Free Practice Questions for the Anthropic Claude Certified Architect CCAR-P Exam (2026 Updated)

An ethics review must examine unsupported generalizations, stereotyping, disparate treatment, and other conclusions about people that are not justified by the evidence. It must also preserve identifiable human accountability for consequential decisions; responsibility cannot be transferred to a probabilistic system. Licensing is a legal and commercial-control question, while latency and throughput are operational requirements. Both remain important, but neither is the central ethical test presented here. Restricting review to low-confidence or threshold-triggering outputs is also inadequate because models can express harmful or biased conclusions with high confidence. Ethical review should cover representative populations, protected and intersectional groups, high-impact outcomes, override mechanisms, transparency, and channels for challenge or appeal.

Study Guide references/topics: Bias and unsupported generalization; human accountability; consequential decisions; ethical oversight.

User scope applies to one engineer across every project and is therefore appropriate for portable personal preferences. Option A fits this definition because an interface theme belongs to the individual rather than to a repository or organization. Option B also fits because Claude Code provides a language setting for the preferred response language, and placing that preference in user scope makes it apply across repositories.

Option C requires managed configuration because an organization-wide security control must be centrally deployed and resistant to individual override. Option D belongs in project scope because repository-specific MCP endpoints must be shared consistently with that repository’s contributors.

Option E describes credential handling rather than merely a preference assignment. Credentials must not be placed in a repository, but avoiding version control alone is insufficient. They must be stored through a supported secure authentication mechanism, protected environment configuration, operating-system credential facility, or approved secrets manager—not inserted as plaintext into an ordinary settings file.

Anthropic defines user scope as affecting one user across all projects, project scope as shared repository configuration, and managed scope as the location for enforceable organizational controls. It also explicitly lists themes and other personal settings as user-scope use cases. Claude Code Configuration Scopes

Study Guide references/topics: User scope; project scope; managed configuration; personal preferences; repository-shared MCP configuration; credential protection.

===============

Over-refusal and hallucination are characteristic model-behavior risks. An overly broad safety response can reject a legitimate request even when the surrounding application operates correctly. A plausible but unsupported answer is a groundedness failure arising from probabilistic generation and inadequate source adherence. These risks require model-specific evaluations, grounding instructions, citations, verification, and calibrated fallback behavior. Expired certificates, database timeouts, and load-balancer misconfiguration are conventional distributed-system failures that should be addressed through infrastructure monitoring, retries, health checks, and configuration management. Distinguishing these categories matters because ordinary software remediation will not resolve behavioral failures, while prompt changes will not repair infrastructure. Anthropic’s hallucination guidance recommends auditable citations and supporting evidence for generated claims. Reducing hallucinations

Authorization and compliance logging must remain enforceable application-layer controls. Option B requires the application to authenticate the requester, resolve the user’s role and entitlements, and deny the operation when the user lacks authority. A Skill can instruct Claude how to behave, but it is not a reliable security boundary and cannot replace identity-based access control enforced by the surrounding system.

Option A similarly belongs at the application layer. The application must create an authoritative audit event containing the requester, timestamp, Skill and model version, relevant input or content identifiers, generated output, review status, and retention classification. Audit evidence cannot depend on whether the model remembers or chooses to invoke a logging instruction.

Options C, D, and E describe reusable generation behavior that appropriately belongs within the approved Skill: house style, the standardized disclaimer, and the prohibited-language policy. The application may still validate their presence after generation, but the Skill remains the primary reusable content package.

The correct architecture separates behavioral guidance from deterministic enforcement. Skills supply domain instructions and templates; the application enforces identity, authorization, audit retention, data access, output validation, and consequential-action controls.

Study Guide references/topics: Skills versus application controls; authentication; authorization; compliance logging; deterministic guardrails; policy enforcement boundaries.

===============

Role-based access control directly supports HIPAA’s access-control and minimum-necessary principles. The retrieval and orchestration layers must verify the authenticated user’s role before protected health information enters the model context. Authorization should be applied to individual records, data sources, tools, and actions, with audit events recording the requesting identity, accessed resource, purpose, and result. Model instructions alone are not a security boundary.

Patient information must also remain within services and processing activities covered by the organization’s Business Associate Agreement. Anthropic states that PHI processing requires a HIPAA-ready organization and an accepted BAA, and that only specified eligible services and configurations are covered. Patient data must not be submitted through training, feedback, beta, third-party, or integration pathways that fall outside the applicable agreement. A BAA is not blanket authorization; architects must verify feature eligibility and disable inappropriate data-sharing mechanisms.

Reducing max_tokens, selecting a more capable model, and enabling streaming affect output length, quality, or latency. They do not establish authorization, contractual coverage, minimum-necessary access, or compliant PHI handling.

Study Guide references/topics: Anthropic Business Associate Agreement requirements; HIPAA-ready services; PHI access control; minimum necessary; eligible-service boundaries; auditability.

===============

Authentication and authorization run before retrieval so retrieval can filter by identity — Yes

An asynchronous queue absorbs bursty traffic between intake and the model-invocation layer — Yes

Tax computation is encoded directly in the system prompt rather than in code — No

Conversation logs include unredacted government identifiers to maximize tuning signal — No

Authentication and authorization must precede retrieval so unauthorized information never enters model context. An asynchronous queue is appropriate for burst absorption, backpressure, controlled concurrency, and retry management at scale. Deterministic tax computation should be implemented in validated code or a controlled calculation tool, not delegated to probabilistic prompt interpretation. Including unredacted government identifiers in conversation logs violates data-minimization principles and creates unnecessary privacy, security, and regulatory exposure. Sensitive fields should be removed, tokenized, or redacted before logging or model use unless specifically required and authorized. The resulting design separates deterministic computation, access control, scalable orchestration, and language reasoning into appropriate architectural layers.

Responsible deployment requires users to receive an accurate representation of the system with which they are interacting. Option C provides that transparency while also establishing a practical escalation path. Disclosure should be proportionate to the material role AI plays, expressed in language appropriate to the audience, and aligned with organizational policy and applicable regulatory obligations.

A documented human-contact route is important when the assistant cannot resolve an issue, produces a disputed result, encounters a high-impact exception, or handles a matter requiring human authority. Anthropic’s Responsible Scaling Policy recognizes escalation to human reviewers as an appropriate safeguard for edge cases and situations requiring human judgment. Responsible Scaling Policy

Options A and D intentionally conceal material AI involvement from affected users, weakening informed decision-making, auditability, and trust. Option B is also unsuitable because transparency does not require revealing proprietary prompts, confidential controls, or internal security mechanisms; however, it does require an honest explanation of AI involvement and the system’s operational role.

The correct design combines disclosure, understandable limitations, human escalation, and records demonstrating that the organization’s transparency requirements are consistently applied.

Study Guide references/topics: AI transparency; informed user interaction; human escalation; responsible deployment; disclosure policy; operational accountability.

===============

A stable adversarial regression set provides a controlled basis for detecting behavioral change between model versions. Version-attributed results show whether the proposed upgrade improves, preserves, or degrades performance on the same safety-relevant cases. The evaluation must run before promotion so a regression can block deployment rather than becoming a production incident. Randomly replacing the test inputs removes comparability and makes score changes difficult to attribute. Disabling evaluation or relying on complaints converts a preventable release-control failure into reactive incident handling. Anthropic characterizes regression evaluations as tests of whether an agent still handles tasks it previously completed and recommends maintaining them continuously to detect backsliding. Demystifying evals for AI agents

Robust guardrails require both preventive enforcement and continuous empirical validation. Per-role tool allow-lists satisfy the preventive requirement by restricting each authenticated role to explicitly authorized tools. Enforcement must occur in the orchestration or permission layer before execution; relying on the model to decide whether a tool call is authorized is not an adequate security boundary. Anthropic recommends allow-list-based validation and provides permission rules and pre-tool-use controls capable of denying calls before they execute.

Adversarial evaluation with regression tracking supplies the validation component. The evaluation set should include prompt injections, indirect injections, encoded instructions, multi-turn escalation, role-confusion attempts, and requests designed to trigger unauthorized tool use. Guardrail performance must then be measured across releases so that changes to prompts, models, tools, or orchestration logic do not silently reduce protection.

Centralized logging and user feedback are useful detective and lifecycle controls, but neither prevents an unsafe action nor proves guardrail effectiveness. Periodically refreshing refusal wording is also insufficient unless the revised behavior is evaluated against defined safety criteria. The strongest design therefore combines deterministic authorization with adversarial regression testing.

Study Guide references/topics: Claude Code permissions and pre-tool enforcement; tool allow-list guidance; adversarial evaluations; regression testing; least-privilege orchestration.

===============

Option C addresses both components responsible for the excessive cost. Anthropic prompt caching allows stable, repeatedly submitted prompt material—such as system instructions, tool definitions, and reusable background information—to be placed in a consistent prefix. After that prefix is written to the cache, qualifying subsequent requests can reuse it at the lower cache-read cost instead of repeatedly processing the same content at the standard input-token rate.

Retrieval must be optimized separately. Supplying an entire document collection or excessively deep search results increases cost, consumes context capacity, and may reduce answer quality by surrounding the relevant evidence with distracting material. Retrieval should select the smallest set of authoritative passages that provides sufficient evidence for the current query. This typically requires relevance scoring, deduplication, metadata filtering, reranking, and explicit token-budget limits.

Increasing retrieval depth or expanding the repeated system prompt directly worsens the identified cost driver. Moving every request to a heavier model changes the unit economics but does not correct inefficient context construction. The recommended optimization therefore combines prefix caching with query-specific context pruning, followed by evaluation to confirm that reduced context does not lower task accuracy.

Study Guide references/topics: [Prompt caching](https://docs.anthropic.com/en/docs/build-with-claude/prompt-caching); [effective context engineering] (https://www.anthropic.com/engineering/effective-context-engineering-for-ai-agents); retrieval precision; token-cost analysis; cache-prefix stability.

===============

Architecture X fails a stated production gate: its 4.2-second average exceeds the required three-second response SLA. It should therefore not remain a qualifying architecture unless it is redesigned and retested before selection. A promise to optimize after deployment is not evidence of compliance.

Architecture Y meets the latency requirement at 2.1 seconds. Its annual inference cost is $180,000 at two million sessions, compared with $360,000 for Architecture X—a difference of $180,000 annually. However, cost alone does not establish suitability. The organization must determine whether Y’s lower quality score causes material omissions, correction effort, clinician dissatisfaction, documentation risk, or reduced workflow productivity.

Option C correctly treats the SLA as a threshold and then analyzes the remaining architecture across cost, efficiency, quality, and productivity. Option A ignores clinical quality. Option B disregards an explicit SLA failure. Option D may eventually be viable, but it introduces routing complexity and leaves unanswered how complex cases are detected, whether X’s latency becomes acceptable for them, and how both paths are evaluated.

The final choice should be gated by clinical-quality evaluation, human review requirements, safety metrics, operational latency, and total annual cost.

Study Guide references/topics: Business-value pillars; performance gates; solution cost; workflow efficiency; quality trade-offs; healthcare architecture evaluation.

===============

Category 1 tools are necessary for the agent to complete its approved responsibilities and must remain. Category 2 tools are also justified when they are regularly used and eliminate predictable hand-offs without expanding the agent beyond its defined operating role.

Categories 3 and 4 create capability bloat. A tool that is occasionally useful only for unrelated work does not belong to this agent’s responsibility boundary. A speculative tool has no validated requirement and adds attack surface, context consumption, authorization complexity, evaluation burden, and operational dependencies without demonstrated value.

Tool inclusion should be based on task traceability: every configured capability should map to a documented user journey, responsibility, permission scope, and evaluation case. Anthropic recommends least privilege so that a successful injection or model error can cause minimal damage. Mitigate Jailbreaks and Prompt Injections

The architect should periodically review tool-call telemetry and remove unused capabilities. New tools can be added when a validated workflow requires them, after security review and evaluation. The objective is not the smallest possible catalog regardless of usefulness; it is the smallest catalog that reliably completes the agent’s approved tasks.

Study Guide references/topics: Capability-bloat analysis; tool necessity; hand-off reduction; least privilege; attack-surface management; tool lifecycle review.

===============

A minimal reproduction and MCP status inspection are foundational diagnostic actions because they produce direct, interpretable evidence. A minimal reproduction removes unrelated prompts, tools, settings, hooks, and repository state while changing one variable at a time. This determines whether the failure follows a particular configuration, server, command, model request, or project artifact. It also creates a reproducible evidence package if escalation later becomes necessary.

MCP inspection addresses a common Claude Code failure domain. `claude mcp list` displays configured servers and their health states, including connected, authentication-required, pending-approval, and failed-to-connect conditions. `claude mcp get < name > ` provides server-specific details, while `/mcp` exposes status within an interactive session. These checks distinguish model behavior from transport, authentication, configuration, and workspace-trust failures.

Increasing temperature reduces repeatability and introduces additional variation, making root-cause isolation more difficult. Filing a support ticket before collecting local evidence reverses the appropriate diagnostic sequence. An immediate rollback may eventually be used as a controlled version comparison, but it changes the environment before a baseline has been captured and is therefore not a primary toolkit action.

Study Guide references/topics: [Managing and diagnosing MCP servers](https://docs.anthropic.com/en/docs/claude-code/mcp); minimal reproducible cases; controlled-variable troubleshooting; authentication and connection-state diagnostics.

===============

Self-declared administrative authority inside a prompt is untrusted data, not authenticated identity or authorization evidence. Option B correctly combines independent controls across the model, runtime, authorization, and monitoring layers.

Prompt instructions establish that user content cannot override system policy. Runtime classifiers detect known and generalized attempts to bypass controls. Tool permissions are enforced outside the model and must derive from authenticated identity, role, and approved scope—not statements contained in the conversation. Audit logging records the actor, attempted override, classifier result, tool requests, and final disposition for investigation and control improvement.

Anthropic recommends input screening, hardened system prompts, safe handling of untrusted content, narrowly scoped permissions, red-team testing, and continuous monitoring. Mitigate Jailbreaks and Prompt Injections

Option A depends entirely on model behavior and provides no containment if the model fails. Option C removes the protections the attacker is attempting to defeat. Option D commits a fundamental authorization error by accepting an unverified claim as privilege elevation.

The strongest design also rate-limits repeated attempts, escalates suspicious activity, validates outputs, and requires human confirmation for consequential actions.

Study Guide references/topics: Direct prompt injection; untrusted user content; runtime classifiers; non-model authorization; scoped tools; audit logging; defense in depth.

Alignment is an ongoing governance process rather than a one-time approval. Option D creates a predictable cadence for reassessing objectives, constraints, assumptions, risks, service levels, and success measures as business and technical conditions change. Option E requires disagreements to be surfaced and reconciled explicitly, preserving decision traceability and preventing unresolved conflicts from reappearing during implementation or operation. The routine should document decisions, owners, accepted trade-offs, action items, and conditions that trigger reconsideration. Recording meetings may improve accessibility but does not itself produce alignment. Rotating facilitation is optional and may weaken accountability. Automatically escalating every disagreement to an executive sponsor bypasses normal architectural negotiation and should be reserved for material deadlocks.

Study Guide references/topics: Stakeholder alignment; feedback cadence; assumption management; conflict reconciliation; decision records; lifecycle governance.

Drafting first-pass investigative reports from semi-structured incident logs for analyst review — Yes

Computing real-time fraud scores at sub-50-millisecond latency on a streaming pipeline — No

Long-context contract review with structured clause extraction and deviation flagging — Yes

Replacing a vector index for semantic retrieval over a multi-million-document corpus — No

Routing inbound support tickets into 30 categories with reasoning for the selected route — Yes

Claude is well suited to language-intensive analysis, summarization, extraction, classification, and drafting. Investigative-report drafting, contract analysis, and support-ticket routing all require interpretation of unstructured or semi-structured language and can incorporate human review. A sub-50-millisecond fraud-scoring path requires deterministic, specialized real-time processing and should not place LLM inference on the critical path. Claude also does not replace the retrieval index used to search millions of documents; it consumes the results produced by that infrastructure. The correct architectural decision separates tasks requiring semantic language reasoning from deterministic computation and information-retrieval infrastructure. Model selection and evaluation must then confirm that the chosen Claude model satisfies quality, latency, and cost requirements.

Option B is the only configuration establishing the contractual, data-handling, and audit foundations needed for a HIPAA-eligible deployment. Anthropic requires an eligible commercial organization to activate the HIPAA-ready configuration and accept a Business Associate Agreement. A standard Enterprise subscription is not automatically covered merely because it is an enterprise product. Anthropic BAA Guidance

Zero Data Retention may be required for particular covered services, including eligible Claude Code configurations, and is enabled per organization for qualified accounts. Audit logging supports access review, configuration monitoring, incident investigation, and compliance evidence. Anthropic provides audit logs for Enterprise organizations. Claude Code Legal and Compliance, Access Audit Logs

Options A and D use consumer or personal accounts without the required contractual framework. Option C incorrectly treats the elimination of audit evidence as a substitute for a BAA and compliant configuration.

The signed BAA remains the authoritative source for covered products and features. The customer must also configure access control, minimum-necessary data use, workforce policies, retention, integrations, incident response, and vendor-risk controls. The configuration supports compliance; it does not independently guarantee it.

Study Guide references/topics: HIPAA readiness; BAA; ZDR; PHI handling; audit logging; eligible services; shared compliance responsibility.

===============

Executive sponsors generally need architecture decisions translated into business significance. The briefing should explain what outcomes the retrieval architecture enables, why the chosen approach is valuable, which material trade-offs were accepted, and what major risks require awareness or sponsorship. This allows the executive to assess strategic alignment, investment value, and organizational exposure without becoming immersed in component-level implementation details. Option A is more appropriate for architects and engineering teams conducting a technical review. Option C is primarily suited to product and program stakeholders managing features, scope, and roadmap dependencies. Option D is designed for security, compliance, and risk-governance audiences requiring detailed control evidence. Although those perspectives remain important, option B provides the concise, outcome-oriented framing needed for an executive architectural decision summary.

================

The scenario describes indirect prompt injection: malicious instructions are embedded in third-party content that Claude processes as retrieved evidence. Option A addresses the threat at the appropriate boundary by classifying retrieved material as untrusted, screening it before use, and validating the model’s output before it can influence downstream actions.

Anthropic recommends placing untrusted third-party content in clearly identified tool-result structures, explicitly instructing Claude that retrieved content cannot override system or user instructions, screening tool output for injection attempts, and applying output validation. Mitigate Jailbreaks and Prompt Injections

Citations in Option B improve factual traceability but do not prevent embedded instructions from attempting to redirect model behavior. An outbound destination allow-list in Option C limits the damage that a compromised agent can cause through tool calls, but it does not directly detect or neutralize the injected content. Option D is valuable for detecting behavioral regression after a model change, not for controlling a specific malicious document during runtime.

A production implementation should combine content provenance, structural separation, injection screening, least-privilege tools, output-schema validation, and human confirmation for consequential actions.

Study Guide references/topics: Indirect prompt injection; untrusted retrieved content; input classification; output validation; layered runtime guardrails.

===============

Managed configuration is designed for organization-wide security and compliance controls that individual users and repositories must not override. Applying the hardening flag centrally establishes an administrative policy boundary and prevents engineers from disabling the control through user, project, or local settings.

Anthropic identifies managed scope as the appropriate location for security policies, non-overridable compliance requirements, and standardized configurations deployed by IT or DevOps. Managed values ordinarily take precedence over command-line arguments and every user-controlled settings scope. Claude Code Settings

Option A depends on every engineer maintaining the setting and allows the user to edit or delete it. Option B affects only pipeline execution and does not protect local, interactive, IDE, or other execution paths. Option D standardizes the setting within the repository but does not make it tamper-resistant; contributors with repository write access could alter the file, use higher-precedence local settings where permitted, or operate outside the repository configuration.

The implementation should also verify active policy delivery, monitor configuration-change events, and test that startup or execution fails safely if the managed setting is absent or invalid. Central definition without enforcement and verification would not fully satisfy the requirement.

Study Guide references/topics: Managed settings; non-overridable controls; enterprise hardening; policy enforcement; configuration governance; defense against local override.

===============

Per-user, scope-restricted OAuth tokens directly eliminate the shared-credential weakness. Each token represents a distinct user or delegated identity, carries only the permissions required for that user’s role, and can be revoked independently. This supports least privilege, limits the blast radius of credential compromise, and enables authorization decisions to be tied to a specific principal instead of an undifferentiated shared API key.

Actor attribution in tool-call logs directly resolves the second finding. Each audit event should record the authenticated user, delegated service identity, session or request identifier, tool name, authorization decision, relevant resource, timestamp, and outcome. This establishes accountability and permits incident investigators to reconstruct who initiated a consequential action.

Moving credentials into a server-side secret store is sound secret-management practice, but it does not by itself correct the shared-identity problem: a centrally stored key can still represent every user as the same principal. Schema validation protects downstream processing, while retrieval-layer RBAC protects information access; neither addresses the two specific audit findings.

These controls should be reinforced by short-lived tokens, server-side authorization enforcement, sensitive-field redaction, and tamper-resistant audit-log retention.

Study Guide references/topics: [Claude Code security](https://docs.anthropic.com/en/docs/claude-code/security); [MCP authentication and OAuth] (https://docs.anthropic.com/en/docs/claude-code/mcp); least privilege; identity propagation; auditable tool execution.

===============

Option A augments the existing review process without transferring final accountability to the model. Claude Code can inspect the change in repository context, identify logic defects, security weaknesses, regressions, and maintainability concerns, and publish structured findings for human evaluation. Existing branch protection then preserves required approvals and separation of duties. Automatic merging or disabling protection rules would convert an advisory capability into an uncontrolled authorization mechanism. Silent deletion would eliminate transparency and prevent authors from challenging or correcting the assessment. Anthropic’s Code Review documentation states that findings are posted as comments and do not approve or block the pull request, leaving the established review workflow intact. Claude Code Review

Instrumentation must be driven by an explicit measurement specification. The team must first define the metrics and evaluation slices required to detect performance, cost, quality, safety, or reliability failures. Slices should include representative traffic, adversarial inputs, user segments, tools, and relevant content categories. SLOs and error budgets must also be established before instrumentation because they determine required measurements, aggregation windows, and acceptable failure levels. Alert thresholds cannot be tuned until normal-state data has been collected. Dashboards and on-call documentation depend on the final metric definitions and observed operational behavior. Anthropic supports metrics, event, and trace export through OpenTelemetry, but telemetry is useful only when tied to measurable success and operating objectives. Claude Code monitoring

Claude Code constructs the model context before the first user message. That initial context can include the system prompt, project instructions, subagent configuration, MCP server instructions, and tool definitions expressed as JSON schemas. When numerous MCP servers expose many tools and Tool Search is disabled, those schemas must be loaded upfront. A large collection of verbose tool descriptions and parameter schemas can therefore consume tens of thousands of tokens before the engineer enters any text.

Tool Search is specifically designed to prevent this form of context inflation. With Tool Search enabled, Claude initially receives only server instructions and compact tool-identification information; full tool schemas are deferred until a relevant tool is discovered and required. Anthropic consequently describes Tool Search as the mechanism for keeping MCP context consumption low as integrations scale.

Keyboard layouts, font rendering, and display scaling operate outside the language-model context and cannot generate API input tokens. Likewise, model behavior does not silently reserve 50,000 tokens for personal preferences. The diagnostic action is to inspect configured MCP servers and tool counts, determine whether Tool Search has been disabled, and remove or defer unnecessary definitions.

Study Guide references/topics: [MCP Tool Search and context scaling](https://docs.anthropic.com/en/docs/claude-code/mcp); MCP server configuration; subagent context budgeting; tool-schema optimization.

===============

The assistant is making recommendations without considering information that specialists regard as material. That is a direct input-scope and requirements gap, not merely a presentation issue. The 89 percent acceptance metric is also incomplete because initial acceptance does not reveal whether recommendations remain correct after users apply the omitted criteria. Production readiness requires outcome-focused evaluation, including final recommendation agreement, override reasons, financial impact, supplier risk, and performance across representative procurement scenarios. Options B and E raise possible concerns, but the scenario supplies no evidence that response rate or pilot duration is the demonstrated deficiency. Option A incorrectly treats a single proxy metric as sufficient. Anthropic recommends multidimensional, task-specific success criteria aligned with the actual user outcome. Define success criteria and evaluations

Regulatory assessment must begin by establishing scope. Option B determines whether the regulation applies by examining processed data, affected jurisdictions, users, and deployment purpose. Without this analysis, clause mapping could apply irrelevant obligations or omit applicable ones. Option E establishes the platform’s existing compliance capabilities, including audit records, retention controls, access governance, data residency, and compliance-export functionality. Anthropic’s Trust Center provides control and certification information, while the Compliance API supports programmatic access to activity and governance records. Options A and D occur after regulatory clauses have been mapped and gaps identified. Option C follows prioritization and approval of remediation actions.

Study Guide references/topics: Regulatory applicability; compliance affordance inventory; control mapping; gap assessment; residual risk; remediation sequencing.

A single confirmed fabrication requires investigation, but it does not establish the population-level failure rate. Sampling recent summaries determines prevalence, affected content types, and whether the incident correlates with particular prompts, documents, or model versions. The architecture must also be examined for grounding controls, including source-constrained generation, citation rendering, claim-to-source verification, and rejection of unsupported statements. Anthropic recommends making factual outputs auditable through citations and requiring supporting quotations for important claims. Immediate universal shutdown may become necessary if the risk is severe, but doing so before establishing scope is not the most disciplined first response. Options D and E dismiss evidence without validation and would prevent corrective action. Reducing hallucinations

Expectation alignment begins with measured evidence. Option A gives stakeholders the median experience through p50 latency and the slower-tail experience through p95, then compares both with the agreed SLA. The measurements should reflect representative input sizes, concurrency, retrieval activity, tool calls, geographic routing, and cache conditions.

If the target remains infeasible after reasonable optimization, Option E establishes the correct governance response. The architect should collaboratively revise the SLA, scope, cost envelope, model choice, or user-experience design rather than silently accepting a breach or making unilateral changes. Any revision should document the business impact and accepted trade-offs.

Option B commits all resources before the problem’s severity, causes, and business priority have been established. Option C wrongly treats latency as uncontrollable; model selection, prompt length, retrieval depth, caching, streaming, and architecture can materially affect it. Option D introduces an unvalidated provider and could create quality, security, compliance, and integration regressions.

Expectation management is not merely communicating bad news. It requires transparent measurements, credible optimization options, explicit trade-offs, and jointly approved commitments that the production architecture can actually satisfy.

Study Guide references/topics: SLA alignment; p50 and p95 latency; stakeholder negotiation; evidence-based communication; architectural trade-offs; production constraints.

===============

Option C introduces a deterministic validation boundary between probabilistic model output and downstream execution. Structured validation can reject missing fields, invalid types, unauthorized actions, malformed arguments, and values outside approved enumerations before any tool or business process acts on the response. Anthropic recommends Structured Outputs when guaranteed schema conformance is required. Increase Output Consistency

Option D implements defense in depth. Prompt-level instructions establish intended behavior, while runtime classifiers, content filters, policy engines, output validators, tool permissions, and human confirmation gates provide controls outside the model. Anthropic’s guardrail guidance recommends combining safeguards rather than depending on one mechanism. Mitigate Jailbreaks and Prompt Injections

Option A creates a bypass mechanism that adversaries may discover or imitate. Option B may alter output variability but is not a security boundary and cannot guarantee policy compliance. Option E places complete reliance on a system prompt, which remains vulnerable to ambiguity, conflicting inputs, model errors, and indirect prompt injection.

Guardrails should be risk-based, independently enforceable where possible, observable, tested against adversarial cases, and proportional to the consequences of downstream actions.

Study Guide references/topics: Layered guardrails; structured validation; runtime content checks; prompt injection; deterministic enforcement; defense in depth.

===============

The retrieval pipeline is stated to be unchanged, so the first investigation should isolate changes in generation behavior and grounding instructions. Replaying the failing cases on the previous model version determines whether the regression follows the model upgrade or current model-prompt combination. Inspecting the system prompt establishes whether source-use rules, uncertainty behavior, citation requirements, or prohibitions against unsupported claims were removed or weakened. Increasing context or replacing the embedding model changes a component for which no failure evidence exists and may introduce additional noise. Lowering temperature may reduce variation but does not explain systematic contradiction of retrieved evidence. The investigation should compare identical requests, retrieved passages, prompts, and model versions before applying a fix. Define success criteria and evaluations

A direct call to the existing stable HTTP endpoint is the simplest mechanism that satisfies the stated requirements. The interaction is stateless, requires only one tool invocation, and has a strict latency objective. Adding session management, message-bus translation, or another model-mediated agent would introduce unnecessary network hops, operational dependencies, failure modes, and processing latency.

The assistant’s tool implementation should validate input parameters, authenticate through a server-side credential mechanism, apply narrowly scoped authorization, set explicit timeouts, and validate the pricing response before returning it to Claude. Credentials must never be supplied by or exposed to the model. Appropriate logging should capture request attribution, endpoint outcome, and timing without unnecessarily recording sensitive data.

Anthropic describes the Claude API as a RESTful interface and supports custom tools in which the application executes the requested function or API operation. Claude API Overview, Tool Use Overview

MCP could be justified when standardized discovery or reuse across clients is required, but the scenario already supplies a stable API and does not establish that additional requirement.

Study Guide references/topics: Protocol selection; direct API integration; stateless calls; latency minimization; scoped credentials; avoiding unnecessary agentic complexity.

===============

Yes, Yes, Yes, No, No

Dense vector retrieval represents semantic similarity, making it suitable for matching paraphrases and conceptually related language even when the query and source do not share identical words. Sparse lexical retrieval, including BM25-style matching, retains strong sensitivity to exact tokens and is therefore valuable for identifiers, product codes, technical names, and uncommon terminology.

Structured query retrieval is appropriate when the required operation depends on explicit fields, predicates, joins, counts, grouping, or aggregation over a relational schema. In that situation, generating or invoking a constrained database query is more precise than approximating the operation through semantic similarity.

Hybrid retrieval is not identical to dense retrieval. It combines semantic and lexical candidate sets, typically followed by rank fusion or reranking. Anthropic’s contextual-retrieval guidance explains that semantic search captures meaning and paraphrases, while BM25 captures exact terminology; combining them improves coverage. Contextual Retrieval, Contextual Retrieval Cookbook

Random sampling is not a relevance strategy. It provides no systematic relationship between the query and selected evidence, producing unstable coverage and preventable hallucination risk. Production Q & A requires deterministic or evaluated relevance mechanisms, access filters, suitable indexes, and measurable retrieval metrics such as recall at k.

Study Guide references/topics: Dense retrieval; sparse retrieval; structured queries; hybrid search; rank fusion; retrieval evaluation; production RAG design.

===============

Option C provides the minimum coherent package required to move from architectural intent to implementable and supportable delivery. The architecture overview establishes system boundaries and component relationships. Architecture Decision Records preserve the context and trade-offs behind key choices. Component contracts define interfaces, schemas, responsibilities, failure behavior, and integration assumptions.

The evaluation framework and reference set allow the implementation team to confirm that prompts, models, retrieval components, and tool integrations continue to meet the defined quality, safety, latency, and cost thresholds. Runbooks translate operational knowledge into repeatable procedures, while the on-call playbook defines detection, escalation, containment, and recovery actions. The known-limitations register prevents unsupported behavior from being mistaken for an implementation defect and helps stakeholders manage residual risk.

Options A and B depend excessively on slides or undocumented verbal knowledge. Option D provides implementation material without explaining the system-level decisions, operating model, acceptance criteria, or limitations. Source code cannot substitute for architectural and operational documentation.

A clean transition does not mean the architect can never be consulted. It means routine implementation and support do not depend on undocumented knowledge held by a single individual.

Study Guide references/topics: Design-to-implementation handoff; ADRs; component contracts; reference evaluations; runbooks; operational playbooks; limitations management.

===============

The request is not yet design-ready because it lacks a defined failure, affected user journey, supported decision, target population, and measurable outcome. The architect should therefore facilitate structured discovery rather than prematurely selecting an AI pattern or model.

Discovery should identify where the current customer journey breaks down, who experiences the problem, what decision or task requires assistance, what data is available, and which metric would demonstrate improvement. The team can then establish baseline performance, target thresholds, operational constraints, risks, and explicit non-goals. Anthropic’s evaluation guidance states that an LLM application should begin with clearly defined success criteria and a method for measuring them. Define Success Criteria and Build Evaluations

Option A abandons the sponsor instead of helping translate a business concern into an actionable problem. Option B risks producing a generic demonstration unrelated to a validated customer need. Option C substitutes the architect’s assumptions for stakeholder evidence and may commit the organization to the wrong scope.

Competent delegation begins by defining the decision, intended outcome, authority boundaries, and target metric before determining which responsibilities should be assigned to Claude, conventional software, or human reviewers.

Study Guide references/topics: Structured discovery; delegation competency; problem definition; target metrics; decision support; measurable business outcomes.

===============

The strongest investigation combines configuration comparison with controlled replay. Comparing the current system prompt and output-schema settings against the last known good version identifies maintenance-related configuration drift. Relevant differences include removed formatting instructions, altered schema requirements, incompatible parser expectations, changed stop sequences, or a disabled structured-output mechanism.

Replaying known premaintenance requests against the current configuration creates a controlled test set. Inspecting the raw response before parsing then establishes whether malformed JSON originates in model generation or is introduced by streaming assembly, transport handling, post-processing, or the downstream parser. If the raw response is valid but the pipeline rejects it, the fault lies after generation. If the raw response is malformed, the prompt, schema enforcement, stop reason, and request configuration become the primary investigation targets.

Clearing the prompt cache assumes cache corruption without evidence. Changing model tiers introduces another variable and weakens causal attribution. Raising `max_tokens` is appropriate only when raw responses show truncation and the returned stop reason indicates the token limit was reached; it is not the most direct initial test.

Study Guide references/topics: [Increasing output consistency](https://docs.anthropic.com/en/docs/test-and-evaluate/strengthen-guardrails/increase-consistency); [agent evaluation methodology] (https://www.anthropic.com/engineering/demystifying-evals-for-ai-agents); regression replay; last-known-good comparison; raw-output inspection.

===============