Free CCAR-P Governance, Safety & Risk Management Practice Questions

The Governance, Safety & Risk Management domain makes up 14% of the Anthropic CCAR-P exam. Practice free questions covering AI governance frameworks, safety guardrails, risk assessment, compliance, and responsible deployment — each with the correct answer and a detailed explanation. The real exam mixes multiple-choice and multiple-response items; these practice questions use a single-best-answer format.

CCAR-P Governance, Safety & Risk Management Sample Questions with Answers

Sample Question 1 — Governance, Safety & Risk Management

A manufacturer uses Claude to process vendor emails and attachments. The agent extracts shipment changes and can update purchase orders through an ERP tool. During testing, a PDF containing hidden instructions caused the agent to replace a supplier's bank account. The workflow must continue processing 8,000 messages daily, but payment-related changes require procurement approval. Which redesign BEST addresses the root risk?

  1. A. Add stronger system instructions, scan attachments for injection phrases, and alert security when suspicious text is found.
  2. B. Use a more capable model to classify attachment instructions and retain the existing ERP permissions for operational continuity.
  3. C. Separate extraction from execution, expose narrowly scoped ERP operations, and require procurement approval for payment-related changes. (Correct answer)
  4. D. Run the agent with its current permissions in a sandboxed network and retain complete tool-call traces for investigation.

Correct answer: C

Explanation: Correct answer (C): Separating untrusted-content interpretation from privileged execution prevents an attachment from becoming an authority for tool use. Narrow ERP operations reduce excessive agency, while the approval gate enforces the stated requirement for payment-related changes. This applies the principles of least privilege and deterministic control at a trust boundary, which reduce the blast radius of prompt injection in production. Why the other options are wrong: - Option A: An architect might add detection and stronger instructions as defense-in-depth, but these probabilistic controls do not prevent missed injection content from invoking a privileged ERP operation. - Option B: A stronger model might identify more malicious instructions, but model capability does not eliminate the trust-boundary problem or excessive permissions. - Option D: Sandboxing and tracing can limit network exposure and support investigation, but they do not prevent the agent from making an authorized yet fraudulent ERP change.

Sample Question 2 — Governance, Safety & Risk Management

A consulting firm's assistant retrieves confidential engagement documents and can also query a third-party web search service. Logs show that Claude sometimes includes client names, unreleased acquisition details, and internal document excerpts in search queries. Employees still need current public research, and the search provider is not approved to process client-confidential data. Which control BEST prevents this disclosure?

  1. A. Encrypt search requests in transit and require the search provider to rotate its transport certificates more frequently.
  2. B. Route outbound searches through a policy gateway that constructs minimized queries and blocks confidential entities and retrieved excerpts. (Correct answer)
  3. C. Store complete outbound queries in an immutable audit system and review a statistically representative sample each week.
  4. D. Replace external search with a larger internal vector index populated by quarterly snapshots of selected public websites.

Correct answer: B

Explanation: Correct answer (B): A policy gateway controls the point where data crosses into the unapproved external service. Constructing purpose-limited queries and blocking confidential content directly prevents disclosure while preserving public research. The governing principle is data minimization across trust boundaries, which matters because encryption protects transmission but does not make the recipient authorized to receive the data. Why the other options are wrong: - Option A: Encryption is necessary for secure transport, but the scenario prohibits the provider from receiving confidential data at all; encrypted disclosure remains disclosure. - Option C: Immutable logs improve accountability and may reveal recurring leakage, but weekly review detects the problem only after sensitive information has left the organization. - Option D: An internal public-data index avoids the third-party boundary, but quarterly snapshots fail the stated need for current web research and create a separate content-maintenance burden.

Sample Question 3 — Governance, Safety & Risk Management

An online retailer uses Claude to interpret refund requests and produce structured refund actions. Refunds above $500 require supervisor approval, and a refund may only be issued to the payment instrument used for the order. These rules must hold even if a user manipulates the conversation. Where should the architect enforce them?

  1. A. In the system prompt, with examples covering refund thresholds and valid payment instruments.
  2. B. In a post-transaction monitor that reverses refunds violating the applicable business rules.
  3. C. In the model's output schema, by requiring amount, reason, and destination fields.
  4. D. In a deterministic transaction service that validates authorization, destination, and approval before execution. (Correct answer)

Correct answer: D

Explanation: Correct answer (D): The transaction service can deterministically reject unauthorized destinations and require approval above the threshold before money moves. The explicit requirement that these rules hold under manipulation makes an enforcement boundary outside the model necessary. In production, security-critical financial policy belongs in trusted application logic rather than probabilistic model behavior. Why the other options are wrong: - Option A: Prompt examples can improve normal behavior, but a prompt cannot deterministically enforce financial authorization against manipulation. - Option B: Monitoring and reversal may reduce loss, but they permit an invalid transaction to occur and assume it can always be reversed. - Option C: A schema ensures required fields and types, but structurally valid values can still violate account authorization or approval limits.

Sample Question 4 — Governance, Safety & Risk Management

A regulated utility uses Claude to draft complaint responses and recommend remediation. It achieves 94% aggregate agreement with reviewers. Most outputs explain billing or offer reversible credits, but recommendations to deny a statutory remediation claim affect the customer's legal rights. The operations team cannot review every response. Which review policy is MOST appropriate?

  1. A. Automatically send every response above a model-confidence threshold and audit a random sample of the remainder.
  2. B. Require approval for all responses until aggregate reviewer agreement exceeds 98% for two consecutive months.
  3. C. Require pre-execution approval for statutory denials, while sampling lower-risk drafts and monitoring each decision segment separately. (Correct answer)
  4. D. Automatically send reversible credits and statutory denials, but let customers appeal any outcome through the existing complaint process.

Correct answer: C

Explanation: Correct answer (C): Statutory denials have legally consequential effects, so they warrant approval before execution even when aggregate performance is strong. Sampling lower-risk drafts preserves operational capacity, and segment monitoring avoids hiding denial-specific failures in the global score. The principle is proportional human oversight based on impact and reversibility, which directs scarce review capacity to the highest-risk decisions. Why the other options are wrong: - Option A: Confidence-based routing can help prioritize review, but model confidence may be uncalibrated and does not override mandatory oversight for legally consequential denials. - Option B: Universal review is reasonable during an initial controlled launch, but an aggregate threshold does not directly address segment risk and conflicts with the stated review-capacity limit. - Option D: Appeals provide recourse and reversible credits may tolerate automation, but post hoc appeal is inferior when a denial immediately affects statutory rights.

Sample Question 5 — Governance, Safety & Risk Management

A hospital is deploying a Claude service that summarizes longitudinal records for specialist referrals. Clinically relevant histories must be preserved, all processing must remain in the approved region, and raw prompts and outputs may be retained for no more than 30 days. The prototype removes patient names but sends complete records and stores full traces indefinitely for debugging. Which production change BEST satisfies the requirements?

  1. A. Keep complete records and traces, encrypt them with hospital-managed keys, and grant access only to the AI engineering team.
  2. B. Remove direct identifiers, retain full traces for model improvement, and move the trace store into the approved region.
  3. C. Summarize records before regional processing, then retain every intermediate summary indefinitely because it contains no patient name.
  4. D. Select purpose-relevant record sections, process regionally, minimize trace content, and enforce role-based access and 30-day deletion. (Correct answer)

Correct answer: D

Explanation: Correct answer (D): Purpose-based record selection limits exposure while retaining facts needed for referrals. Regional processing, minimized traces, role-based access, and enforced deletion directly satisfy the residency, access, and 30-day retention constraints. Privacy governance applies across prompts, outputs, intermediates, and operational telemetry; removing names alone does not eliminate health-data sensitivity or re-identification risk. Why the other options are wrong: - Option A: Encryption and restricted access are valuable controls, but retaining complete records and traces indefinitely violates minimization and the explicit 30-day limit. - Option B: Regional storage addresses residency, but direct-identifier removal is incomplete protection and indefinite trace retention still violates the stated lifecycle requirement. - Option C: Pre-summarization can reduce context, but intermediate clinical summaries remain sensitive and cannot be retained indefinitely merely because names were removed.

Sample Question 6 — Governance, Safety & Risk Management

An insurer is rolling out a claims assistant in the EU, Canada, and Australia. Regulators require traceability of recommendations and approvals, but customer claim content must remain in its originating region. Local rules impose different transcript-retention periods, and the global risk team needs cross-region control metrics. Which architecture BEST reconciles these requirements?

  1. A. Store complete prompts and outputs in one encrypted global audit lake, with region-based views and centrally managed access policies.
  2. B. Keep regional processing and content stores, record minimized audit metadata locally, and export de-identified aggregate control metrics globally. (Correct answer)
  3. C. Keep all records regional and prohibit cross-region reporting, requiring each regional compliance team to conduct independent manual audits.
  4. D. Hash complete transcripts, delete the originals after processing, and send hashes plus model-generated summaries to the global risk team.

Correct answer: B

Explanation: Correct answer (B): Regional content planes keep claim data within its jurisdiction, while local retention policies can enforce each region's lifecycle rules. Minimized metadata can preserve model version, source provenance, policy decisions, approvals, and integrity references without centralizing full content. De-identified aggregate metrics support global governance under data minimization, demonstrating that auditability does not require a global transcript repository. Why the other options are wrong: - Option A: Centralization simplifies analytics and access administration, but encrypted content still leaves its originating region and may violate location-specific retention rules. - Option C: Strict regional isolation protects residency, but prohibiting minimized cross-region metrics unnecessarily prevents the required global control oversight. - Option D: Hashes can support integrity checks, but model-generated summaries may still contain regional claim data, and deleting originals immediately may defeat required local retention and review.

Sample Question 7 — Governance, Safety & Risk Management

A telecommunications provider uses Claude to prioritize service complaints. Overall priority accuracy is 92%, exceeding the launch target. Complaints show that rural customers, who represent 6% of cases, are frequently assigned lower urgency despite similar outage severity. The business wants to expand automated routing next month. What should the architect recommend FIRST?

  1. A. Create a representative rural-case evaluation, compare error and outcome metrics by segment, assign remediation ownership, and gate expansion on thresholds. (Correct answer)
  2. B. Raise the global accuracy target to 95%, add more randomly selected cases, and proceed when the new aggregate threshold is met.
  3. C. Remove geographic information from prompts and immediately expand routing after confirming that the field is no longer visible to Claude.
  4. D. Add an explanation to each priority score so operations staff can understand why the model assigned a particular urgency.

Correct answer: A

Explanation: Correct answer (A): The reported failure is segment-specific and may be hidden by rural customers' small share of the aggregate. A representative segmented evaluation establishes the disparity, supports root-cause investigation, and creates an accountable deployment gate. Fairness governance requires relevant outcome measurement and named remediation ownership, not merely a stronger global metric or more persuasive explanations. Why the other options are wrong: - Option B: A higher aggregate target and more random cases can improve broad measurement, but the small affected segment may remain underrepresented and continue failing. - Option C: Removing geography may appear to reduce direct bias, but other fields may act as proxies, and location may be legitimately relevant to outage impact or response constraints. - Option D: Explanations can support review, but generated explanations do not establish whether outcomes are equitable or correct the segment-level disparity.

Sample Question 8 — Governance, Safety & Risk Management

An executive research system synthesizes market filings, licensed reports, and internal forecasts into acquisition recommendations. The board requires material claims to be verifiable and each consequential recommendation to have an accountable approver. Which production feature BEST meets this requirement?

  1. A. Display Claude's complete generated explanation beside every recommendation and archive it for future governance reviews.
  2. B. Attach a confidence score to each recommendation and automatically approve recommendations above a defined threshold.
  3. C. Link claims to versioned source excerpts, label model synthesis and uncertainty, and record the approving decision owner. (Correct answer)
  4. D. Require the research team to validate the final recommendation but omit source details to protect licensed report content.

Correct answer: C

Explanation: Correct answer (C): Versioned source excerpts provide verifiable provenance, while explicit labels distinguish evidence from model synthesis and uncertainty. Recording the human approver establishes organizational accountability for consequential recommendations. Generated reasoning or confidence is not independent evidence, so production traceability must connect claims to retrievable sources and decisions to responsible owners. Why the other options are wrong: - Option A: A generated explanation can help readers follow the recommendation, but it may be persuasive without being factually grounded and does not establish source provenance. - Option B: Confidence thresholds can support workflow routing, but model confidence is not proof and automatic approval removes the required accountable decision owner. - Option D: Human validation provides oversight, but omitting evidence prevents the board from verifying material claims; access-controlled excerpts could protect licensed content.

Keep Practicing

Take the 10-question CCAR-P quick-start test across all 7 domains, or return to the CCAR-P practice test hub for 200+ questions, exam details, and a study plan. Drill the other domains: Integration, Solution Design & Architecture, Evaluation, Testing & Optimization, Governance, Safety & Risk Management, Stakeholder Communication & Lifecycle Management, Claude Models, Prompting & Context Engineering, and Developer Productivity & Operational Enablement.