CCAR-P Practice Questions: Developer Productivity & Operational Enablement Domain

Correct answer (B): Using each developer's identity preserves attribution and avoids prohibited shared credentials. Read-only access supports the required analysis, while repository authorization deterministically reserves protected writes for the release team. This is a least-privilege design that separates identity from authorization and prevents prohibited actions instead of relying on the model to interpret a warning.

Why the other options are wrong:
- Option A: A shared token would make release operations convenient and a confirmation step may reduce accidental use. However, it directly violates the shared-credential prohibition and allows the model to possess more authority than most developers.
- Option C: A writable workspace could simplify analysis and audit logs would support investigation. However, logging is a compensating control that does not prevent unauthorized modification of sensitive code.
- Option D: Confirmation can be useful for authorized consequential actions. However, every developer would still receive write privileges that conflict with the stated release-team-only authorization boundary.

Correct answer (D): Deterministic checks should continue to block enforceable violations, while human attention should scale with semantic and business risk. The contrast between low-risk documentation and financially consequential authentication or payout changes makes risk-based review the governing constraint. This preserves assurance where failures matter most without forcing equal review cost onto every change.

Why the other options are wrong:
- Option A: Uniform senior review is defensible for highly sensitive repositories, but it does not use the stated risk differences to reduce review queues.
- Option B: Automated tests and scanners are important, but they cannot fully verify business semantics or architectural risk in authentication and payout code.
- Option C: Model explanations can support reviewers, but model confidence is not a deterministic quality gate and making existing checks advisory weakens assurance.

Correct answer (A): Classification separates routine transformations from migrations affected by language compatibility, weak coverage, business criticality, or deprecated callbacks. Per-repository gates preserve traceability, and exception ownership plus revert procedures address high-risk failures. The decisive constraints are fleet heterogeneity, an eight-week deadline, regulated systems, and repository-level accountability. The architectural principle is scalable automation through risk-based routing rather than uniform autonomy. In production, this captures efficiency for mechanical work without silently applying unsuitable changes to exceptional systems.

Why the other options are wrong:
- Option B: Parallel patching could meet the schedule, but build success does not validate behavioral callback changes and batch-level investigation loses required repository traceability.
- Option C: Per-repository agents enable parallelism, but inconsistent self-selected validation weakens governance and aggregate rates can hide failures in regulated systems.
- Option D: Manual handling appropriately recognizes regulated risk, but reusing one unchanged patch ignores language, coverage, and callback differences across the remaining fleet.

Correct answer (D): A federated model preserves mandatory enterprise identity, audit, permission, and review controls while allowing teams to specialize within governed extension points. The prior failure of a monolithic system and the diversity of team workflows make controlled extensibility decisive. In production, this model limits control fragmentation without making the platform unusable for domain-specific engineering.

Why the other options are wrong:
- Option A: Team autonomy supports local productivity, but retrospective reports do not consistently enforce the required identity, permission, and review baselines.
- Option B: A single configuration creates uniformity, but it repeats the monolithic approach that failed to support diverse languages and local delivery practices.
- Option C: Language-specific agents provide some specialization, but prohibiting local extensions cannot accommodate repository and domain requirements within the same language.

Correct answer (C): The organization needs deterministic consistency for identity, permissions, auditing, and release controls, but its engineering workflows are too heterogeneous for one monolithic implementation. A federated model centralizes non-negotiable risk boundaries and asset lifecycle governance while allowing approved local extensions to evolve at team speed. This avoids both uncontrolled configuration drift and a central bottleneck that cannot support specialized engineering contexts.

Why the other options are wrong:
- Option A: Local ownership would maximize responsiveness and fit each unit's technical environment. However, decentralizing permissions and release gates violates the requirement for common enforceable security controls, while quarterly review is only retrospective.
- Option B: A single central configuration would produce consistency and simplify audit review. However, it cannot accommodate the stated differences in languages and workflows and would force every local change through the existing central delay.
- Option D: Specialized agents could improve domain fit, and a dashboard would make behavior visible. However, broad access conflicts with minimum permissions, and observability does not replace mandatory preventive controls or governed extensions.

Correct answer (B): Individual federated identities provide attribution, while managed roles enforce repository and tool authorization and centralized expiry supports the 15-minute revocation requirement. The governing constraints are rapid revocation, user-level attribution, and differing repository sensitivity. The principle is to enforce authorization through identity-aware infrastructure rather than prompts or shared credentials. In production, this limits exposure, preserves reliable audit records, and allows one person's access to end without disrupting others.

Why the other options are wrong:
- Option A: Project credentials are easier to rotate than one enterprise credential, but they still weaken user attribution and may not support immediate individual revocation.
- Option C: Individual accounts improve attribution, but prompt-based repository prohibitions do not enforce authorization and weekly review is too late for the revocation SLA.
- Option D: A shared service account simplifies operations, but self-identification is not trustworthy attribution and output filtering occurs after unauthorized access may have happened.

Correct answer (B): The instructions apply to the whole repository and must evolve through the existing review process. Version-controlled project instructions give every developer consistent guidance while providing ownership, history, review, and rollback. This applies the principle that shared development configuration should be managed as a reviewable software asset, which reduces configuration drift in production engineering workflows.

Why the other options are wrong:
- Option A: Personal instructions can preserve individual preferences, but independently maintained copies would drift and would not satisfy the requirement for reviewed team-wide changes.
- Option C: An onboarding document is useful for training, but repeated manual copying creates inconsistent session context and weak change control.
- Option D: Central standards can govern organization-wide requirements, but one global configuration would not track the evolving conventions of this specific repository.

Correct answer (C): Scoped read-only tools satisfy the diagnostic need while structurally preventing production mutation and avoiding long-lived credentials. The prohibition on AI-initiated mutations makes least privilege the governing constraint. The underlying principle is to enforce sensitive boundaries through identity and tool design rather than model instructions or after-the-fact detection, reducing both accidental and adversarial impact.

Why the other options are wrong:
- Option A: A monitored proxy improves traceability, but alerts detect an overprivileged action rather than preventing the prohibited production mutation.
- Option B: Human approval can control exceptional operations, but administrator access is unnecessary for the stated read-only diagnostic workflow and violates least privilege.
- Option D: Local copies may improve query speed, but distributing customer-derived telemetry to laptops expands the privacy boundary and does not provide the strongest access control.

Correct answer (B): A maintained enablement package supplies reusable starting points, safe defaults, complete workflow examples, accountability, and support at enterprise scale. Rapid onboarding must occur without losing permission and review standards. Treating enablement assets as owned operational products reduces setup duplication and prevents unsafe practices from becoming local defaults.

Why the other options are wrong:
- Option A: Immediate access encourages experimentation, but access alone does not establish the required permission, testing, and human review practices.
- Option C: Specialist support can help complex teams, but embedding scarce experts in every planning meeting will not scale to 400 engineers.
- Option D: The pilot configuration offers a useful example, but forced duplication may carry stack-specific assumptions and create many unmanaged copies.

Correct answer (C): A correlated incident bundle helps Claude connect the deployment with telemetry and configuration while read-only tools keep diagnosis separate from mutation. Authorized review directly satisfies the prohibition on unverified production changes. The governing principle is to use AI for evidence synthesis and hypothesis generation while preserving deterministic operational control over high-impact actions.

Why the other options are wrong:
- Option A: Automatic rollback can limit some damage and command recording aids auditing, but broad shell access still permits the prohibited unverified mutation.
- Option B: Reducing context can improve focus, but logs alone omit traces, deployment events, and configuration needed to test the likely post-deployment cause.
- Option D: Parallel analysis may accelerate independent inspection, but majority agreement among probabilistic agents is not authorization to alter production.