Question 1

A business sponsor has requested an AI solution to ''improve customer experience.'' The sponsor cannot articulate which customer journey is failing, which metric reflects the failure, or which decisions the AI should support. The sponsor is asking you to begin design work next week.

Which delegation-competency action should you take first?

ARecommend that the sponsor revise the request and resubmit it later for evaluation.

BBegin prototyping a generic assistant against the broad request before the next deadline.

CPropose a fixed scope that you commit to by default based on your own assumptions.

DFacilitate a structured discovery to define the failing decision and the target metric.

Answer : D

The request is not yet design-ready because it lacks a defined failure, affected user journey, supported decision, target population, and measurable outcome. The architect should therefore facilitate structured discovery rather than prematurely selecting an AI pattern or model.

Discovery should identify where the current customer journey breaks down, who experiences the problem, what decision or task requires assistance, what data is available, and which metric would demonstrate improvement. The team can then establish baseline performance, target thresholds, operational constraints, risks, and explicit non-goals. Anthropic's evaluation guidance states that an LLM application should begin with clearly defined success criteria and a method for measuring them. Define Success Criteria and Build Evaluations

Option A abandons the sponsor instead of helping translate a business concern into an actionable problem. Option B risks producing a generic demonstration unrelated to a validated customer need. Option C substitutes the architect's assumptions for stakeholder evidence and may commit the organization to the wrong scope.

Competent delegation begins by defining the decision, intended outcome, authority boundaries, and target metric before determining which responsibilities should be assigned to Claude, conventional software, or human reviewers.

Study Guide references/topics: Structured discovery; delegation competency; problem definition; target metrics; decision support; measurable business outcomes.

===============

Question 2

An engineering organization is adopting Claude Code across 200 developers. A team lead proposes that AI-generated pull requests bypass standard code review for changes under 50 lines because small changes are considered low risk and review capacity is constrained.

Which two Diligence-competency objections should you raise? (Select two.)

Each correct answer presents part of the solution.

ARemoving review eliminates the verification mechanism required for AI-generated output across the workflow.

BCode-review capacity should be expanded to handle every code change submitted across the team.

CThe threshold should be increased to 200 lines to capture more changes.

DAI-generated pull requests should be rejected by default across the organization.

ELine count is a poor proxy for the actual risk introduced by a code change.

Answer : A, E

AI-generated code requires verification through the same controlled engineering workflow as human-authored changes. Removing review eliminates the gate that can detect incorrect assumptions, security defects, missing tests, and unintended behavior. Line count is not a defensible risk measure: a one-line authorization change, dependency alteration, or command-execution defect can be more consequential than a large documentation update. Review requirements should instead be determined by affected components, privilege, data sensitivity, reversibility, test coverage, and deployment impact. Expanding capacity may be operationally useful but is not the central diligence objection. Raising the threshold retains the same flawed proxy, while rejecting all AI-generated changes discards legitimate productivity benefits. Anthropic states that users remain responsible for reviewing proposed code and commands. Claude Code security

Question 3

You are compiling guardrail tactics for a customer-facing assistant.

Which two tactics belong on the guardrail list?

Each correct answer presents a complete solution.

AEmbed approved override phrases that let trusted users relax guardrails on demand.

BLower sampling temperature globally to reduce the chance of off-policy completions.

CValidate the model output against a structured schema before downstream actions are taken.

DLayer prompt-level guardrails with runtime content checks rather than relying on either alone.

ERely on a single hardened system prompt that enumerates every disallowed behavior.

Answer : C, D

Option C introduces a deterministic validation boundary between probabilistic model output and downstream execution. Structured validation can reject missing fields, invalid types, unauthorized actions, malformed arguments, and values outside approved enumerations before any tool or business process acts on the response. Anthropic recommends Structured Outputs when guaranteed schema conformance is required. Increase Output Consistency

Option D implements defense in depth. Prompt-level instructions establish intended behavior, while runtime classifiers, content filters, policy engines, output validators, tool permissions, and human confirmation gates provide controls outside the model. Anthropic's guardrail guidance recommends combining safeguards rather than depending on one mechanism. Mitigate Jailbreaks and Prompt Injections

Option A creates a bypass mechanism that adversaries may discover or imitate. Option B may alter output variability but is not a security boundary and cannot guarantee policy compliance. Option E places complete reliance on a system prompt, which remains vulnerable to ambiguity, conflicting inputs, model errors, and indirect prompt injection.

Guardrails should be risk-based, independently enforceable where possible, observable, tested against adversarial cases, and proportional to the consequences of downstream actions.

Study Guide references/topics: Layered guardrails; structured validation; runtime content checks; prompt injection; deterministic enforcement; defense in depth.

===============

Question 4

You are responding to a stakeholder request that adds significant scope to a deployment already in flight.

Which response best aligns expectations while respecting the stakeholder's underlying need?

AHide the scope-addition request from the broader delivery team to avoid a difficult conversation, allowing the change to proceed without team awareness of its timeline implications.

BDecline the request outright without acknowledging the stakeholder's underlying need or offering alternatives such as deferral, descoping, or timeline extension.

CAcknowledge the request, describe the scope and timeline implications transparently, and propose options---defer it, descope something else, or extend the timeline---for the stakeholder to choose.

DAccept the additional scope into the current release without describing the timeline or descoping implications, allowing the delivery plan to absorb unacknowledged changes until they surface as delays.

Answer : C

Option C preserves both transparency and stakeholder agency. The architect acknowledges the underlying business need while making the delivery consequences explicit. Presenting controlled alternatives converts an unbounded request into a governed decision: defer the capability, exchange it for existing scope, or accept a later release date. The selected option should be documented with revised success criteria, dependencies, risk, cost, ownership, and approval. Concealing the request prevents accurate planning and creates unmanaged delivery risk. Rejecting it without exploring alternatives ignores legitimate stakeholder value. Quietly absorbing additional work produces scope creep and makes later delays appear unexpected. Effective lifecycle communication does not promise every requested capability; it presents the trade-offs necessary for an informed decision.

Study Guide references/topics: Scope governance; expectation alignment; transparent trade-offs; change control; stakeholder decision rights.

Question 5

You are explaining the precedence of Claude Code configuration scopes to the team.

Which precedence ordering, from highest to lowest, is correct?

ALocal managed user command-line arguments project

BProject user managed local command-line arguments

CManaged command-line arguments local project user

DUser project local command-line arguments managed

Answer : C

The correct general precedence is managed configuration, command-line arguments, local configuration, project configuration, and then user configuration.

Managed configuration has the highest authority because it contains centrally administered organizational and compliance controls that ordinary engineers must not be able to override. Command-line arguments provide temporary session-level overrides where the relevant setting permits them. Local settings apply to one user within a specific repository and take precedence over the shared project configuration. Project settings apply to every contributor using that repository and override general user preferences. User settings form the lowest tier because they provide personal defaults across projects and apply only when no higher-precedence source supplies a value.

Anthropic documents this order explicitly: managed, command line, local, project, and user. It also notes that permission rules may merge rather than behave as simple scalar overrides, and certain security-sensitive keys have specialized precedence behavior. Claude Code Configuration Scopes

The ordering allows personal customization without permitting it to defeat repository conventions or centrally mandated security requirements. Architects must still examine the merge behavior of the individual configuration property rather than assuming every array or permission rule is replaced wholesale.

Study Guide references/topics: Claude Code configuration; scope precedence; managed policies; local overrides; project settings; user defaults.

===============

Free Practice Questions for Anthropic CCAR-P Exam

Question 1

Question 2

Question 3

Question 4

Question 5