Anthropic CCAR-P Claude Certified Architect - Professional Exam Practice Test

The workflow must first identify where human judgment is necessary. Option E applies risk-based oversight by examining each decision’s impact and reversibility. High-impact, irreversible, externally binding, privacy-sensitive, or legally consequential actions require stronger review than low-risk draft generation or easily reversible recommendations.

After locating those control points, Option A defines how work reaches reviewers. The sampling strategy should specify whether review is universal, random, risk-triggered, confidence-based, or stratified. Escalation criteria should cover policy violations, uncertain outputs, conflicting evidence, sensitive data, failed validation, and cases exceeding the reviewer’s authority.

Anthropic recommends human confirmation for decisions with meaningful real-world consequences and actions requiring affirmative consent. Computer Use Security Considerations

Option B necessarily follows the pilot because findings must exist before design iteration. Reviewer onboarding and operational documentation in Options C and D are important readiness activities, but they follow the core design decisions being tested by this item: where oversight is required and how cases are sampled and escalated.

The completed pilot plan should subsequently include trained reviewers, documented procedures, queue capacity, SLAs, audit evidence, and measured inter-reviewer agreement.

Study Guide references/topics: Human-in-the-loop design; impact and reversibility; oversight points; sampling; escalation criteria; consequential decisions.

===============

An ethics review must examine unsupported generalizations, stereotyping, disparate treatment, and other conclusions about people that are not justified by the evidence. It must also preserve identifiable human accountability for consequential decisions; responsibility cannot be transferred to a probabilistic system. Licensing is a legal and commercial-control question, while latency and throughput are operational requirements. Both remain important, but neither is the central ethical test presented here. Restricting review to low-confidence or threshold-triggering outputs is also inadequate because models can express harmful or biased conclusions with high confidence. Ethical review should cover representative populations, protected and intersectional groups, high-impact outcomes, override mechanisms, transparency, and channels for challenge or appeal.

Study Guide references/topics: Bias and unsupported generalization; human accountability; consequential decisions; ethical oversight.

Model Stage, Post-Processing, Post-Processing, Model Stage, Pre-Processing, Pre-Processing

Pre-processing prepares source material before Claude receives it. Optical character recognition converts scanned invoice images into machine-readable text. Because PII redaction is explicitly performed before model invocation, it also belongs in pre-processing. Additional activities at this layer can include file validation, malware scanning, normalization, page separation, and metadata extraction.

The model stage contains tasks requiring Claude’s language-understanding capability. Classifying the invoice type involves interpreting textual and contextual features, while extracting structured invoice fields requires mapping unstructured content into defined business attributes.

Post-processing verifies and commits the model’s result. Schema validation confirms that required fields exist, data types are correct, enumerated values are permitted, and structural constraints are satisfied. Persistence must occur only after validation and any required human review because the system of record should not receive malformed or unapproved model output.

This decomposition separates probabilistic inference from deterministic processing. OCR, redaction, validation, and persistence do not need to be delegated to Claude when conventional components can execute them more predictably. The resulting architecture reduces model workload, strengthens privacy controls, improves auditability, and prevents unvalidated output from directly changing authoritative records.

Study Guide references/topics: Task decomposition; pre-processing; model inference; post-processing; deterministic validation; privacy-by-design; system-of-record protection.

===============

Documentation remains grounded only when the generating agent can inspect the authoritative implementation. A purpose-built subagent should receive scoped filesystem and code-search capabilities, identify the relevant modules, interfaces, configuration files, tests, and call sites, and generate documentation from that evidence. This approach minimizes reliance on training-data recall, which cannot represent the repository’s current private code or recent changes.

Subagents are useful because repository exploration occurs in their own context, allowing them to return focused findings or proposed edits without filling the main conversation with every file read. Their tool access should follow least privilege: read access to required paths, narrowly controlled write access, and explicit exclusions for secrets or unrelated repositories.

Generated documentation should enter the team’s established change-control process as a patch, branch, or pull request. Normal review, automated checks, link validation, example execution, and human approval provide accountability and prevent unverified material from being published. Direct publication bypasses these safeguards, while disabling repository tools makes factual grounding impossible.

Study Guide references/topics: [Claude Code custom subagents](https://docs.anthropic.com/en/docs/claude-code/sub-agents); [codebase exploration workflows] (https://docs.anthropic.com/en/docs/claude-code/common-workflows); source-grounded generation; least-privilege tools; human review and lifecycle controls.

The observed failure is a groundedness defect: the response contains claims that cannot be traced to retrieved evidence. Option A directly constrains generation to the supplied sources, requires visible attribution, and verifies that each material claim has supporting text. Unsupported claims should be removed, qualified, or replaced with an explicit statement that the available sources are insufficient. Regression evaluation in Option B may detect the failure but does not itself prevent unsupported claims. OAuth addresses identity and authorization, while input classifiers address malicious or unsafe retrieved content; neither verifies factual support. Anthropic recommends citations, supporting quotations, and post-generation claim verification to reduce hallucinations in document-grounded applications. Reducing hallucinations

A complete handoff package must help different stakeholders understand, operate, troubleshoot, and evolve the Claude-based solution. An architecture overview explains the system’s structure and responsibilities, while Architecture Decision Records document important decisions, alternatives, and trade-offs. Component-level diagrams provide implementation context without forcing maintainers to reconstruct dependencies from source code. Operational runbooks and an on-call playbook enable reliable incident detection, diagnosis, escalation, and recovery. Documenting known limitations is particularly important for Claude applications because model behavior can vary with prompts, context, input distribution, and external dependencies. Options B, C, and D each provide only a partial or temporary understanding of the system. They would create knowledge gaps, increase operational risk, and make future maintenance dependent on individuals rather than durable organizational documentation.

================

A clearly defined closed-set classification task should begin with a concise zero-shot prompt containing the permitted categories, unambiguous category descriptions, and the required output structure. This provides a simple, inexpensive baseline that can be measured against a representative evaluation set. Chain-of-thought prompting adds unnecessary latency and token usage when the routing decision does not require substantive multi-step reasoning. Permitting Claude to invent categories would violate the closed-set contract and complicate downstream automation. Omitting descriptions would increase ambiguity among potentially overlapping labels. If evaluation later reveals persistent confusion between particular categories, the architect can introduce targeted examples or refine the definitions. Prompt complexity should be added in response to measured failure patterns, not assumed to be necessary before establishing baseline performance. Anthropic: Prompt engineering overview

================

The interaction model and portability requirement are architectural decision drivers. MCP is appropriate when tools or data sources must be exposed through a standardized interface reusable across compatible AI clients. Direct API integration is often preferable for a narrow, stateless, latency-sensitive call where the application already owns the integration logic. Agent-to-agent handoff is better suited to stateful or longer-running delegation between independently responsible agents. Documentation quality and team familiarity influence implementation effort but do not determine the correct integration pattern. Encryption in transit is a mandatory security property for production integration rather than a differentiating architectural requirement; each viable approach must provide it. Anthropic distinguishes direct Messages access from stateful managed-agent infrastructure, while MCP supplies a standardized tool integration layer. Claude Platform documentation

Tool Search applies progressive discovery to a large tool catalog. Instead of inserting every MCP tool’s complete JSON schema and description into the initial context, Claude receives limited discovery information and loads the full definitions only when a task requires them. This preserves the available context for instructions, repository content, conversation history, and tool results without removing the underlying capabilities.

Anthropic’s Claude Code documentation states that Tool Search keeps MCP context usage low by deferring tool definitions until Claude needs them. Only the tools actually selected enter the working context. Claude Code MCP Tool Search

Anthropic’s advanced-tool-use guidance also describes conventional multi-server configurations consuming tens of thousands of tokens before work begins, while on-demand discovery substantially reduces that overhead. Advanced Tool Use

Option B solves context pressure by destroying required functionality. Option C worsens the constraint by adding more prompt tokens. Option D expands the exact source of context bloat.

The team should also improve server and tool descriptions so discovery returns the correct tools, monitor tool-selection quality, and keep frequently required foundational tools non-deferred only when evaluations justify the additional context cost.

Study Guide references/topics: MCP scaling; Tool Search; progressive discovery; deferred schemas; context-budget management; tool-selection accuracy.

===============

Statement 1 measures efficiency because the same operating unit—one procurement analyst—now processes three times as many purchase orders per day. It reflects increased throughput and reduced effort per transaction within the existing procurement process.

Statement 2 represents transformation. The organization has not merely accelerated manual data entry; it has eliminated that role from the workflow and redirected employees toward higher-value vendor relationship management. This is a structural redesign of responsibilities and operating practices.

Statement 3 is a solution-cost issue because the measured API integration expense exceeds the approved per-transaction financial model by 40%. The architect must investigate token consumption, model routing, caching, retrieval overhead, tool calls, and integration charges while protecting the required quality level.

Statement 4 directly concerns the performance SLA. The observed 11-second latency is compared with an explicit contractual or operational target of five seconds. This is not simply an efficiency complaint; it is a measurable breach of a defined service-level commitment.

The architect should map each stakeholder statement to its dominant value pillar before recommending remediation because throughput, organizational transformation, cost control, and SLA compliance require different architectural responses.

Study Guide references/topics: Business-value pillars; efficiency; transformation; solution cost; performance SLAs; stakeholder-outcome classification.

===============

The assistant is making recommendations without considering information that specialists regard as material. That is a direct input-scope and requirements gap, not merely a presentation issue. The 89 percent acceptance metric is also incomplete because initial acceptance does not reveal whether recommendations remain correct after users apply the omitted criteria. Production readiness requires outcome-focused evaluation, including final recommendation agreement, override reasons, financial impact, supplier risk, and performance across representative procurement scenarios. Options B and E raise possible concerns, but the scenario supplies no evidence that response rate or pilot duration is the demonstrated deficiency. Option A incorrectly treats a single proxy metric as sufficient. Anthropic recommends multidimensional, task-specific success criteria aligned with the actual user outcome. Define success criteria and evaluations

Authorization must be enforced before restricted information enters model context. The retrieval service should authenticate the user, resolve role and document permissions, and filter candidate records before prompt construction. This prevents unauthorized content from appearing in prompts, model traces, cached context, tool results, or generated responses. A system-prompt instruction is behavioral guidance, not an enforceable access-control boundary. Post-generation filtering is also inadequate because the model has already received and processed the restricted data, creating exposure through output, logging, or indirect inference. Relying on general refusal behavior provides no deterministic authorization. The correct architecture treats RBAC as an application and data-layer control, with the model receiving only information the requesting principal is entitled to access.

Study Guide references/topics: Retrieval-layer RBAC; authorization before inference; least privilege; sensitive-context isolation.

A project-scoped CLAUDE.md converts repeatedly supplied information into persistent, version-controlled context. Claude Code loads applicable CLAUDE.md instructions at session initialization, allowing architecture principles, coding conventions, build commands, repository structure, and verification requirements to be shared consistently across engineers. Anthropic explicitly recommends using CLAUDE.md for information that developers would otherwise explain repeatedly; concise and specific instructions provide stronger adherence. Committing the file also enables normal review and change-control practices. Option C reduces typing speed but preserves the underlying waste and inconsistency. Options A and D remove useful capability or governance rather than correcting the workflow. The implementation should periodically review the file for obsolete, conflicting, or unnecessarily verbose instructions.

Study Guide references/topics: Claude Code project memory; CLAUDE.md; persistent context; repository conventions; workflow standardization.

The strongest investigation combines configuration comparison with controlled replay. Comparing the current system prompt and output-schema settings against the last known good version identifies maintenance-related configuration drift. Relevant differences include removed formatting instructions, altered schema requirements, incompatible parser expectations, changed stop sequences, or a disabled structured-output mechanism.

Replaying known premaintenance requests against the current configuration creates a controlled test set. Inspecting the raw response before parsing then establishes whether malformed JSON originates in model generation or is introduced by streaming assembly, transport handling, post-processing, or the downstream parser. If the raw response is valid but the pipeline rejects it, the fault lies after generation. If the raw response is malformed, the prompt, schema enforcement, stop reason, and request configuration become the primary investigation targets.

Clearing the prompt cache assumes cache corruption without evidence. Changing model tiers introduces another variable and weakens causal attribution. Raising `max_tokens` is appropriate only when raw responses show truncation and the returned stop reason indicates the token limit was reached; it is not the most direct initial test.

Study Guide references/topics: [Increasing output consistency](https://docs.anthropic.com/en/docs/test-and-evaluate/strengthen-guardrails/increase-consistency); [agent evaluation methodology] (https://www.anthropic.com/engineering/demystifying-evals-for-ai-agents); regression replay; last-known-good comparison; raw-output inspection.

===============

Least privilege means granting the exact capabilities required for the defined responsibility—no more and no less. Option B permits the assistant to read the approved knowledge base and write only to the draft queue. Enforcing the allow-list at the orchestration layer creates a deterministic authorization boundary outside the model’s prompt and reasoning.

The rule should also be role-specific so different users or operational roles receive only the tools and data scopes they require. The knowledge-base tool should remain read-only, while the draft-queue tool should be restricted to draft creation rather than external sending, approval, or production publication.

Option A exposes every globally readable tool, creating unnecessary access to unrelated information. Option C relies on voluntary model behavior instead of enforceable authorization. A mistaken tool selection or successful prompt injection could therefore invoke an inappropriate capability. Option D minimizes permissions by eliminating the assistant’s required functionality and is not a viable least-privilege implementation.

Anthropic’s permission guidance distinguishes allow, ask, and deny rules and confirms that these controls are enforced by Claude Code rather than by model instructions. Configure Permissions

Study Guide references/topics: Least privilege; per-role authorization; orchestration-layer enforcement; capability scoping; read/write separation; tool allow-lists.

===============

Claude Code permission decisions can be affected by multiple configuration scopes. The appropriate diagnostic action is to inspect the effective rules and identify the exact deny pattern. Managed policy has the highest precedence, and a deny rule from any applicable scope cannot be overridden by an allow rule elsewhere. The architect must then determine whether the denial represents an intentional security boundary or an incorrectly scoped rule. If correction is justified, only the specific rule should be amended. Repeated retries cannot change a deterministic permission decision. Disabling permissions or granting unrestricted Bash access removes safeguards far beyond the reported problem and violates least privilege. Anthropic’s permission documentation explicitly describes scope precedence and deny-first evaluation. Claude Code permissions

Options A and B describe model-specific behavioral risks. An overly broad safety response is a false positive caused by how the language model interprets contextual or surface-level signals. A plausible but unsupported answer is a hallucination: the generated statement appears credible but lacks grounding in the retrieved evidence. Anthropic recommends grounding factual responses in source material, requiring citations, allowing Claude to express uncertainty, and verifying generated claims. Options C, D, and E are conventional infrastructure or application failures involving certificates, routing, and database connectivity. They can occur in systems that do not use an LLM and should be addressed through standard monitoring, configuration management, retry policies, and operational testing. Anthropic: Reduce hallucinations

================

Project-scope configuration is appropriate for shared MCP definitions, permissions, hooks, and other repository-specific behavior that every team member should receive consistently. Managed configuration complements this by enforcing organization-wide security and compliance requirements that individual developers cannot override. Together, these mechanisms separate collaborative project configuration from centrally controlled policy. Editor themes are personal preferences and do not materially establish a secure environment. Allowing each engineer to select an arbitrary model can undermine consistency when model choice affects behavior, cost, or approved-use requirements. Storing a shared API key in a committed project file is a serious credential-management failure. Claude Code documentation identifies .claude/settings.json as the shared project file and managed settings as the highest-precedence organizational policy layer. Claude Code: Settings files and precedence

================

User scope applies to one engineer across every project and is therefore appropriate for portable personal preferences. Option A fits this definition because an interface theme belongs to the individual rather than to a repository or organization. Option B also fits because Claude Code provides a language setting for the preferred response language, and placing that preference in user scope makes it apply across repositories.

Option C requires managed configuration because an organization-wide security control must be centrally deployed and resistant to individual override. Option D belongs in project scope because repository-specific MCP endpoints must be shared consistently with that repository’s contributors.

Option E describes credential handling rather than merely a preference assignment. Credentials must not be placed in a repository, but avoiding version control alone is insufficient. They must be stored through a supported secure authentication mechanism, protected environment configuration, operating-system credential facility, or approved secrets manager—not inserted as plaintext into an ordinary settings file.

Anthropic defines user scope as affecting one user across all projects, project scope as shared repository configuration, and managed scope as the location for enforceable organizational controls. It also explicitly lists themes and other personal settings as user-scope use cases. Claude Code Configuration Scopes

Study Guide references/topics: User scope; project scope; managed configuration; personal preferences; repository-shared MCP configuration; credential protection.

===============

A delivery team needs implementation-level direction rather than an executive architecture summary. Component responsibilities establish ownership and boundaries, while interface contracts define schemas, accepted inputs, outputs, errors, and behavioral expectations. Sequence diagrams show how components interact across dominant and failure flows. Configuration tables with defaults prevent inconsistent assumptions between environments. Operational runbooks ensure that deployment, recovery, monitoring, and routine maintenance are addressed during implementation rather than improvised after release. Options B, C, and D omit one or more elements required to translate architectural intent into a buildable and supportable system. The guide should enable normal delivery work without continuous dependence on undocumented knowledge held by the architect.

Study Guide references/topics: Implementation documentation; component contracts; sequence diagrams; configuration management; operational readiness.

An actionable runbook must connect detection, diagnosis, containment, recovery, and escalation. Option B supplies that complete operational chain: alerts identify abnormal conditions; triage procedures guide initial investigation; dashboards and logs provide evidence; escalation paths assign authority; and rollback procedures restore a known-safe state. The runbook should cover model errors, latency degradation, rate limits, tool failures, prompt regressions, cost anomalies, data-governance events, and dependency outages. Anthropic’s operational materials demonstrate incident workflows in which alerts lead responders to logs and runbooks before corrective action. Options A, C, and D each omit information required for an on-call engineer to progress from notification to controlled resolution. Procedures should be tested through exercises and updated after incidents.

Study Guide references/topics: Claude operational and observability patterns; incident response; triage; escalation; rollback; operational readiness.

Robust guardrails require both preventive enforcement and continuous empirical validation. Per-role tool allow-lists satisfy the preventive requirement by restricting each authenticated role to explicitly authorized tools. Enforcement must occur in the orchestration or permission layer before execution; relying on the model to decide whether a tool call is authorized is not an adequate security boundary. Anthropic recommends allow-list-based validation and provides permission rules and pre-tool-use controls capable of denying calls before they execute.

Adversarial evaluation with regression tracking supplies the validation component. The evaluation set should include prompt injections, indirect injections, encoded instructions, multi-turn escalation, role-confusion attempts, and requests designed to trigger unauthorized tool use. Guardrail performance must then be measured across releases so that changes to prompts, models, tools, or orchestration logic do not silently reduce protection.

Centralized logging and user feedback are useful detective and lifecycle controls, but neither prevents an unsafe action nor proves guardrail effectiveness. Periodically refreshing refusal wording is also insufficient unless the revised behavior is evaluated against defined safety criteria. The strongest design therefore combines deterministic authorization with adversarial regression testing.

Study Guide references/topics: Claude Code permissions and pre-tool enforcement; tool allow-list guidance; adversarial evaluations; regression testing; least-privilege orchestration.

===============

Function-level or section-level chunking for code modules — Code or Hierarchical Specifications

Tree-aware chunking that follows code or specification hierarchy — Code or Hierarchical Specifications

Per-record chunking where each record is one chunk — Heterogeneous Short Records

Semantic chunking along clause or paragraph boundaries — Long Structured Documents

Fixed-size chunking with overlap for short records of similar length — Heterogeneous Short Records

Hierarchical chunking that mirrors document section structure — Long Structured Documents

Chunking must preserve the structural unit that carries meaning in the source corpus. Code and hierarchical specifications are best divided at function, module, class, or tree boundaries because arbitrary token cuts can separate definitions from their implementation or parent context. Heterogeneous short-record collections should generally preserve each record as an independent chunk. Fixed-size overlapping chunks are also effective when records have broadly similar lengths and lack meaningful internal hierarchy. Long structured documents benefit from semantic boundaries such as clauses and paragraphs, while hierarchical chunking preserves relationships among sections, subsections, and parent headings. Anthropic notes that chunk size, boundaries, and overlap materially affect retrieval performance; therefore, one universal chunking method is inappropriate. Anthropic Contextual Retrieval

A structured feedback session must enable informed review, traceable decisions, and accountable follow-through. Option B allows stakeholders to examine architecture diagrams, evaluation results, risk registers, or prototypes before the meeting. The focused agenda keeps discussion aligned with decisions that must be made rather than allowing the session to become an unstructured status conversation. Written decision records prevent different participants from leaving with incompatible interpretations. Assigning an owner and due date to every action converts feedback into executable delivery work. Options A, C, and D depend heavily on memory, provide inadequate preparation time, and create weak decision traceability. In-flight deployments particularly require documented feedback because accepted changes may affect scope, cost, risk, testing, and release timing.

Study Guide references/topics: Stakeholder feedback; decision records; action ownership; lifecycle alignment; communication planning.

Option B is the only configuration establishing the contractual, data-handling, and audit foundations needed for a HIPAA-eligible deployment. Anthropic requires an eligible commercial organization to activate the HIPAA-ready configuration and accept a Business Associate Agreement. A standard Enterprise subscription is not automatically covered merely because it is an enterprise product. Anthropic BAA Guidance

Zero Data Retention may be required for particular covered services, including eligible Claude Code configurations, and is enabled per organization for qualified accounts. Audit logging supports access review, configuration monitoring, incident investigation, and compliance evidence. Anthropic provides audit logs for Enterprise organizations. Claude Code Legal and Compliance, Access Audit Logs

Options A and D use consumer or personal accounts without the required contractual framework. Option C incorrectly treats the elimination of audit evidence as a substitute for a BAA and compliant configuration.

The signed BAA remains the authoritative source for covered products and features. The customer must also configure access control, minimum-necessary data use, workforce policies, retention, integrations, incident response, and vendor-risk controls. The configuration supports compliance; it does not independently guarantee it.

Study Guide references/topics: HIPAA readiness; BAA; ZDR; PHI handling; audit logging; eligible services; shared compliance responsibility.

===============

Project scope is designed for repository-specific configuration shared through version control, including MCP server definitions, project permissions, hooks, and team instructions. This gives every contributor a consistent baseline while keeping changes reviewable. Managed configuration is appropriate for mandatory security and compliance controls because administrators can deploy it centrally and prevent lower scopes from overriding it. Local scope is machine-specific and unsuitable for organization-wide enforcement. User scope follows one engineer across projects, so it cannot guarantee that an entire team receives identical MCP definitions. Personal editor preferences belong in user or local configuration, not project scope, unless the team has explicitly standardized them. Anthropic’s settings hierarchy distinguishes managed, project, local, and user responsibilities. Claude Code settings

Before a pilot begins, the architect must understand the workflows being enabled, the associated security boundaries, and the correct ownership of each configuration decision. Option D establishes this foundation. Organization-wide, non-overridable controls belong in managed configuration, whereas repository-specific MCP servers, shared permissions, and team subagents generally belong in project scope.

Option A then converts those decisions into an initial project baseline that the pilot group can use. The baseline should identify approved MCP endpoints, minimum permission rules, denied operations, subagent responsibilities, configuration ownership, and observable success criteria. Anthropic distinguishes managed, user, project, and local scopes according to who they affect and whether they are shared with the team. Claude Code Configuration Scopes

Options B and C are broad-rollout activities and should not occur before pilot evidence is available. Option E is explicitly post-pilot: findings must first be collected before the configuration can be iterated and stabilized.

The correct lifecycle is discovery, boundary definition, baseline design, limited pilot, evidence review, baseline refinement, documentation and training, followed by controlled expansion with a support and rollback process.

Study Guide references/topics: Claude Code rollout planning; scope ownership; MCP baselines; permission design; pilot strategy; operational enablement.

===============

A direct call to the existing stable HTTP endpoint is the simplest mechanism that satisfies the stated requirements. The interaction is stateless, requires only one tool invocation, and has a strict latency objective. Adding session management, message-bus translation, or another model-mediated agent would introduce unnecessary network hops, operational dependencies, failure modes, and processing latency.

The assistant’s tool implementation should validate input parameters, authenticate through a server-side credential mechanism, apply narrowly scoped authorization, set explicit timeouts, and validate the pricing response before returning it to Claude. Credentials must never be supplied by or exposed to the model. Appropriate logging should capture request attribution, endpoint outcome, and timing without unnecessarily recording sensitive data.

Anthropic describes the Claude API as a RESTful interface and supports custom tools in which the application executes the requested function or API operation. Claude API Overview, Tool Use Overview

MCP could be justified when standardized discovery or reuse across clients is required, but the scenario already supplies a stable API and does not establish that additional requirement.

Study Guide references/topics: Protocol selection; direct API integration; stateless calls; latency minimization; scoped credentials; avoiding unnecessary agentic complexity.

===============

Option D defines a measurable performance characteristic rather than a business capability. The requirement specifies a percentile-based latency threshold—under 800 milliseconds at the 95th percentile—and ties that threshold to the expected workload volume. It therefore describes how well the system must operate under defined conditions.

Options A, B, and C are functional requirements. They describe actions the solution must perform: extracting fields and creating a downstream record, producing an editable draft, and assigning tickets to categories. Functional requirements define observable system behaviors or outputs.

A strong non-functional requirement must include a metric, threshold, measurement method, and operating condition. For Option D, the architect should further define whether latency is measured end-to-end or only at the model API, the test duration, concurrency, input-size distribution, cache state, timeout behavior, geographic region, and treatment of failed requests. Without those details, teams may report incompatible results while claiming to satisfy the same requirement.

Non-functional requirements for Claude solutions commonly address latency, availability, throughput, cost, privacy, security, recoverability, observability, scalability, and regulatory compliance.

Study Guide references/topics: Structured discovery; functional requirements; non-functional requirements; p95 latency; workload conditions; measurable acceptance criteria.

===============

Iteration is an evidence-driven lifecycle phase. Option D combines three essential inputs: production telemetry, sampled output evaluation, and stakeholder feedback. Telemetry exposes latency, cost, errors, tool failures, retrieval behavior, and operational anomalies. Output sampling identifies quality, safety, grounding, or consistency failures that infrastructure metrics may not reveal. Stakeholder feedback establishes whether the system continues to satisfy real business and user needs.

The architect should prioritize the highest-impact validated problem, define the intended improvement, and test the proposed change against the existing evaluation framework and reference set. Anthropic emphasizes that evaluations make behavioral changes visible before they affect users and that their value compounds throughout an agent’s lifecycle. Demystifying Evals for AI Agents

Option A replaces targeted iteration with unnecessary redesign. Option B incorrectly treats deployment as the end of measurement. Option C removes the baseline needed to distinguish genuine improvement from regression or noise.

A mature iteration cycle preserves evaluation continuity, adds production failures as new test cases, validates changes offline, conducts controlled rollout, monitors results, and updates documentation and known limitations.

Study Guide references/topics: Production iteration; telemetry; sampled evaluation; stakeholder feedback; regression testing; evaluation continuity; change prioritization.

===============

Per-user, scope-restricted OAuth tokens directly eliminate the shared-credential weakness. Each token represents a distinct user or delegated identity, carries only the permissions required for that user’s role, and can be revoked independently. This supports least privilege, limits the blast radius of credential compromise, and enables authorization decisions to be tied to a specific principal instead of an undifferentiated shared API key.

Actor attribution in tool-call logs directly resolves the second finding. Each audit event should record the authenticated user, delegated service identity, session or request identifier, tool name, authorization decision, relevant resource, timestamp, and outcome. This establishes accountability and permits incident investigators to reconstruct who initiated a consequential action.

Moving credentials into a server-side secret store is sound secret-management practice, but it does not by itself correct the shared-identity problem: a centrally stored key can still represent every user as the same principal. Schema validation protects downstream processing, while retrieval-layer RBAC protects information access; neither addresses the two specific audit findings.

These controls should be reinforced by short-lived tokens, server-side authorization enforcement, sensitive-field redaction, and tamper-resistant audit-log retention.

Study Guide references/topics: [Claude Code security](https://docs.anthropic.com/en/docs/claude-code/security); [MCP authentication and OAuth] (https://docs.anthropic.com/en/docs/claude-code/mcp); least privilege; identity propagation; auditable tool execution.

===============

Four distinct workflow domains indicate that the agent’s responsibilities have expanded beyond a cohesive capability boundary. Decomposing the deployment into domain-focused agents reduces each agent’s tool-selection space and produces clearer prompts, permissions, evaluations, and ownership. Option E strengthens this conclusion because placing a model-based router before the existing overloaded agent adds latency, cost, and another failure point without correcting the underlying capability sprawl. Overlapping descriptions should be clarified, while unused tools may simply be removed; neither finding alone proves that separate domain agents are required. Public documentation of a pattern is not evidence that it fits this workload. Anthropic emphasizes simple composable patterns, clearly differentiated tools, and empirical evaluation before adding orchestration complexity. Building Effective Agents

Authorization and compliance logging must remain enforceable application-layer controls. Option B requires the application to authenticate the requester, resolve the user’s role and entitlements, and deny the operation when the user lacks authority. A Skill can instruct Claude how to behave, but it is not a reliable security boundary and cannot replace identity-based access control enforced by the surrounding system.

Option A similarly belongs at the application layer. The application must create an authoritative audit event containing the requester, timestamp, Skill and model version, relevant input or content identifiers, generated output, review status, and retention classification. Audit evidence cannot depend on whether the model remembers or chooses to invoke a logging instruction.

Options C, D, and E describe reusable generation behavior that appropriately belongs within the approved Skill: house style, the standardized disclaimer, and the prohibited-language policy. The application may still validate their presence after generation, but the Skill remains the primary reusable content package.

The correct architecture separates behavioral guidance from deterministic enforcement. Skills supply domain instructions and templates; the application enforces identity, authorization, audit retention, data access, output validation, and consequential-action controls.

Study Guide references/topics: Skills versus application controls; authentication; authorization; compliance logging; deterministic guardrails; policy enforcement boundaries.

===============

Over-refusal and hallucination are characteristic model-behavior risks. An overly broad safety response can reject a legitimate request even when the surrounding application operates correctly. A plausible but unsupported answer is a groundedness failure arising from probabilistic generation and inadequate source adherence. These risks require model-specific evaluations, grounding instructions, citations, verification, and calibrated fallback behavior. Expired certificates, database timeouts, and load-balancer misconfiguration are conventional distributed-system failures that should be addressed through infrastructure monitoring, retries, health checks, and configuration management. Distinguishing these categories matters because ordinary software remediation will not resolve behavioral failures, while prompt changes will not repair infrastructure. Anthropic’s hallucination guidance recommends auditable citations and supporting evidence for generated claims. Reducing hallucinations

Sound human-in-the-loop design places review before a high-impact or irreversible action occurs. The reviewer must receive sufficient context and explicit approval criteria so that the checkpoint functions as a meaningful control rather than a ceremonial step. This is especially important when Claude outputs could initiate financial transactions, publish sensitive material, alter access rights, affect employment decisions, or trigger other consequential actions. Option A provides only retrospective auditing and cannot prevent harm. Option C may support monitoring or quality measurement, but random sampling does not protect every case that requires mandatory approval, particularly when review criteria are undefined. Option D removes the accountability and intervention mechanism entirely. Therefore, B provides the strongest design by combining risk-based placement, human authority, and clearly defined verification requirements before execution.

Project scope is designed for configuration that must be shared by everyone working in a repository. Committing the approved configuration provides versioning, review history, repeatable onboarding, and consistent MCP and permission behavior across the monorepo. User scope is intended primarily for individual preferences and personal rules, so independently maintained user files create configuration drift. Local scope affects only one person in one project and is therefore unsuitable for team-wide distribution. A lead architect’s local configuration cannot establish a shared environment. Claude Code documentation specifically describes .claude/settings.json as the shared project settings file that teams check into source control. Security-critical policies that must not be overridden should additionally be enforced through managed organizational settings rather than relying exclusively on repository configuration. Claude Code: Settings files and precedence

================

The network-boundary requirement is a mandatory architectural constraint; therefore, Option D must be resolved before evaluating operational savings. Managed infrastructure can reduce responsibility for agent loops, sandboxes, session state, recovery, and orchestration, but those advantages are immaterial if financial data leaves the approved boundary. Anthropic describes Claude Managed Agents as a hosted agent harness and provides configurable data-residency controls. The architect must still validate inference location, session persistence, encryption, subprocessors, credential handling, auditability, and deletion behavior against the organization’s exact security policy. Options A, B, and C affect migration effort or economics, but they cannot override a non-negotiable data-governance requirement.

Study Guide references/topics: Architectural constraints; managed versus self-hosted agents; data boundaries; residency; security-gated decision-making.

Package 1 is designed for security and compliance review because its threat model identifies relevant threats and attack paths, its residual-risk register documents the risks remaining after controls, and its control-mapping table connects safeguards to organizational or regulatory requirements. Package 2 is designed for the product manager because delivered capabilities and roadmap dependencies directly support prioritization, release planning, sequencing, and lifecycle ownership. An engineering implementation team would ordinarily need component diagrams, interface contracts, configuration schemas, deployment instructions, and operational runbooks rather than primarily risk-governance artifacts. An executive sponsor generally needs a concise outcome, cost, risk, and decision summary instead of feature-level dependency details. Effective architecture communication must therefore adapt the content and level of detail to each audience’s responsibilities and decision rights.