Practice — CCAR-P Domain 5: Governance, Safety & Risk Management (14%)
13 scenario-based MCQs. Answer key + explanations at the bottom.
Q1
A steering committee asks how Anthropic itself gates the release of increasingly capable models, independent of anything your team builds on top. Which statement best describes the Responsible Scaling Policy (RSP)?
A. A runtime moderation layer that customers enable per request to block harmful outputs B. A certification program that audits customer applications before they reach production C. A published commitment to evaluate models for dangerous capabilities (bio, cyber, autonomy) before deployment, with mitigations gated by capability level D. A contractual service-level agreement guaranteeing that production models will refuse every category of harmful request without exception
Q2
You are reviewing three proposed Claude deployments: (1) a consumer assistant serving EU residents, (2) a claims summarizer over US patient health records, (3) a document workflow for a US federal agency running in the cloud. Which mapping of primary compliance regime to deployment is correct?
A. GDPR governs (1), HIPAA governs (2), FedRAMP governs (3) B. GDPR governs (2), FedRAMP governs (1), HIPAA governs (3) C. HIPAA governs (1), GDPR governs (3), FedRAMP governs (2) D. FedRAMP governs (1), HIPAA governs (2), GDPR governs (3)
Q3
A support assistant for EU consumers logs every request — full transcripts, tool-call arguments and results, token usage — retained indefinitely for observability. Legal flags GDPR exposure. Which approach best reconciles auditability with data protection?
A. Disable transcript and tool-call logging entirely, guaranteeing that no personal data is ever retained anywhere in the observability stack or its backups B. Pseudonymize or redact personal data in logs and set retention limits, keeping the IDs and provenance needed to trace any decision to its source C. Keep the full logs unchanged but restrict dashboard access to members of the compliance team only D. Relocate log storage to a US region on the theory that EU data-protection obligations stop applying to the data
Q4
A hospital deploys Claude to draft discharge instructions from patient records. The clinical safety board requires that no model-generated guidance reach a patient unvalidated. Which human-in-the-loop design satisfies this constraint with the least disruption?
A. Sample 10% of generated instructions for retrospective quality audit each week B. Add a second Claude pass that critiques and revises each draft against a clinical rubric before sending C. Require patients to acknowledge a disclaimer stating that the content is AI-generated D. Insert a clinician review-and-approve gate between generation and delivery
Q5
During a governance review, a stakeholder asks what "Constitutional AI" actually is. Which answer is accurate?
A. A training technique in which the model critiques and revises its own outputs against written principles, generating RLAIF data B. A runtime moderation filter that intercepts and blocks any output violating a customer-configurable policy document attached to each API request C. A regulatory framework that certifies models as compliant with international human-rights law before sale D. A system-prompt template that customers must include in requests to activate Claude's safety behavior
Q6
A RAG-based policy assistant for a bank occasionally states customer benefits that don't exist in the retrieved documents. Compliance labels this hallucination the top deployment risk. Which guardrail most directly addresses it?
A. Increase top-K so that more chunks from the corpus are retrieved on every query B. Switch to a larger, more capable model whose general knowledge covers the bank's policies C. Add grounding instructions — answer only from <context>, say "I can't find that" when absent, and cite quoted sources D. Append a standing disclaimer to every answer stating that the information provided may be inaccurate and should be verified against official policy documents
Q7
A security review of an internal agent finds 22 connected tools — including ticket deletion and payroll write access — though the agent's job is answering HR policy questions. Which risk assessment is most accurate?
A. Low risk — the model simply ignores tools it doesn't need, so unused capabilities add no exposure B. High risk — every capability the agent carries is added attack surface and context cost, so the tool set should be pruned to what the job requires C. Low risk, provided the system prompt contains an explicit instruction never to invoke the destructive tools D. High risk, best mitigated by wrapping all 22 tools behind a single meta-tool dispatcher so the agent sees one clean interface instead of twenty-two separate schemas
Q8
To increase throughput, an ops team replaces human confirmation on a terminate_instance tool with a second Claude instance that reviews each call and auto-approves it when it looks safe. What is the strongest objection?
A. The reviewing model adds latency to every call that outweighs any safety benefit gained B. Two Claude instances cannot participate in the same request pipeline without shared mutable state C. The reviewer must be a larger, more capable model than the actor, since a same-size reviewer cannot be trusted to catch the acting model's mistakes D. LLM verification does not replace human consent for destructive, side-effecting actions, and the two models can fail in correlated ways
Q9
A regulator-facing architecture document must explain how your agentic underwriting assistant meets transparency obligations. Which combination is strongest?
A. Surface the agent's planning steps, and log every tool call with source provenance so any decision can be traced back to its source data B. Publish the assistant's full system prompt and sampling parameters on the company's public website C. State that Claude was trained with Constitutional AI, which guarantees that every decision it makes is inherently explainable D. Provide token-usage and latency dashboards demonstrating the operational health of the deployment
Q10
An agent platform runs two workloads: (1) drafting internal meeting summaries and (2) issuing customer refunds through a payment tool. Throughput matters for both. Which allocation of human oversight is best?
A. Pre-execution confirmation gates on both workloads, since applying one consistent oversight standard simplifies governance and audit across the platform B. Post-hoc sampled review on both workloads so that neither pipeline blocks on a human C. Pre-execution confirmation for the refund tool's side-effecting calls; sampled post-hoc review for the low-risk summaries D. A second-model critique loop on refund calls and no human oversight on either workload
Q11
A financial-services team bulk-extracts loan terms from contracts. Auditors must be able to verify any extracted value against the source contract months later. Which design meets this requirement most directly?
A. Store the model's complete raw responses alongside the extracted values in the data warehouse so auditors can reread the original outputs later B. Have a human re-key a random 5% of the extractions each month as a spot-check control C. Log token usage, model version, and request IDs for every extraction call in the pipeline D. Require a source pointer field for every extracted value in the schema, tagging each fact with provenance
Q12
After a risk review, a team appends 40 "NEVER" rules to a support assistant's system prompt. Refusals of legitimate, in-scope requests rise sharply — yet a few prohibited behaviors still slip through. What best explains the outcome?
A. The model treats NEVER rules as suggestions unless they are repeated in every user turn B. Many same-priority conditional rules dilute one another; the prompt should be restructured around fewer principles with criticals at the ends C. The model is too small to hold 40 rules in attention, and upgrading to a larger model resolves both symptoms D. Refusal rates rise proportionally with system-prompt length, so any prompt this long produces over-refusal
Q13
A loan-triage classifier shows lower routing accuracy for applications from one customer segment. The team wants to manage this fairness risk on an ongoing basis. Which approach is most defensible?
A. Remove the segment attribute from all inputs so the model can no longer see it B. Rely on the model's safety training to prevent biased outputs across segments C. Build an eval set with per-segment slices, compare every prompt or architecture change against it, and track per-slice regressions D. Add a system-prompt line explicitly instructing the model to treat every customer segment identically when routing loan applications
Answers
Q1: C. The RSP is Anthropic's published commitment to evaluate models for dangerous capabilities (bio, cyber, autonomy) before deployment, with mitigations gated by capability level. (A) confuses a lab-level scaling policy with a runtime product feature. (B) is wrong because the RSP governs Anthropic's models, not customer applications. (D) invents a contractual guarantee — no such refusal SLA exists, and HHH explicitly balances refusing harm against over-refusal.
Q2: A. GDPR is EU data protection, so it governs the assistant serving EU residents; HIPAA is US health-data law, so it governs the patient-records summarizer; FedRAMP is US federal cloud authorization, so it governs the agency workload. The exam tests exactly this regime-to-deployment matching plus its architectural consequence. Every other option scrambles at least two mappings.
Q3: B. Pseudonymization/redaction plus retention limits reduces personal-data exposure while preserving the audit property that a regulator can trace any decision back to source data. (A) destroys auditability entirely — observability requires logging tool calls and IDs. (C) leaves the underlying retention problem untouched; access control is not data minimization. (D) is a misconception — GDPR follows the EU data subjects, not the storage region.
Q4: D. The board's constraint is that nothing unvalidated reaches a patient, which only a pre-delivery human review gate satisfies; this is the canonical confirmation-gate placement for high-stakes output. (A) is post-hoc — unvalidated instructions still reach patients before the sample is audited. (B) is an evaluator-optimizer loop, useful for quality but not human validation. (C) shifts risk to the patient instead of removing it.
Q5: A. Constitutional AI is a training technique: the model critiques and revises its outputs against a written constitution, and those pairs become RLAIF training data. (B) is the common runtime-filter misconception — CAI happens at training time, not inference time. (C) confuses the constitution's sources (e.g., the UN Declaration) with legal certification. (D) is false; the behavior is baked into the model, not activated by a prompt.
Q6: C. Grounding instructions — answer only from <context>, explicit "I can't find that" fallback, quote and cite sources — are the documented guardrail that dramatically reduces RAG hallucination, and citations make violations detectable. (A) adds recall but does nothing to stop the model using prior knowledge. (B) makes ungrounded answers more fluent, not more grounded. (D) is transparency theater — it discloses risk without reducing it.
Q7: B. Capability bloat is a first-class risk: every tool the agent carries is attack surface and context cost, so surface area should be pruned to the job. (A) is the key misconception — connected authority is exposure whether or not it's normally used. (C) treats prompt text as a security boundary; instructions are not authorization controls. (D) hides the tools behind an interface without reducing the agent's actual authority.
Q8: D. Destructive, side-effecting operations require host-level human confirmation; a second LLM can complement but not replace that consent, and both models can fail on the same adversarial or ambiguous input. (A) is a real cost but not the governance objection. (B) is factually wrong. (C) encodes the misconception that model size confers verification validity — the flaw is the missing human, not the reviewer's scale.
Q9: A. Transparency for an agentic system combines the agent principle of surfacing planning steps with audit-friendly observability — logging tool calls and provenance so a regulator can trace any decision to its source data. (B) discloses configuration, not decisions, and creates its own exposure. (C) is a misconception: Constitutional AI is a training technique, not an explainability guarantee. (D) shows operational health, which says nothing about how decisions were made.
Q10: C. Oversight should be proportional to the action profile: refunds are side-effecting and irreversible, so they need pre-execution confirmation; internal summaries are low-risk, so sampled post-hoc review preserves throughput. (A) burns human attention gating harmless drafts. (B) lets unconfirmed refunds execute — audit after the money moves. (D) substitutes LLM critique for human consent exactly where consent is required.
Q11: D. Provenance in the schema — a required source pointer paired with every extracted value — is the documented pattern for auditable extraction, letting any value be verified against its exact source. (A) keeps outputs but doesn't link a value to where in the contract it came from. (B) is a sampling control, not the ability to verify any value. (C) is operational metadata that traces calls, not facts.
Q12: B. This is dilution: dozens of same-priority conditionals lower the weight of each rule, producing over-refusal on legitimate traffic while genuinely critical rules still get missed. The fix is principles over conditionals, criticals at top and end, and splitting into specialized prompts if conditionals keep proliferating. (A) and (D) are invented mechanics. (C) is the model-size band-aid — the root cause is prompt architecture.
Q13: C. Fairness risk is managed with segmented evaluation: per-slice eval sets, side-by-side comparison of every change, and regression tracking — because a change that improves one input class can hurt another. (A) is fairness-through-unawareness; it removes visibility without removing the accuracy disparity and breaks measurement. (B) confuses model-level safety training with application-level fairness obligations. (D) is a prompt placebo with no measurement attached.