstream processing failures.

Which two investigative steps most directly isolate the root cause? (Choose two.)

1. Clear the prompt cache and resubmit all pending requests to eliminate stale cached prefixes.
2. Compare the current system prompt and output schema configuration against the last known good version from before the maintenance window.
3. Switch to a different Claude model tier to rule out provider-side changes as a contributing factor.
4. Increase the max_tokens limit to determine whether output truncation is causing incomplete JSON structures.
5. Replay a set of premaintenance requests against the current configuration and inspect the raw model output before downstream parsing.

Question 31

You are listing characteristics of robust guardrail design for an enterprise deployment.

Which two characteristics belong on the list? (Choose two.)

Each correct answer presents a complete solution.

1. Centralized log retention for guardrail violations with quarterly review by the security team.
2. Per-role tool allow-lists enforced at the orchestration layer before any tool call executes.
3. User feedback channels that route reported guardrail failures into the product backlog for triage.
4. Periodic refresh of the system prompt wording to keep refusal language current and clear.
5. Adversarial-input coverage in the evaluation set with regression tracking on guardrail performance.

Question 32

A customer support team has proposed delegating customer refund decisions to a Claude-driven workflow with no human review for refunds under 50 USD. The team's reasoning is that small refunds are low-risk and human review would erase the efficiency gain.

Which Delegation-competency principle should guide your response?

1. Delegation should always include human review on every decision the workflow produces.
2. Delegation scope should reflect the type of risk involved, not the transaction size alone.
3. Delegation scope should be set primarily by maximizing efficiency gains across the workflow.
4. Delegation should be avoided entirely wherever financial transactions occur in the workflow.

Question 33

A Claude-based research assistant begins producing responses that confidently contradict its retrieved source documents despite no change to the retrieval pipeline.

Which two diagnostic actions most directly identify the root cause of this behavior? (Choose two.)

1. Increase the context-window size to allow more retrieved chunks per query.
2. Switch the retrieval index to a denser embedding model to improve chunk-relevance scores.
3. Determine whether the failure reproduces on the previous model version to test for a model mismatch.
4. Reduce the temperature setting to lower response variance across all query types.
5. Inspect the system-prompt grounding instructions to determine whether citation constraints remain intact.

Question 34

A Claude architect is implementing safety controls for a customer-facing advice assistant that must never provide regulated investment recommendations.

Which two guardrail implementations most directly enforce this constraint? (Choose two.)

1. Increase response temperature to introduce variability that reduces the likelihood of specific recommendations.
2. Add an output classifier that detects and blocks responses containing regulated investment-recommendation language.
3. Limit session length to reduce the volume of queries processed per user per day.
4. Log all user queries to a SIEM for post-hoc compliance review.
5. Define explicit out-of-scope categories in the system prompt with fixed refusal phrasing for investment advice requests.

Question 35

You are designing a human-in-the-loop validation workflow.

Which two design elements belong in the workflow? (Choose two.)

Each correct answer presents a complete solution.

1. capture of reviewer decisions as labeled data that feeds the evaluation set over time
2. mandatory reviewer agreement with the model output to maintain consistent reviewer-model alignment
3. aggregate reviewer throughput metrics published weekly to leadership for headcount planning
4. uniform sampling of all model outputs to give every request an equal chance of review
5. risk-stratified sampling that concentrates reviewer attention on low-confidence and high-impact outputs

Question 36

You are building an evaluation pipeline for a Claude-based deployment and must complete the specification steps before running the deployment against the dataset.

Which two steps must be completed BEFORE running the deployment against the evaluation dataset? (Choose two.)

Each correct answer presents part of the solution.

1. Publish the aggregated metrics to a dashboard and gate releases on threshold checks.
2. Curate and label the evaluation dataset to match the defined slices.
3. Review failure cases with subject matter experts to refine the scoring rubric.
4. Define the metrics and slices the framework will report across representative, edge, and adversarial cases.
5. Score the deployment outputs against the reference labels and aggregate the metrics.

Question 37

An engineering organization is adopting Claude Code across 200 developers. A team lead has proposed that AI-generated pull requests bypass the standard code review process for changes under 50 lines, on the grounds that small changes are low-risk and review capacity is constrained.

Which two Diligence-competency objections should you raise? (Choose two.)

Each correct answer presents part of the solution.

1. Removing review eliminates the verification mechanism required for AI-generated output across the workflow.
2. Code-review capacity should be expanded to handle every code change submitted across the team.
3. The threshold should be increased to 200 lines to capture more changes.
4. AI-generated pull requests should be rejected by default across the organization.
5. Line count is a poor proxy for the actual risk introduced by a code change.