Study with CCAR-P Actual Test Questions

You are reviewing instrumentation in a multi-agent system.
Which two findings constitute valid observability gaps in the instrumentation? (Select two.) Each correct answer presents a complete solution.

• A. Trace spans for each agent step are exported to the shared distributed-tracing backend.
• B. Tool-call payloads and outcomes are recorded with redaction applied to known sensitive fields.
• C. Latency and token usage on every span are emitted to the central metrics pipeline.
• D. Request-scoped correlation identifiers do not propagate across agent and tool calls.
• E. Model identity and version on each turn are not recorded with the turn artifacts.

You are designing a human-in-the-loop validation workflow for a new Claude-based deployment and must complete the design steps before piloting the workflow.
Which two steps must be completed BEFORE piloting the workflow with a representative subset of traffic?
(Select two.)
Each correct answer presents part of the solution.

• A. Iterate the workflow design based on observed pilot findings before broader rollout to production.
• B. Document the workflow with check criteria, escalation paths, and service-level agreements (SLAs) for each step.
• C. Define the sampling strategy and the escalation criteria at each oversight point in the pipeline.
• D. Onboard the reviewer pool with role-specific training on the check criteria and escalation procedures.
• E. Identify the decision points in the pipeline that require human oversight by impact and reversibility.

During an architectural review, the security team identifies a risk that adversarial content injected into retrieved documents could manipulate the model's behavior.
Which mitigation most directly addresses this threat?

• A. Require citations for each claim and constrain responses to source-supported content.
• B. Restrict outbound tool calls to an approved destination allow-list.
• C. Score outputs against a stable adversarial evaluation set on each model-version change.
• D. Treat all retrieved content as untrusted input and apply input classifiers with output validation.

A Claude architect is auditing configuration scope assignments.
Which two statements correctly identify an appropriate use of user-scope configuration versus other scopes?
(Select two.)

• A. Defining MCP server endpoints shared by all contributors to a specific repository.
• B. Saving a preferred Claude response language that applies to all repositories the engineer uses.
• C. Persisting personal editor theme preferences that follow an engineer across projects.
• D. Enforcing a company-wide policy that disables a feature for all engineers.
• E. Storing API authentication keys so they are not committed to version control.

A Claude architect is designing a HIPAA-compliant pipeline that processes patient records.
Which two design decisions directly support HIPAA compliance requirements? (Select two.)

• A. Using streaming responses to reduce perceived latency for clinical users.
• B. Enforcing role-based access controls so that PHI is retrievable only by authorized personnel.
• C. Setting max_tokens to a low value to minimize the volume of text generated per request.
• D. Selecting the highest-capability Claude model to maximize diagnostic accuracy.
• E. Ensuring patient data is never included in training feedback loops sent to the model provider without a BAA in place.