20 Governance, Safety & Stakeholders Practice Questions & Answers

1. 1. A tier-1 customer-support agent built on Claude is given four tools: knowledge-base search, create-ticket, issue-refund, and delete-customer-account. Reviewing the deployment, you confirm that tier-1 staff are never authorized to delete accounts. Which change BEST reduces risk?

   • A.Add a system-prompt instruction telling the model it must never delete an account
   • B.Keep the tool but require the model to state its reasoning before each delete
   • C.Remove the delete-customer-account tool from the agent's toolset for this role✓ Answer
   • D.Keep the tool but log every delete call and review the log weekly

   Least privilege is implemented by removing a capability the role does not need, which eliminates the attack surface entirely. Logging is a detective control that only tells you after the damage, a reasoning requirement is a compensating control, and a system-prompt instruction is model-level guidance that adversarial or malformed input can override, so none of them is a security boundary.

   Source: Anthropic Claude certification (Architect – Professional), Domain 5 obj. 1 (guardrails and safety controls) and Domain 3 (least privilege / capability bloat); control hierarchy: preventive > detective > compensatingReport a problem with this question

2. 2. An internal research agent summarizes web pages and customer-supplied attachments. During testing, a fetched page contains hidden text that reads like an instruction to the agent to send an internal file to an outside address. What is the MOST effective defense?

   • A.Append a system-prompt line telling the model to ignore any instructions found inside retrieved content
   • B.Switch to a model that follows the system prompt more reliably
   • C.Scan retrieved text for suspicious phrases such as 'ignore previous instructions' and strip them
   • D.Treat retrieved content as data by architecture: the agent has no outbound-send capability, and any send is performed by a separate path that requires human approval✓ Answer

   Indirect prompt injection is a boundary problem, not a wording problem: any content the model reads may contain adversarial instructions, so the only durable control is to ensure the model cannot reach a damaging capability in the first place. Prompt instructions, better instruction-following, and keyword filters can all be defeated by rephrasing or encoding, whereas removing the outbound capability and gating sends behind human approval holds regardless of what the injected text says.

   Source: Anthropic Claude certification (Architect – Professional), Domain 5 obj. 2 (failure modes: direct and indirect prompt injection; treat retrieved content and tool results as untrusted data, never as instructions)Report a problem with this question

3. 3. A document-drafting assistant produces roughly 50,000 outputs per month across many internal uses. Compliance proposes that a human approve every single output before it leaves the system. What is the BETTER oversight design?

   • A.Require human approval on every output, as proposed, so nothing is missed
   • B.Remove human review entirely and rely on output classifiers plus post-hoc logging
   • C.Let the model decide which of its own outputs need human review
   • D.Tier oversight by consequence: mandatory qualified review before dissemination for high-consequence outputs, sampled audit for high-volume low-risk paths, automatic release for reversible internal drafts✓ Answer

   Human-in-the-loop should be scoped to the blast radius of the decision: blanket approval on every output creates a bottleneck that reviewers rationalize away, degrading into rubber-stamping and weakening oversight exactly where it matters. Risk-tiered routing concentrates qualified attention on irreversible or externally consumed outputs while sampling keeps visibility into the long tail, and letting the model gate itself is not independent oversight at all.

   Source: Anthropic Claude certification (Architect – Professional), Domain 5 obj. 3 (human-in-the-loop validation strategies; risk-tiered oversight rather than blanket approval gates)Report a problem with this question

4. 4. A staffing company deploys an LLM system that scores applicants and automatically sends rejection emails to anyone below a threshold, with no person involved. Which governance response is appropriate?

   • A.Keep full automation but disclose in the job posting that AI is used in screening
   • B.Keep full automation but raise the rejection threshold and monitor aggregate accuracy monthly
   • C.Keep full automation and log every decision so rejected candidates can be re-reviewed on request
   • D.Reclassify the system as decision support: a qualified reviewer must review the adverse decision before it is communicated to the candidate✓ Answer

   Employment decisions belong to the class of high-risk uses affecting an individual's livelihood and legal or economic standing, where a qualified professional must review the output before it is disseminated rather than after. Disclosure, threshold tuning, and after-the-fact re-review are all worth doing but none of them supplies the missing element, which is a human accountable for the adverse decision at the moment it is made.

   Source: Anthropic Claude certification (Architect – Professional), Domain 5 obj. 3 and obj. 5; Anthropic Usage Policy high-risk domains (employment among them) require qualified professional review before disseminationReport a problem with this question

5. 5. Three months after an automated decision, a customer disputes it and your legal team must explain exactly how it was produced. Which record set makes the decision reconstructable?

   • A.The input, the prompt and model versions in effect, the retrieved context identifiers and versions, the tool calls made, the raw output, and any human reviewer and action✓ Answer
   • B.The current prompt plus a fresh re-run of the same customer query today
   • C.Aggregate dashboards showing accuracy, latency, and flag rates for that month
   • D.The final output text and its timestamp

   An audit trail must let you re-derive the specific decision, which requires capturing every input to it: prompt version, model version, retrieved context, tool calls, and the human step. Re-running the query today is not evidence because generation is non-deterministic and the prompt, model, and corpus have all changed since, while aggregate dashboards and a bare output cannot explain why that particular result occurred.

   Source: Anthropic Claude certification (Architect – Professional), Domain 5 obj. 5 (transparency and auditability: decision logging, documented model and prompt versions, retained rationale) and Domain 4 (observability sufficient to reconstruct an incident)Report a problem with this question

6. 6. To let an assistant call an internal reporting service, a developer pastes the service API key into the system prompt. Conversations are persisted for quality review. What is the correct remediation?

   • A.Keep the secret out of the prompt entirely: the model calls a backend endpoint that holds the credential server-side and authorizes the request there✓ Answer
   • B.Leave the key in place but instruct the model never to reveal or repeat it
   • C.Move the key from the system prompt into the first user message so it is not part of the reusable template
   • D.Leave the key in place, rotate it monthly, and monitor the reporting service for unusual usage

   Anything placed in a prompt becomes part of the conversation payload and of whatever transcript, log, cache, or review queue that payload flows into, so a secret in a prompt should be treated as already disclosed. Moving it to a user message changes nothing about persistence, and instructing the model not to reveal it is a request the model can be manipulated into ignoring; only holding the credential server-side keeps it out of the model's context and out of retained history.

   Source: Anthropic Claude certification (Architect – Professional), Domain 5 obj. 1 and Domain 3 (authentication and authorization: credentials are held server-side, never embedded in prompts or client-visible context)Report a problem with this question

7. 7. An agent can read an internal wiki and also has a tool that fetches arbitrary URLs. A security reviewer notes that untrusted wiki content could cause the agent to place confidential text into a URL it fetches. Which control BEST prevents exfiltration?

   • A.Log every outbound fetch and alert the security team on large request sizes
   • B.Redact obvious secrets from wiki pages so there is less sensitive text to leak
   • C.Add a system-prompt rule that the model must never include document text in a URL
   • D.Restrict outbound network egress to an approved destination allowlist and forbid model-constructed URLs and query parameters✓ Answer

   Exfiltration through a fetch tool is an egress problem, so the control belongs at the network boundary where the model has no influence: if the agent can only reach pre-approved destinations with parameters it did not author, injected instructions have nowhere to send data. Prompt rules can be overridden by the very injected content that triggers the attack, logging only detects the loss afterward, and redaction reduces impact without closing the channel.

   Source: Anthropic Claude certification (Architect – Professional), Domain 5 obj. 2 (data leakage / exfiltration failure modes) and Domain 3 (least-privilege scoping of tool capabilities)Report a problem with this question

8. 8. A finance operations agent has four capabilities: read account balances, generate an internal reconciliation report, initiate a vendor payment, and email vendors. Which approval design is most appropriate?

   • A.Approvals are requested only when the model itself judges an action to be risky
   • B.Every capability, including read-only queries, requires an approval click
   • C.No approvals; alert the finance team after any payment or email is sent
   • D.Read and report run automatically; payment and outbound email require human approval that displays the exact action and its parameters before execution✓ Answer

   Approval gates should sit on actions that are irreversible, move money, or leave the organization, because those are the ones a human cannot undo after the fact; read-only actions carry no such blast radius and gating them only trains reviewers to click through. Notifying after the payment is a detective control that arrives too late, and letting the model decide when to ask for approval makes the safeguard depend on the component being safeguarded.

   Source: Anthropic Claude certification (Architect – Professional), Domain 5 obj. 3 (require approval on state-changing/destructive actions; leave read-only paths automatic)Report a problem with this question

9. 9. A triage assistant that routes public benefit applications reports 94% accuracy on a held-out test set, and the team calls fairness testing complete. What is the most important gap?

   • A.Error rates were never measured sliced by demographic group, language, and other affected populations against pre-defined disparity thresholds✓ Answer
   • B.The test set is too small to support a 94% figure with confidence
   • C.Demographic fields were left in the input and should be removed so the model cannot see them
   • D.The system prompt does not instruct the model to treat all applicants fairly

   Aggregate accuracy can hide severe subgroup harm, because a small group with a very high error rate barely moves a global average; fairness is only observable when outcomes are evaluated sliced by the groups the system affects, against thresholds agreed before launch. Removing demographic fields does not remove bias since proxies such as postal code, name, or phrasing remain, and a fairness instruction in the prompt is unmeasured and unenforceable.

   Source: Anthropic Claude certification (Architect – Professional), Domain 5 obj. 5 (bias and fairness: evaluate outcomes sliced by demographic/protected group rather than reporting only aggregate accuracy)Report a problem with this question

10. 10. A retail brand launches a consumer-facing chat assistant with a human first name and a photo avatar. What does responsible deployment require?

    • A.Cover it with a line in the linked privacy policy, since the assistant's persona is a branding choice
    • B.Disclose only if the user asks whether they are talking to a person
    • C.Disclose at the start of the session that the user is interacting with AI, and in high-risk contexts also disclose that AI contributed to the advice or decision✓ Answer
    • D.No disclosure is needed because a team reviews sampled transcripts each week

    Disclosure exists so the user can calibrate trust and decide what to share, which only works if it arrives before the interaction rather than on request or buried in a policy document. A human name and avatar increase the risk of the user believing they are speaking with a person, and internal transcript review is an operational control that gives the user no information at all.

    Source: Anthropic Claude certification (Architect – Professional), Domain 5 obj. 5 (transparency: consumer-facing chatbots must disclose AI interaction at minimum at the start of the session; high-risk deployments additionally disclose AI involvement in the advice or decision)Report a problem with this question

11. 11. An unreviewed prompt change ships on a Friday morning. By afternoon, monitoring shows the assistant has produced thousands of confidently wrong answers to customers. What should the incident response do FIRST?

    • A.Begin a blameless postmortem and schedule a design review for the following week
    • B.Leave the system running and post a banner asking users to double-check its answers
    • C.Build and deploy an output classifier that catches this class of wrong answer
    • D.Contain: roll back to the last known-good prompt version and disable the affected path, then scope the affected outputs and notify impacted users✓ Answer

    Incident response is ordered containment first, then scoping, notification, and remediation, because every minute the faulty version stays live adds to the population of harmed users. A postmortem and a new classifier are remediation steps that take time the incident does not have, and a warning banner shifts the burden onto users while the harmful outputs keep being produced.

    Source: Anthropic Claude certification (Architect – Professional), Domain 5 (risk management) and Domain 6 (lifecycle management): incident response sequence detect, contain, scope, notify, remediateReport a problem with this question

12. 12. At a mid-size company, anyone on the product team can edit the production system prompt directly in a web console. There is no record of who changed what. Which governance control addresses the root problem?

    • A.Take a nightly backup of the prompt text so any change can be undone later
    • B.Require an announcement in the team chat channel before anyone edits the prompt
    • C.Treat the prompt as a versioned, peer-reviewed artifact in source control, promoted through staged rollout with a regression evaluation gate✓ Answer
    • D.Restrict console edit rights to a single senior engineer who makes all changes

    A production prompt is a controlled dependency whose behavior change is as consequential as a code change, so it needs the same lifecycle: review before merge, an immutable version history, a test gate, and a controlled rollout with a rollback path. Chat announcements and nightly backups leave changes untested, and funneling edits through one person creates a bottleneck without producing review, evaluation, or an audit record.

    Source: Anthropic Claude certification (Architect – Professional), Domain 6 (lifecycle management: documented changes, staged rollout) with Domain 4 (regression-test guardrails after every prompt or model change)Report a problem with this question

13. 13. A product team asks whether they may send full customer records to an external AI service to power a new feature. What is the correct governance answer?

    • A.Yes, provided the data is encrypted in transit and at rest
    • B.No, sending customer data to any external service is never permissible
    • C.It depends: classify the data, check the organization's own policy plus applicable law and contractual commitments for that data and jurisdiction, then obtain approval from the accountable owners before any data is sent✓ Answer
    • D.Yes, provided the vendor states that customer data is not used to train models

    What may leave the organization is determined by the data's classification and by the policy, law, and contracts that apply to that organization and jurisdiction, so the answer legitimately varies and must be established case by case rather than assumed. Vendor training statements and encryption address only narrow slices of the question, and a blanket prohibition is not the rule either; the durable control is classification plus documented approval by the accountable owner before transmission.

    Source: Anthropic Claude certification (Architect – Professional), Domain 5 obj. 4 (compliance: data classification, minimization, and organization- and jurisdiction-specific policy determine permissible third-party processing)Report a problem with this question

14. 14. A support-summarization feature currently sends each customer's entire profile, including government ID number and stored payment details, to the model. The summary only needs recent order history and the ticket text. What should change?

    • A.Keep sending the full profile but shorten how long the request logs are retained
    • B.Keep sending the full profile but encrypt the request payload
    • C.Keep sending the full profile but instruct the model to ignore the identity and payment fields
    • D.Send only the fields the task requires, and redact or tokenize identifiers at the boundary before the request is made✓ Answer

    Data minimization means the sensitive field is never transmitted at all, which is the only measure that removes it from every downstream copy: request logs, caches, traces, error reports, and any human review queue. Telling the model to ignore a field does not stop it from being sent, and shorter retention or encryption reduce exposure of data that should not have been in scope to begin with.

    Source: Anthropic Claude certification (Architect – Professional), Domain 5 obj. 4 (data minimization: process only the data the purpose requires)Report a problem with this question

15. 15. An engineer wants to enable a community-published connector that would give a production agent write access to the company CRM. What must happen before it is enabled?

    • A.Rely on the connector's high download count and community rating as evidence it is safe
    • B.A supply-chain review of the connector: publisher and provenance, the exact scopes and data flows it requires, its update and patching process, and formal approval, with its outputs treated as untrusted input✓ Answer
    • C.Enable it in production behind monitoring, and remove it if problems appear
    • D.Enable it, but instruct the agent in the system prompt to use the connector cautiously

    A third-party connector extends the trust boundary of the system to code and servers you do not control, and granting it write access makes any weakness in it a write path into your CRM. Popularity is not an assurance and monitoring is detective, arriving after records are already modified; the durable control is reviewing provenance, requested scopes, and maintenance before enablement and continuing to treat whatever the connector returns as untrusted data rather than instructions.

    Source: Anthropic Claude certification (Architect – Professional), Domain 5 obj. 2 (third-party tool/connector output expands the trust boundary) and Domain 3 (per-tool authorization review before enablement)Report a problem with this question

16. 16. A document assistant that was stable for months begins producing confident answers with citations that do not match the source text. The change began the day after a scheduled refresh of the document set. The model version, prompt version, temperature, and latency are all unchanged. Where should you investigate FIRST?

    • A.The retrieval and indexing layer: whether the re-index completed, whether chunking or embeddings are mismatched, and whether the index still points at the current documents✓ Answer
    • B.The context window, which has probably become too small to hold the retrieved passages
    • C.The model itself, since answer quality is a model-quality problem
    • D.The sampling temperature, which is likely too high for a factual task

    Diagnosing an LLM system starts with asking what changed, and the only thing that changed here is the document corpus, which implicates the retrieval and indexing pipeline rather than the model. A partial re-index, an embedding or chunking mismatch, or a stale index pointer all feed the model wrong passages, and the model then faithfully cites the wrong material, so tuning temperature or blaming model quality would leave the real defect in place.

    Source: Anthropic Claude certification (Architect – Professional), Domain 5 obj. 2 (distinguish model failure from pipeline failure; mis-retrieved or stale RAG context as a failure mode)Report a problem with this question

17. 17. During a governance review of a customer-facing automated system, the question 'who is accountable when this system produces a harmful output?' has no documented answer. Which arrangement satisfies the accountability requirement?

    • A.A named internal owner accountable for the system's outputs, a documented approver for its deployment, and a defined escalation and remediation path when it is wrong✓ Answer
    • B.The model provider, because the provider designed and trained the underlying model
    • C.The end user, who accepted terms stating that outputs may be inaccurate and should be verified
    • D.Whichever engineer most recently modified the prompt or configuration

    Accountability for a deployed system rests with the organization that chose to deploy it for its own purpose, so it must be assigned to a named owner in advance, with a recorded deployment approval and a remediation path. Pointing at the provider, at the user's acceptance of terms, or at whoever last touched the configuration all diffuse responsibility after the fact and leave no one empowered to stop or fix the system.

    Source: Anthropic Claude certification (Architect – Professional), Domain 5 (governance and risk management) and Domain 6 (documented approvals, ownership, and handoff for deployed systems)Report a problem with this question

18. 18. A team wants to reuse an internal meeting-summarization system, validated only for internal notes, as the engine for a public health-information chatbot. What does good governance require?

    • A.Documented intended use and known limitations define the approved scope; a materially different use requires a new risk assessment, evaluation, and approval before launch✓ Answer
    • B.Reuse is fine because the underlying model and infrastructure are identical
    • C.Reuse is fine as long as a disclaimer tells users the answers may be inaccurate
    • D.Reuse is fine as long as all conversations are logged for later review

    Validation is always relative to a use case and a population, so evidence gathered for low-stakes internal summarization says nothing about accuracy or harm in public health guidance, where errors reach people who may act on them. Identical infrastructure is irrelevant to risk, and a disclaimer or a log neither establishes fitness for the new purpose nor supplies the review that a high-risk domain requires.

    Source: Anthropic Claude certification (Architect – Professional), Domain 5 (documenting intended use and known limitations; out-of-scope use requires re-assessment) and Domain 6 (lifecycle governance)Report a problem with this question

19. 19. A legal-operations team has added grounding controls to a research assistant: it may use only the supplied documents, must quote source text for each claim, and is explicitly permitted to answer 'I don't know'. They ask whether outputs can now be published without review. What is the correct response?

    • A.Yes, provided a keyword filter blocks outputs that contain no citation at all
    • B.Yes, provided the assistant is also run several times and the answers are checked for agreement
    • C.Yes: requiring a verbatim quote for every claim makes fabrication structurally impossible
    • D.No: these controls reduce but do not eliminate fabricated or misapplied content, so high-stakes output still requires qualified review before dissemination✓ Answer

    Grounding, citation requirements, and permission to abstain are documented as measures that reduce hallucination, not as guarantees, because a model can still misread, misattribute, or draw an unsupported inference from a correctly quoted passage. Consistency checking across runs and citation-presence filters raise the floor but cannot verify that a citation actually supports the claim, so a qualified professional must still review high-stakes output before it is disseminated.

    Source: Anthropic Claude certification (Architect – Professional), Domain 5 obj. 1 (grounding guardrails reduce but do not eliminate hallucination; high-stakes output still requires validation) and obj. 3 (pre-dissemination review in high-risk domains)Report a problem with this question

20. 20. In an enterprise assistant backed by a shared document index, a user receives a passage from a document their role is not permitted to open. What is the correct fix?

    • A.Instruct the model in the system prompt not to disclose documents the user lacks permission to read
    • B.Add an output classifier that inspects the final answer and removes sensitive-looking passages
    • C.Retrieve fewer passages per query so the chance of surfacing a restricted document drops
    • D.Enforce the requesting user's entitlements inside retrieval, so unauthorized documents are filtered out before any passage reaches the model✓ Answer

    Authorization must be enforced at the data layer, because once restricted text is placed in the model's context it has already crossed the permission boundary and every later control is best-effort. A prompt instruction can be overridden, an output classifier guesses at sensitivity and fails silently, and retrieving fewer passages only lowers the probability of a breach that the architecture still permits.

    Source: Anthropic Claude certification (Architect – Professional), Domain 3 (tenant isolation and per-user authorization on retrieval so RAG cannot leak across permission boundaries) with Domain 5 obj. 2 (data leakage failure mode)Report a problem with this question

Practice questions based on the official Claude Certified Architect – Professional (CCAR-P) exam guide and Anthropic's public documentation. This is an independent study tool, not affiliated with or endorsed by Anthropic, and does not grant certification. The real exam is 63 questions, 120 minutes, passing at a scaled 720/1000, delivered via Pearson VUE ($175). Official certification page →