CCAR-P Practice Questions: Governance, Safety & Risk Management Domain

Correct answer (D): A tiered policy aligns review intensity with the consequence and ambiguity of each message. The controlling constraints are limited clinician capacity and the prohibition on unreviewed clinically consequential recommendations. The architectural principle is risk-proportionate human oversight: automate low-risk, reversible communication while escalating clinical, uncertain, or exceptional cases. In production, this preserves capacity without weakening the safety boundary around patient care.

Why the other options are wrong:
- Option A: An architect might use deterministic checks and sampling for scale, but sampling cannot guarantee review of every clinically consequential recommendation before delivery.
- Option B: An architect might choose universal review in a regulated setting, but it ignores the stated clinician-capacity constraint and applies equal controls to materially different risks.
- Option C: An architect might use confidence as an efficient escalation signal, but a fixed self-reported score is not a reliable substitute for impact-based classification and mandatory clinical review.

Correct answer (C): The review policy should follow materiality, known error concentration, and reversibility. High-value adjustments have immediate regulatory impact, while handwritten documents are a demonstrated weak segment; both warrant mandatory review. Validated low-risk cases can be automated, with sampling used to detect drift. This risk-tiered approach preserves throughput without treating all errors as equally consequential.

Why the other options are wrong:
- Option A: Citations improve traceability, but cited evidence does not guarantee correct extraction and does not address the known risks from high-value or handwritten cases.
- Option B: Random sampling is useful for ongoing monitoring, but it can miss individual high-value errors that immediately affect regulatory reporting.
- Option D: Confidence-based triage can be useful when calibrated, but self-reported confidence alone does not address materiality and may not identify the observed handwritten-document weakness.

Correct answer (A): An authenticated policy-enforcement service evaluates each transaction against current employee authority, account state, and fraud policy before execution. The decisive constraint is that limits vary dynamically and must never be exceeded. The architectural principle is to enforce security-critical authorization deterministically at the action boundary rather than delegate it to model behavior. This prevents prohibited transactions instead of relying on probabilistic compliance or after-the-fact correction.

Why the other options are wrong:
- Option B: An architect might refresh prompts to improve model awareness, but prompt content can become stale and cannot deterministically enforce employee-specific transaction authority.
- Option C: An architect might use a second model as a verifier, but both calls remain probabilistic and may operate on stale policy rather than authoritative current state.
- Option D: An architect might use logging and reversals for recovery, but the requirement states that unauthorized credits must not occur, making retrospective correction insufficient.

Correct answer (B): Narrow read-only tools preserve fast access to operational evidence while removing unnecessary write capability, and a sandbox limits the impact of analyzing untrusted files. Any production mutation is separated behind an explicit approval boundary. This best meets both the 30-second diagnostic objective and the prohibition on unapproved changes by applying least privilege rather than trying to infer command safety.

Why the other options are wrong:
- Option A: Keyword blocking and explanations may stop obvious mistakes, but shell commands can have indirect effects that evade a denylist, leaving broad production privileges intact.
- Option C: A mirror safely supports some investigation, but hourly state can be too stale for active incidents and does not provide the required current production diagnostics.
- Option D: Independent model review can reduce some errors, but two probabilistic judgments do not create a deterministic boundary against unapproved production modification.

Correct answer (C): Reconstruction requires verifiable lineage from each finding to its evidence and the system components that produced it. Source identifiers, retrieval artifacts, validation outcomes, model and prompt versions, tool activity, and the human disposition create a durable trace without treating generated prose as ground truth. This matters because model explanations can sound plausible but do not prove which evidence or configuration actually governed the output.

Why the other options are wrong:
- Option A: Detailed explanations and confidence can improve reviewer usability. They are generated assertions rather than durable provenance and cannot establish the actual source, retrieval state, or deployed configuration.
- Option B: Session recordings preserve visible interactions and may help investigate usability issues. They do not reliably capture backend retrieval, model, prompt, policy, validation, or tool versions in a machine-auditable form.
- Option D: Dual review strengthens human accountability for consequential findings. Reviewer names and a generated explanation still do not reconstruct the evidence and system configuration behind the finding.

Correct answer (C): The requirements span multiple control layers: unauthorized data should be excluded before context construction, unnecessary sensitive fields should be minimized, and generated output should be validated for schema, prohibited fields, and evidentiary support. This defense-in-depth design addresses both privacy exposure and unsupported claims. It matters in production because a single post-generation filter cannot reliably correct unauthorized retrieval or establish claim provenance.

Why the other options are wrong:
- Option A: A broader pattern filter could catch additional identifier formats. Retrieving records the advisor cannot access violates the permission boundary before output filtering occurs, and filtering does not verify risk claims.
- Option B: A stronger model and sampling may improve average summary quality. They neither enforce record-level authorization nor validate every released summary against the mandatory schema and evidence requirements.
- Option D: Independent generation can expose instability and support evaluation. Model confidence is not a reliable authorization, privacy, or grounding control, and retaining both outputs may increase sensitive-data exposure.

Correct answer (C): Statutory denials have legally consequential effects, so they warrant approval before execution even when aggregate performance is strong. Sampling lower-risk drafts preserves operational capacity, and segment monitoring avoids hiding denial-specific failures in the global score. The principle is proportional human oversight based on impact and reversibility, which directs scarce review capacity to the highest-risk decisions.

Why the other options are wrong:
- Option A: Confidence-based routing can help prioritize review, but model confidence may be uncalibrated and does not override mandatory oversight for legally consequential denials.
- Option B: Universal review is reasonable during an initial controlled launch, but an aggregate threshold does not directly address segment risk and conflicts with the stated review-capacity limit.
- Option D: Appeals provide recourse and reversible credits may tolerate automation, but post hoc appeal is inferior when a denial immediately affects statutory rights.

Correct answer (D): Replacing the unrestricted shell and administrator credential removes unnecessary capabilities rather than merely observing their use. The decisive constraint is that the approved workflow needs diagnostics and restarts for only 12 services. The governing principle is least privilege through narrow tools and resource-scoped credentials. This matters in production because it limits the impact of model errors, malicious input, and compromised integrations.

Why the other options are wrong:
- Option A: An architect might use anomaly alerts to improve detection, but the agent could still alter unrelated production resources before an engineer responds.
- Option B: An architect might seek additional reasoning for auditability, but generated explanations do not constrain the administrator credential or unrestricted shell.
- Option C: An architect might extend retention to support investigations, but retrospective review does not prevent the configuration changes the scenario already demonstrated.

Correct answer (D): The root cause is excessive authority through a shared identity and unrestricted execution, not insufficient telemetry. Separating read-only diagnosis preserves autonomous investigation, while narrow schema-constrained mutation tools reduce action scope. Evaluating authorization with the requester's identity and requiring approval for destructive changes satisfies attribution and oversight requirements. This prevention-first design matters because post-execution detection cannot reliably reverse production damage.

Why the other options are wrong:
- Option A: Anomaly detection can identify suspicious commands and improve response. The stated incident demonstrates that detection after or during unrestricted execution is not a substitute for removing excessive permissions and the unattributable shared identity.
- Option B: Sandboxing and targeted approvals can reduce some execution risk. Retaining production administrator access and relying on a command list leaves broad authority and permits destructive actions that evade pattern matching.
- Option C: A deterministic runbook and manual execution would reduce agent risk. It unnecessarily removes the required benefit of autonomous diagnosis even though read-only investigation can be safely separated from changes.

Correct answer (B): The aggregate score may conceal systematic errors in a smaller segment, and production complaints provide evidence that this segment requires explicit evaluation. Representative examples and segment-level error and outcome analysis establish whether the problem is data, labeling, prompting, or workflow-related. Routing affected rankings for review preserves accountable decision-making while evidence is gathered. This is preferable to optimizing the same global benchmark, which could improve the headline metric without reducing disparate harm.

Why the other options are wrong:
- Option A: A higher quality target and prompt optimization can improve aggregate performance. Reusing the same historical set neither diagnoses the affected segment nor establishes that historical recruiter decisions are an appropriate fairness baseline.
- Option C: Explanations may help recruiters inspect recommendations and support transparency. Generated rationales are not reliable evidence of causal model behavior and do not quantify the reported segment-level disparity.
- Option D: Removing explicit references may reduce one source of influence. Career gaps can remain inferable from employment dates, and aggregate monitoring would continue to hide the reported segment failure.