Pass the Anthropic Claude Certified Architect CCAR-P Questions and answers with ExamsMirror

Yes, No, Yes, No, Yes

Least privilege requires each retained tool to be necessary for the agent’s assigned responsibility and restricted to the minimum action level needed. Catalog lookup is appropriate because vendor and SKU information is needed to prepare an accurate request. The policy-document tool is similarly justified because the agent must ground the draft in applicable procurement rules. The draft-write tool is also aligned because it writes only to a review queue, preserving the required human approval boundary.

The inbox-send tool exceeds the stated responsibility. Sending a request directly to a vendor converts a drafting assistant into an externally acting purchasing agent and bypasses the review stage. The production-database administrator tool is unrelated to procurement and introduces unnecessary destructive capability, privilege-escalation exposure, and potential data-access risk.

Anthropic’s prompt-injection guidance recommends limiting access to sensitive data and actions and applying least privilege so that a compromised agent can cause minimal damage. Claude Code also supports tool-specific allow, ask, and deny rules that are enforced outside the model. Prompt-Injection Mitigation , Claude Code Permissions

Study Guide references/topics: Capability-bloat auditing; least privilege; tool scoping; human review gates; separation of drafting and execution authority.

===============

The interaction model and portability requirement are architectural decision drivers. MCP is appropriate when tools or data sources must be exposed through a standardized interface reusable across compatible AI clients. Direct API integration is often preferable for a narrow, stateless, latency-sensitive call where the application already owns the integration logic. Agent-to-agent handoff is better suited to stateful or longer-running delegation between independently responsible agents. Documentation quality and team familiarity influence implementation effort but do not determine the correct integration pattern. Encryption in transit is a mandatory security property for production integration rather than a differentiating architectural requirement; each viable approach must provide it. Anthropic distinguishes direct Messages access from stateful managed-agent infrastructure, while MCP supplies a standardized tool integration layer. Claude Platform documentation

Progressive tool discovery preserves the complete capability catalog while limiting initial context to a curated set of common tools and a discovery mechanism. When the task requires an additional capability, Claude searches the catalog and loads only the relevant tool definitions.

Anthropic’s Tool Search mechanism implements this pattern through deferred loading. The context initially contains the search tool and any deliberately non-deferred tools; relevant definitions are expanded only when discovered. This reduces token consumption and helps maintain tool-selection accuracy in large catalogs. Tool Search Tool

Option B adds a model call and still repeatedly processes all definitions, increasing latency and cost while potentially losing important schema details. Option C treats a larger context window as permission to waste context and does not address time-to-first-response overhead. Option D reduces capability breadth because the fixed five tools may be irrelevant to a given task.

The architect should provide clear tool and server descriptions, define which high-frequency tools remain immediately available, and evaluate discovery recall, selection accuracy, latency, and context savings across representative workflows.

Study Guide references/topics: Progressive discovery; deferred tool loading; MCP scaling; context optimization; tool-selection accuracy; on-demand capability loading.

===============

An ethics review must examine unsupported generalizations, stereotyping, disparate treatment, and other conclusions about people that are not justified by the evidence. It must also preserve identifiable human accountability for consequential decisions; responsibility cannot be transferred to a probabilistic system. Licensing is a legal and commercial-control question, while latency and throughput are operational requirements. Both remain important, but neither is the central ethical test presented here. Restricting review to low-confidence or threshold-triggering outputs is also inadequate because models can express harmful or biased conclusions with high confidence. Ethical review should cover representative populations, protected and intersectional groups, high-impact outcomes, override mechanisms, transparency, and channels for challenge or appeal.

Study Guide references/topics: Bias and unsupported generalization; human accountability; consequential decisions; ethical oversight.

The required control is best implemented through layered prevention. The system prompt should explicitly classify personalized investment recommendations as out of scope, instruct Claude not to recommend particular securities or transactions, and provide standardized refusal language. Fixed refusal behavior reduces ambiguity and gives the model a clear alternative response when users request prohibited advice or attempt to reframe it indirectly.

An output classifier supplies an independent enforcement layer after generation but before delivery. It should detect prohibited recommendation language, individualized buy-or-sell instructions, portfolio allocations, and equivalent regulated content. A detected violation must block or replace the response rather than merely record it. This protects against prompt circumvention, unexpected phrasing, and occasional model noncompliance.

Increasing temperature makes responses less predictable and weakens control reliability. Session-length limits regulate volume, not content. SIEM logging is valuable for monitoring, investigation, and compliance evidence, but it is detective rather than preventative: the prohibited recommendation may already have reached the customer.

The completed design should evaluate both layers using adversarial prompts, paraphrases, multi-turn escalation, and classifier false-negative testing.

Study Guide references/topics: [Mitigating jailbreaks and prompt injections](https://docs.anthropic.com/en/docs/test-and-evaluate/strengthen-guardrails/mitigate-jailbreaks); layered guardrails; explicit scope boundaries; standardized refusals; output classification; pre-delivery enforcement.

===============

Over-refusal and hallucination are characteristic model-behavior risks. An overly broad safety response can reject a legitimate request even when the surrounding application operates correctly. A plausible but unsupported answer is a groundedness failure arising from probabilistic generation and inadequate source adherence. These risks require model-specific evaluations, grounding instructions, citations, verification, and calibrated fallback behavior. Expired certificates, database timeouts, and load-balancer misconfiguration are conventional distributed-system failures that should be addressed through infrastructure monitoring, retries, health checks, and configuration management. Distinguishing these categories matters because ordinary software remediation will not resolve behavioral failures, while prompt changes will not repair infrastructure. Anthropic’s hallucination guidance recommends auditable citations and supporting evidence for generated claims. Reducing hallucinations

Haiku is the appropriate starting point because the workload is high-volume, latency-sensitive, and based on a stable closed set of moderation labels. These characteristics favor a fast, cost-efficient model capable of consistent classification without incurring the additional inference time and expense associated with deeper reasoning.

Anthropic’s model-selection guidance requires architects to balance capability, speed, and cost rather than automatically selecting the most capable model. Its content-moderation guidance specifically identifies Haiku as a cost-effective option for processing moderation workloads at substantial scale. Choosing the Right Model , Content Moderation

Opus is disproportionate to a routine closed-set classification problem. Sonnet may become justified if evaluation demonstrates that Haiku fails materially on complex policy distinctions, multilingual ambiguity, or adversarial edge cases, but it should not be selected merely because it is larger. Enabling extended thinking on every request would further increase latency and token consumption without evidence that the additional reasoning improves the defined success metrics. The correct architectural practice is to establish a representative moderation evaluation set, validate Haiku against accuracy and safety thresholds, and escalate only the cases that genuinely need deeper reasoning.

Study Guide references/topics: Model selection; capability–latency–cost trade-offs; classification workloads; evaluation-driven routing; moderation architecture.

===============

Option C addresses both components responsible for the excessive cost. Anthropic prompt caching allows stable, repeatedly submitted prompt material—such as system instructions, tool definitions, and reusable background information—to be placed in a consistent prefix. After that prefix is written to the cache, qualifying subsequent requests can reuse it at the lower cache-read cost instead of repeatedly processing the same content at the standard input-token rate.

Retrieval must be optimized separately. Supplying an entire document collection or excessively deep search results increases cost, consumes context capacity, and may reduce answer quality by surrounding the relevant evidence with distracting material. Retrieval should select the smallest set of authoritative passages that provides sufficient evidence for the current query. This typically requires relevance scoring, deduplication, metadata filtering, reranking, and explicit token-budget limits.

Increasing retrieval depth or expanding the repeated system prompt directly worsens the identified cost driver. Moving every request to a heavier model changes the unit economics but does not correct inefficient context construction. The recommended optimization therefore combines prefix caching with query-specific context pruning, followed by evaluation to confirm that reduced context does not lower task accuracy.

Study Guide references/topics: [Prompt caching](https://docs.anthropic.com/en/docs/build-with-claude/prompt-caching); [effective context engineering] (https://www.anthropic.com/engineering/effective-context-engineering-for-ai-agents); retrieval precision; token-cost analysis; cache-prefix stability.

===============

The first diagnostic action must establish whether Claude Code has loaded the MCP server configuration and whether it can connect to the registered endpoint. The official management command is claude mcp list; within Claude Code, /mcp can also be used to inspect server status. The listing distinguishes registered and connected servers from configurations that require authentication, approval, or connection troubleshooting. Connect Claude Code to Tools via MCP

If the server was added or its configuration changed after the current session began, reconnecting or restarting the relevant Claude Code session is a proportionate next step. This ensures that configuration state and available tool definitions are refreshed before more intrusive troubleshooting begins. If the server is listed but unhealthy, the engineer can then inspect it with claude mcp get < name > and investigate transport, command path, credentials, workspace approval, or endpoint connectivity.

Options A, B, and D are operationally unsound because they discard working capabilities or environments before confirming the basic registration state. Disabling all MCP servers eliminates useful diagnostic comparisons; changing product families abandons the relevant configuration; reinstalling the operating system is grossly disproportionate and risks destroying evidence needed for diagnosis.

Study Guide references/topics: Claude Code environment configuration; MCP registration; server-status inspection; session refresh; targeted operational troubleshooting.

===============

Managed configuration is designed for organization-wide security and compliance controls that individual users and repositories must not override. Applying the hardening flag centrally establishes an administrative policy boundary and prevents engineers from disabling the control through user, project, or local settings.

Anthropic identifies managed scope as the appropriate location for security policies, non-overridable compliance requirements, and standardized configurations deployed by IT or DevOps. Managed values ordinarily take precedence over command-line arguments and every user-controlled settings scope. Claude Code Settings

Option A depends on every engineer maintaining the setting and allows the user to edit or delete it. Option B affects only pipeline execution and does not protect local, interactive, IDE, or other execution paths. Option D standardizes the setting within the repository but does not make it tamper-resistant; contributors with repository write access could alter the file, use higher-precedence local settings where permitted, or operate outside the repository configuration.

The implementation should also verify active policy delivery, monitor configuration-change events, and test that startup or execution fails safely if the managed setting is absent or invalid. Central definition without enforcement and verification would not fully satisfy the requirement.

Study Guide references/topics: Managed settings; non-overridable controls; enterprise hardening; policy enforcement; configuration governance; defense against local override.

===============