Free 10-Question CCAR-P Quick-Start Practice Test

Check your CCAR-P (CCA-P) readiness in under 15 minutes with 10 practice questions spanning all 7 Anthropic exam domains — Integration (19%), Solution Design & Architecture (17%), Evaluation, Testing & Optimization (16%), Governance, Safety & Risk Management (14%), Stakeholder Communication & Lifecycle Management (14%), Claude Models, Prompting & Context Engineering (13%), and Developer Productivity & Operational Enablement (7%). Instant scoring with detailed explanations, no signup required. The real exam mixes multiple-choice and multiple-response items; these practice questions use a single-best-answer format.

10 CCAR-P Sample Questions with Answers

Sample Question 1 — Claude Models, Prompting & Context Engineering

A software company classifies 180,000 support tickets daily into 25 routing queues. The production SLA is 800 ms, and the minimum acceptable macro F1 score is 0.92. On a representative evaluation set, a faster model achieves 0.935 macro F1 at 420 ms and $0.003 per ticket; a more capable model achieves 0.947 at 1.1 seconds and $0.014 per ticket. Which model strategy should the architect recommend?

  1. A. Use the more capable model because its higher F1 score outweighs the latency and cost differences.
  2. B. Use the faster model because it meets the measured quality threshold, latency SLA, and operating constraints. (Correct answer)
  3. C. Run both models for every ticket and accept a route only when their classifications agree.
  4. D. Alternate between the models evenly so production traffic continues to exercise both capability levels.

Correct answer: B

Explanation: Correct answer (B): The faster model is best because representative evidence shows that it exceeds the required 0.92 macro F1 score while remaining within the 800 ms SLA and costing substantially less. CCAR-P model selection should be driven by demonstrated workload requirements rather than generic capability ranking. In production, right-sizing avoids paying for quality and reasoning capacity that do not improve the defined business outcome. Why the other options are wrong: - Option A: A higher evaluation score can be valuable, but this model violates the explicit latency SLA and provides improvement beyond the stated acceptance threshold at much higher cost. - Option C: Agreement checks can help with uncertain high-risk decisions, but invoking both models for every routine classification would increase cost and latency without a stated requirement for consensus. - Option D: Continued experimentation can detect model differences, but evenly splitting production traffic is not an appropriate steady-state routing strategy when one model already satisfies all requirements.

Sample Question 2 — Claude Models, Prompting & Context Engineering

Twelve business units use Claude to generate weekly operations reports. Each unit copied the original prompt and now maintains its own version. After six months, required risk disclosures are missing in four units, formatting differs across reports, and changes cannot be traced reliably. Units still need distinct terminology and metrics. Which prompt architecture should the technical lead implement?

  1. A. Select the best current unit prompt as the standard and prohibit business-unit-specific prompt changes.
  2. B. Continue separate prompts but use a model to compare their wording and flag substantial differences weekly.
  3. C. Version a shared core prompt and schema, with bounded unit-specific fields and tested override precedence. (Correct answer)
  4. D. Combine every unit's instructions into one comprehensive prompt and let users specify the desired report type.

Correct answer: C

Explanation: Correct answer (C): A versioned core preserves mandatory disclosures and output contracts, while bounded extension points support legitimate unit terminology and metrics. The key constraint is consistency with controlled customization, not complete uniformity. The underlying principle is separating stable shared instructions from scoped variable content, which enables traceable changes, regression testing, and rollback without creating unmanaged prompt forks. Why the other options are wrong: - Option A: A single locked prompt would reduce drift, but it ignores the stated requirement for distinct business-unit terminology and metrics. - Option B: Drift detection would improve visibility, but it leaves duplicated ownership and inconsistent mandatory behavior as the root architectural problem. - Option D: A comprehensive prompt supports all units centrally, but mixing every unit's instructions increases conflicts and context dilution instead of establishing controlled extension boundaries.

Sample Question 3 — Developer Productivity & Operational Enablement

A platform team has 45 developers contributing to the same monorepo. Developers using Claude-assisted tooling repeatedly provide different build commands, test locations, and pull-request requirements. This has caused generated changes to bypass required integration tests, and new developers need several days to learn the conventions. Some developers also want to retain personal formatting and explanation preferences. Which configuration approach should the architect recommend?

  1. A. Let each developer maintain a complete local instruction file and distribute an example through the onboarding wiki.
  2. B. Store mandatory repository workflows in reviewed, version-controlled project instructions and keep optional personal preferences in user-specific configuration. (Correct answer)
  3. C. Embed all repository and personal instructions in a wrapper script maintained outside the repository by the platform team.
  4. D. Require developers to paste the current contribution guide into every session and review generated changes for missing steps.

Correct answer: B

Explanation: Correct answer (B): The shared, version-controlled instructions establish one durable source for mandatory build, test, and review conventions, while user configuration preserves harmless personalization. The governing constraint is reducing inconsistent changes without eliminating justified individual preferences. The architectural principle is to separate centrally governed project requirements from user-specific settings and manage shared AI configuration as an engineering asset. This matters in production because reviewed, traceable configuration reduces drift, accelerates onboarding, and makes changes to development behavior auditable. Why the other options are wrong: - Option A: Local files support customization, but duplicating mandatory conventions across developers preserves the configuration drift causing the current failures. - Option C: A wrapper can standardize execution, but keeping the instructions outside the repository weakens visibility, version alignment, and normal code-review governance. - Option D: Repeatedly supplying documentation may improve individual sessions, but it creates manual overhead and does not reliably establish a consistent shared baseline.

Sample Question 4 — Developer Productivity & Operational Enablement

A payments company is enabling Claude-assisted development in a repository that contains deployment scripts. The current environment gives the assistant unrestricted shell access and inherits each developer's production credentials. Developers need Claude to inspect source files, edit a working branch, run approved local tests, and query a sanitized test database. Security requires structural prevention of production changes and secret exposure; retaining a command log alone is not sufficient. Which design BEST meets these requirements?

  1. A. Keep unrestricted shell access, add instructions prohibiting production commands, and alert security when sensitive command patterns appear.
  2. B. Run sessions in an isolated workspace with scoped file access, allowlisted test commands, test-only credentials, and no production deployment capability. (Correct answer)
  3. C. Permit read-only production access, block file writes by default, and let developers temporarily enable unrestricted access when implementation begins.
  4. D. Retain developer credentials but require explicit confirmation before every shell command and archive complete session transcripts for audit.

Correct answer: B

Explanation: Correct answer (B): An isolated workspace with narrow file, command, and credential capabilities directly removes the paths to production modification and secret exposure while preserving the required development tasks. The decisive constraint is deterministic prevention rather than detection after an unsafe command. The architectural principle is least privilege enforced at the tool and identity boundaries, not through prompts or logs. This matters because model or user mistakes cannot exercise capabilities that the environment never grants. Why the other options are wrong: - Option A: Prompt restrictions and alerts are useful compensating controls, but unrestricted access leaves the underlying production-change capability available. - Option C: Separating read and write access can reduce risk, but temporary unrestricted access violates the requirement to prevent production access structurally. - Option D: Confirmations and transcripts improve oversight and attribution, but inherited production credentials still expose unnecessary high-impact capabilities and secrets.

Sample Question 5 — Evaluation, Testing & Optimization

A logistics company has completed a proof of concept in which Claude summarizes shipment exceptions for operations staff. Executives describe the results as promising, but operations values completeness, finance prioritizes cost, and support wants responses within 3 seconds. The team has only anecdotal user feedback and wants to begin prompt optimization. What should the architect recommend FIRST?

  1. A. Test several prompt variants with executives and deploy the variant receiving the highest preference score.
  2. B. Define task-level quality, latency, cost, and business-success measures, then establish a reproducible baseline. (Correct answer)
  3. C. Upgrade the model for difficult exceptions and compare its average response quality with the current model.
  4. D. Deploy the proof of concept to a small user group and use complaint volume as the quality metric.

Correct answer: B

Explanation: Correct answer (B): The organization must first define what successful production behavior means and measure the existing system against it. Conflicting stakeholder priorities and the absence of objective evidence make quality, latency, cost, and business-outcome criteria the governing constraints. The architectural principle is to establish an evaluation contract and reproducible baseline before optimization. In production, this makes changes comparable and prevents teams from improving one dimension while unknowingly degrading another. Why the other options are wrong: - Option A: Executive preference testing can reveal useful qualitative feedback, but it does not capture operations completeness, the 3-second requirement, cost, or reproducible task performance. - Option C: A model comparison may eventually be appropriate, but no agreed success criteria exist yet to determine whether the additional capability or cost produces a meaningful improvement. - Option D: A limited deployment can provide production evidence, but complaint volume alone is a lagging and incomplete measure that does not define acceptable quality, latency, or cost.

Sample Question 6 — Evaluation, Testing & Optimization

A payment processor uses Claude to classify 80,000 merchant disputes per day. An evaluation set sampled randomly from historical traffic reports 96% accuracy. However, regulatory-escalation cases represent only 0.4% of traffic, and production reviews show that 18% of those cases are assigned to ordinary support queues. Missing an escalation can trigger reporting violations. Which evaluation change BEST addresses the readiness gap?

  1. A. Increase the random sample until the overall confidence interval becomes narrower, while retaining accuracy as the release metric.
  2. B. Use a more capable model on every case and compare its overall accuracy against the current production baseline.
  3. C. Ask reviewers to examine only the model outputs with low self-reported confidence before each release.
  4. D. Add stratified escalation examples and difficult negatives, then enforce a separate error threshold for that class. (Correct answer)

Correct answer: D

Explanation: Correct answer (D): The rare class carries disproportionate regulatory risk and is too sparse for aggregate accuracy to establish readiness. Stratified examples, difficult negatives, and a class-specific threshold directly measure the consequential failure. The architectural principle is that evaluation coverage and release criteria should reflect error impact as well as production frequency. This matters because a system can appear strong globally while remaining unsafe for a small but critical segment. Why the other options are wrong: - Option A: A larger random sample improves statistical precision, but regulatory cases remain rare and their unacceptable error rate can still be obscured by overall accuracy. - Option B: A stronger model could improve classification, but changing models before measuring the critical segment does not establish whether the regulatory failure is resolved. - Option C: Targeted human review can be useful, but model self-reported confidence is not necessarily calibrated and may fail to identify confidently incorrect escalations.

Sample Question 7 — Governance, Safety & Risk Management

A manufacturer uses Claude to process vendor emails and attachments. The agent extracts shipment changes and can update purchase orders through an ERP tool. During testing, a PDF containing hidden instructions caused the agent to replace a supplier's bank account. The workflow must continue processing 8,000 messages daily, but payment-related changes require procurement approval. Which redesign BEST addresses the root risk?

  1. A. Add stronger system instructions, scan attachments for injection phrases, and alert security when suspicious text is found.
  2. B. Use a more capable model to classify attachment instructions and retain the existing ERP permissions for operational continuity.
  3. C. Separate extraction from execution, expose narrowly scoped ERP operations, and require procurement approval for payment-related changes. (Correct answer)
  4. D. Run the agent with its current permissions in a sandboxed network and retain complete tool-call traces for investigation.

Correct answer: C

Explanation: Correct answer (C): Separating untrusted-content interpretation from privileged execution prevents an attachment from becoming an authority for tool use. Narrow ERP operations reduce excessive agency, while the approval gate enforces the stated requirement for payment-related changes. This applies the principles of least privilege and deterministic control at a trust boundary, which reduce the blast radius of prompt injection in production. Why the other options are wrong: - Option A: An architect might add detection and stronger instructions as defense-in-depth, but these probabilistic controls do not prevent missed injection content from invoking a privileged ERP operation. - Option B: A stronger model might identify more malicious instructions, but model capability does not eliminate the trust-boundary problem or excessive permissions. - Option D: Sandboxing and tracing can limit network exposure and support investigation, but they do not prevent the agent from making an authorized yet fraudulent ERP change.

Sample Question 8 — Governance, Safety & Risk Management

A consulting firm's assistant retrieves confidential engagement documents and can also query a third-party web search service. Logs show that Claude sometimes includes client names, unreleased acquisition details, and internal document excerpts in search queries. Employees still need current public research, and the search provider is not approved to process client-confidential data. Which control BEST prevents this disclosure?

  1. A. Encrypt search requests in transit and require the search provider to rotate its transport certificates more frequently.
  2. B. Route outbound searches through a policy gateway that constructs minimized queries and blocks confidential entities and retrieved excerpts. (Correct answer)
  3. C. Store complete outbound queries in an immutable audit system and review a statistically representative sample each week.
  4. D. Replace external search with a larger internal vector index populated by quarterly snapshots of selected public websites.

Correct answer: B

Explanation: Correct answer (B): A policy gateway controls the point where data crosses into the unapproved external service. Constructing purpose-limited queries and blocking confidential content directly prevents disclosure while preserving public research. The governing principle is data minimization across trust boundaries, which matters because encryption protects transmission but does not make the recipient authorized to receive the data. Why the other options are wrong: - Option A: Encryption is necessary for secure transport, but the scenario prohibits the provider from receiving confidential data at all; encrypted disclosure remains disclosure. - Option C: Immutable logs improve accountability and may reveal recurring leakage, but weekly review detects the problem only after sensitive information has left the organization. - Option D: An internal public-data index avoids the third-party boundary, but quarterly snapshots fail the stated need for current web research and create a separate content-maintenance burden.

Sample Question 9 — Integration

A telecommunications provider is deploying a Claude-based service agent that reads account history and issues refunds. Routine refunds below $50 may be automated, but larger refunds require supervisor approval. The prototype uses one account-management tool that can update plans, change addresses, close accounts, and issue refunds of any amount. All calls are logged, and the team proposes instructing Claude to use only the refund operation. Which change BEST addresses the production risk while preserving routine automation?

  1. A. Retain the account-management tool, add anomaly alerts, and review unusual actions after each shift.
  2. B. Replace it with read-only account access and a narrow refund tool that enforces amount limits and approval tokens. (Correct answer)
  3. C. Retain the account-management tool, strengthen its system instructions, and require Claude to explain each action.
  4. D. Send every proposed account action to a supervisor before allowing any tool invocation to execute.

Correct answer: B

Explanation: Correct answer (B): The narrow refund tool is best because the agent needs automated access only to low-value refunds, while larger refunds require approval. Enforcing operation and amount boundaries in trusted code applies least privilege and keeps authorization outside the model. This prevents unauthorized actions rather than merely detecting them, while avoiding unnecessary review of permitted routine refunds. Why the other options are wrong: - Option A: An architect might add alerts for accountability, but post-action detection does not remove the agent's ability to close accounts or issue excessive refunds. - Option C: Stronger instructions and explanations may improve behavior and auditability, but they are not deterministic controls over the broad administrative capability. - Option D: Universal approval would control risk, but the scenario explicitly permits automated refunds below $50, making this operationally excessive.

Sample Question 10 — Integration

An online marketplace classifies 120,000 support tickets daily. A lower-cost Claude configuration meets the 1.5-second SLA and achieves 96% overall routing accuracy, but reaches only 88% on the 3% of tickets involving account takeover. A more capable configuration reaches 98% on that segment but doubles average latency and triples total inference cost. The business requires at least 97% accuracy for account-takeover tickets while holding total cost near the current budget. What should the architect recommend?

  1. A. Use the more capable configuration for every ticket and offset its cost by reducing operational logging.
  2. B. Keep the lower-cost configuration for every ticket and add a second identical classification call when confidence is low.
  3. C. Route likely account-takeover or ambiguous tickets to the more capable configuration and evaluate routing misses separately. (Correct answer)
  4. D. Run both configurations for every ticket and use a third model to resolve classifications on which they disagree.

Correct answer: C

Explanation: Correct answer (C): Selective escalation concentrates additional capability and cost on the small segment with the stringent quality requirement. The architecture must also evaluate missed high-risk cases because routing quality governs whether escalation works. This risk-based segmentation balances correctness, latency, and cost more effectively than applying expensive processing to the entire workload. Why the other options are wrong: - Option A: A universal upgrade would improve the high-risk segment, but it violates the stated cost and latency constraints, while reducing logging weakens operations. - Option B: A repeated call may help with stochastic errors, but no evidence shows that the lower-cost configuration can reach the required high-risk accuracy. - Option D: Ensembling is technically viable for difficult cases, but three calls on every ticket add unnecessary latency and cost to the low-risk majority.

Keep Practicing

Ready for more? The full CCAR-P practice test hub has 200+ questions with per-domain drilling: Integration, Solution Design & Architecture, Evaluation, Testing & Optimization, Governance, Safety & Risk Management, Stakeholder Communication & Lifecycle Management, Claude Models, Prompting & Context Engineering, and Developer Productivity & Operational Enablement.