CCAR-P questions and answers — Domain 5: Governance, Safety and Risk

9 practice questions on Governance, Safety and Risk, the domain weighted at 14% of the CCAR-P exam. Every answer explains why the distractors fail — that is the part that transfers to questions you have not seen before.

Question 1

An agent summarises supplier emails and can also raise purchase orders. An email contains instructions to raise an order. What is the strongest control?

1. A system prompt instructing the model to ignore instructions found in emails
2. Removing the order-raising capability from the summarising agent
3. Screening emails for suspicious phrasing
4. Asking the model to flag anomalous content

Answer: B. Indirect prompt injection, and the layering order applies: architectural controls beat prompt controls. An agent without the capability cannot be induced to use it. The prompt policy, screening and flagging are all worth adding, but each reduces probability rather than removing possibility.

Question 2

Which statement about Anthropic's certifications is accurate?

1. FedRAMP authorisation covers all commercial products
2. SOC 2 Type I and II, ISO/IEC 27001:2022 and ISO/IEC 42001:2023 apply to commercial products, with a HIPAA-ready configuration and BAA available
3. Certifications apply equally to consumer and commercial plans
4. ISO 42001 covers information security

Answer: B. ISO/IEC 42001:2023 is the AI management systems standard, distinct from ISO/IEC 27001:2022 for information security. These attestations cover commercial products such as Claude for Work and the API rather than consumer plans, and documentation is requested through the Trust Portal.

Question 3

A team argues the system is compliant because the vendor holds SOC 2 and ISO 42001. What is wrong with this reasoning?

1. Those certifications are not relevant to AI systems
2. A vendor attestation is an input to your compliance case, not a substitute — lawful basis, minimisation, retention, access control and audit evidence remain yours
3. Certifications expire annually and cannot be relied on
4. Nothing; vendor certification is sufficient

Answer: B. Compliance attaches to what your system does with the data. The vendor's controls cover the vendor's part of the stack, and an auditor will ask you to evidence yours.

Question 4

Which failure mode is characterised by declining quality with no error raised?

1. Prompt injection
2. Silent drift
3. Over-refusal
4. Data leakage

Answer: B. Silent drift is why behavioural monitoring exists: nothing breaks, so infrastructure alerting stays quiet while output quality falls. It is detected through escalation rates, override rates and a periodically refreshed eval suite.

Question 5

A required human review step has produced a two-day backlog and reviewers are approving in bulk without reading. How should this be assessed?

1. The control is working, since review is occurring
2. The control has failed — a review nobody has time to perform is the same as no review, and the design must change
3. It is a staffing problem outside the architecture
4. Approving in bulk is acceptable for low-risk cases

Answer: B. Human review is a design element with a cost, and it must be sized so it actually happens. The architectural responses are triaging which cases need review, giving reviewers evidence and citations rather than bare answers, and measuring override rates as a quality signal.

Question 6

Which use requires both qualified human review and disclosure that AI was involved?

1. Drafting internal engineering documentation
2. Preparing an employment termination recommendation
3. Summarising a public earnings call
4. Reformatting a dataset

Answer: B. Employment decisions are one of the recognised high-risk categories — with legal, healthcare, insurance, financial advice, housing and lending, academic assessment and journalism. In all of them a qualified human reviews and owns the decision, and affected people are told AI was used. Both, not either.

Question 7

Which practice most reduces the risk of sensitive data leaking through an LLM system?

1. Encrypting the database at rest
2. Minimising and tokenising identifiers before they are sent, and redacting sensitive fields in logs
3. Using a commercial plan
4. Increasing the guardrail model's temperature

Answer: B. Data minimisation applies before the call, and logs are the easiest place to leak data you were careful about everywhere else. Encryption at rest and plan choice are necessary but address different exposures; temperature is unrelated.

Question 8

What should a per-request audit record contain for a regulated Claude system?

1. The final output only
2. Model and prompt version, inputs and outputs, retrieved sources and citations, validation and guardrail outcomes, who reviewed what and when, and the resulting decision
3. The API key used and the timestamp
4. Aggregate daily statistics

Answer: B. You will need to demonstrate months later what the system did and why. That requires the full chain from input through grounding and controls to the human decision — retained for the period the regime requires and no longer, with sensitive fields redacted.

Question 9

Over-refusal is measured at 12% of legitimate requests. How should this be classified?

1. A safety success, since the system is cautious
2. A quality failure — users route around a system that declines legitimate work, defeating the controls entirely
3. A model defect requiring a vendor ticket
4. An acceptable cost of guardrails

Answer: B. Over-refusal is a named failure mode with a real cost: people stop using the system and revert to unmonitored alternatives, which is worse for safety than a calibrated system. It belongs on the dashboard alongside accuracy.

← Previous: Questions & answers — Domain 4  |  Next: Questions & answers — Domains 6–7 →