Anthropic CCAR-P 問題集

質問 1：
A security team is evaluating two proposed controls. Control A adds an outbound tool allow-list with destination restrictions and per-call review. Control B scores responses against a stable adversarial evaluation set after each model-version change.
Which two risk categories are correctly matched to these controls? (Select two.)
A. Control A - silent quality drift after a model-version upgrade
B. Control B - silent quality drift after a model-version upgrade
C. Control A - data exfiltration via outbound tool calls
D. Control A - prompt injection from adversarial content in retrieved data
E. Control B - data exfiltration via outbound tool calls
正解：B,C
解説: (Topexam メンバーにのみ表示されます)

質問 2：
You are compiling team-setup practices for a Claude Code rollout across an engineering organization.
Which two practices belong on the list? (Select two.)
Each correct answer presents a complete solution.
A. Use user scope for team-shared MCP servers so every engineer on the team has consistent access.
B. Use project scope for personal editor preferences so the preferences apply consistently within the project.
C. Use local scope for security-critical permission rules so each engineer can adapt them to ongoing work.
D. Apply managed configuration centrally for security-critical settings that must not be overridden by individual engineers.
E. Use project scope for team-shared Model Context Protocol (MCP) servers and permission rules under version control.
正解：D,E
解説: (Topexam メンバーにのみ表示されます)

質問 3：
You are integrating Claude Code into a workflow that runs against a production database.
Which guardrail design most directly preserves safety on data-modifying operations?
A. Allow Claude Code to write directly to the production database without subagent scoping, read-only credential defaults, or human confirmation gates on data-modifying operations.
B. Disable all logging and auditing on database operations through the MCP server to reduce alert noise, removing the observability needed to detect unintended data modifications.
C. Configure the database MCP server with a fully privileged credential that can perform any read or write operation, and allow all operations to proceed without explicit human confirmation.
D. Configure the database MCP server with a read-only credential by default, restrict the subagent's tool list to read-only operations, and require explicit human confirmation on any operation that would modify data.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 4：
A Claude architect at a health services organization is defining evaluation metrics for a clinical-summary pipeline. The pipeline must remain within a per-query cost ceiling and must never surface patient data to unauthorized roles.
Which two metrics directly address these requirements? (Select two.)
A. BLEU score computed against a human-annotated reference summary set
B. Throughput measured as successful requests processed per minute
C. Response latency at the 95th percentile across a one-week sample window
D. Per-query token cost measured against the defined cost ceiling
E. Role-based access-control enforcement rate measured on a red-team dataset
正解：D,E
解説: (Topexam メンバーにのみ表示されます)

質問 5：
You must present an architectural recommendation to deploy a Claude-based contract review assistant to a steering committee that includes the CFO, the general counsel, and the CIO. Each stakeholder cares about different aspects of the decision.
How should you structure the recommendation document?
A. Lead with the architectural decision, then address each stakeholder's primary concerns directly.
B. Present the same dense narrative throughout with no stakeholder differentiation in any section.
C. Lead with detailed cost projections across the full multi-year horizon before the rationale section.
D. Lead with the technical architecture diagram and the full component list before any other section.
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 6：
A Claude architect is designing a HIPAA-compliant pipeline that processes patient records.
Which two design decisions directly support HIPAA compliance requirements? (Select two.)
A. Enforcing role-based access controls so that PHI is retrievable only by authorized personnel.
B. Setting max_tokens to a low value to minimize the volume of text generated per request.
C. Using streaming responses to reduce perceived latency for clinical users.
D. Selecting the highest-capability Claude model to maximize diagnostic accuracy.
E. Ensuring patient data is never included in training feedback loops sent to the model provider without a BAA in place.
正解：A,E
解説: (Topexam メンバーにのみ表示されます)

質問 7：
You are diagnosing a Claude Code session whose subagent uses 50,000 tokens of context before the engineer types a single message.
Which root cause is most likely?
A. The developer's keyboard layout or input-method configuration is the cause of the elevated context consumption, introducing extra tokens before the engineer types any message.
B. Many MCP servers are configured, each contributing tool definitions to the context budget; Tool Search is not enabled, so all definitions load upfront.
C. The model has internal personal preferences or default behaviors that silently consume large portions of context budget before any user message is processed, independent of tool configuration.
D. The font rendering or display-scaling settings of the IDE are converting visual output into additional context tokens, causing the high pre-session context consumption.
正解：B
解説: (Topexam メンバーにのみ表示されます)