13 Rapid review · CCAR-P

120 quick questions, grouped by domain. Cover the answer column, say your answer aloud, then check. Repeat the ones you miss until you can answer each in under ten seconds.

Domain 1: Solution Design & Architecture

# Question Answer

1 First question to ask about any proposed Claude

system?

What measurable outcome moves, from what baseline

2 Three architecture patterns named in the exam

guide?

Workflow, agentic, augmented LLM

3 Steps are fixed and known in advance: which pat‐

tern?

Workflow

4 Path depends on findings and cannot be predicted:

which pattern?

Agent

5 One call with retrieval and tools does the job: which

pattern?

Augmented LLM

6 Classify then send to a specialized path? Routing

7 Lead model splits work it discovers at run time? Orchestrator-workers 8 Draft, critique against criteria, repeat? Evaluator-optimizer

9 Run several independent subtasks at once, or vote? Parallelization

Four stages every design needs? Input, processing, output, feedback

Most common missing stage in weak designs? Feedback loop

Three good reasons for multi-agent? Parallel wide work, context isolation, distinct roles and permissions

What should subagents return? Compact summaries, not transcripts

Hard limits on an agent? Turns, tool calls, tokens or spend, wall-clock time

How to make retries safe for side effects? Idempotency keys

Long multi-minute task with a user waiting? Asynchronous job with progress updates Three value types? Efficiency, productivity, transformation

Platform choice is driven by? Constraints: commitments, residency, networking, feature availability, identity

Domain 2: Models, Prompting & Context Engineering

# Question Answer

Three model tiers, from most capable to

fastest?

Opus, Sonnet, Haiku (check the current lineup in Anthropic's models overview)

How do you choose a tier? Evaluate candidates on your own cases: quality, latency, cost per success

Typical professional model strategy? Mixed: route easy work to a fast tier, escalate hard work

Why pin model versions? Predictable behavior; planned, evaluated migrations

Five parts of a production system prompt? Role, delimited context, rules with reasons, output contract, behavior when unsure

How many few-shot examples, and what

kind?

A few (3 to 5), diverse, including an edge case

When to use extended thinking? Hard multi-step reasoning, verified by evaluation; not for simple tasks

Order for cache-friendly prompts? Static first (tools, system, documents), dynamic last

What breaks a prompt cache? Any change in the cached prefix

What do Skills provide? Packaged capabilities loaded on demand (progressive disclosure)

Four context-engineering moves? Prioritize, compact, isolate, load on demand

Long document placement in a prompt? Near the top, with the question at the end

Fix for contradictory rules? One clear rule with its reason

Fix for inconsistent output format? Schema via structured output or tool, plus validation

Domain 3: Integration

# Question Answer

Least-privilege order of actions? Remove, narrow, gate, monitor

Is logging a substitute for removing a tool? No; it is a detective control Agent's effective permission should be? Never more than the calling user's

Shared service account behind a multi-user

agent creates?

A confused-deputy risk

Where must authorization be enforced? In tools and data layers, not prompts

Token passthrough is? An anti-pattern; servers use their own scoped credentials

Should credentials ever be in the context win‐

dow?

Best fit for shared enterprise integrations? MCP servers with registry and gateway

Best fit for a one-off function in one app? A direct tool definition

Best fit for a partner-owned agent? Agent-to-agent with a contract and untrusted-data handling

Many tools, wrong tool choices? Remove unneeded tools; progressive discovery

Part numbers and error codes: retrieval type? Keyword or hybrid

Aggregates over structured records? SQL or analytics tool

Small stable corpus always needed? Put it in context and cache it

Chunking principle? Follow document structure; add context to each chunk

Two metadata uses at retrieval? Permission filtering and freshness filtering

Reranking does what? Reorders candidates so fewer, better chunks reach the model

Retrieval metric for "is the right chunk in the

top k"?

Recall at k

Why are LLM failures hard to observe? They are semantic: wrong answers return success codes

Key trace fields? Correlation ID, prompt and model versions, retrieved IDs, tokens, latency, cost, outcome

Personal data in traces? Redact before logging; restrict raw access

Three MCP server primitives? Tools, resources, prompts

Rapid review

Domain 4: Evaluation, Testing & Optimization

# Question Answer

55 Six metric dimensions? Accuracy, latency, cost, safety, security, and business outcome 56 Best source for eval cases? Redacted real traffic, stratified, plus edge and adversarial cases 57 Why a frozen holdout? To detect overfitting from tuning

58 Three grading methods? Code checks, model-based judges, human review 59 Before trusting an LLM judge? Calibrate against expert labels 60 When does the regression suite run? On every change to prompts, models, tools, retrieval 61 A/B randomization unit for chat? User or conversation

62 Confident wrong answers after a data refresh? Check retrieval and indexing first 63 Fails only on hard cases? Model mismatch: stronger tier or thinking for those cases 64 Ignores one instruction in a long prompt? Restructure or chain the prompt 65 Cost metric that matters? Cost per successful task

66 First cost lever for repeated static context? Prompt caching
67 Cost lever for non-urgent bulk work? Batch processing
68 Lever to cut perceived latency? Streaming
69 Independent calls in sequence? Parallelize

70 Distractor to reject in cost questions? Truncating required context 71 Signal for gradual quality drift? Trends in sampled grader scores and escalation rates 72 A small eval difference on 50 cases is? Often noise

Domain 5: Governance, Safety & Risk Management

# Question Answer

Can a system prompt make a model immune to injec‐

tion?

Lethal trifecta? Private data, untrusted content, external communication

Fix for a trifecta agent? Remove or gate at least one leg

Five guardrail layers? Input, model, tools, output, process

Oversight for routine low-risk drafts? Spot checks

Oversight for irreversible or high-value actions? Explicit human approval before action

Oversight for credit, hiring, medical, legal decisions? Human decides; Claude assists Sign of rubber-stamp review? Near-100% approval in seconds

Required before PHI flows? BAA and a HIPAA-eligible configuration

US federal workload requirement? FedRAMP-authorized environment at the right level

GDPR assessment for high-risk processing? DPIA

GDPR limit relevant to AI decisions? Significant automated decisions need human involvement

Residency requirement met by? In-region deployment plus contractual terms

How to find bias? Stratified evaluation across groups and languages

Transparency basics? Disclose AI use, document limits, offer a human route

First step in a live safety incident? Contain: disable or redirect via flag or kill switch

Four NIST AI RMF functions? Govern, Map, Measure, Manage

Domain 6: Stakeholder Communication & Lifecycle Management # Question Answer

90 Vague goal in a stem: first action? Structured discovery

91 Parts of a good problem state‐

ment?

User, problem, baseline, target, constraint, scope, owner, approver 92 Who should write evaluation

cases?

Domain experts with the build team

93 Record of a significant decision? ADR

94 Five parts of an ADR? Context, options, decision, consequences, evidence 95 What executives need? Outcome, cost, risk, timeline, the decision required 96 How to describe non-determinism? Measured rates on a test set plus the controls 97 LLM SLA components? Availability, latency, quality floor, fallback 98 Pilot misses target: how to report? Data, cause, options with cost and time; owner decides 99 Overpromising sponsor: response? Prompt, private, data-based reset with accurate wording

Contents of a handoff pack? Architecture, ADRs, inventory, eval suite, runbooks, dashboards, risk assessment, owners

Proof a handoff worked? Receiving team can change, release, monitor, roll back alone

Lifecycle phases? Discovery, design, build, launch, handoff, monitor, iterate, retire

Rapid review

Decision-rights tool? RACI with one accountable person per decision

Two executives disagree on auto‐

mation?

Propose risk tiers and let pilot data set the boundary

Usage falls by half after a year? Investigate, then improve, refocus, or retire

Protection against vendor lock-in? Own your prompts, evaluation sets, and integration code

Domain 7: Developer Productivity & Operational Enablement # Question Answer

Where do unbreakable org rules for Claude Code

live?

Enterprise managed settings

Where do team conventions live? Committed project settings and CLAUDE.md

Enforcement or guidance: hooks? Enforcement (deterministic)

Enforcement or guidance: CLAUDE.md? Guidance

Rule for secrets files? Deny reads in settings; use a secrets manager

Long CLAUDE.md problem? Consumes context and buries rules; keep it short

Packaged repeatable workflows? Slash commands, subagents, skills, plugins

Claude Code in CI needs? Isolated environment, tight permissions, human merge

Default production access for on-call AI? Read-only through approved tools

Who acts on production? A human, under their own identity

Good productivity metrics? Lead time, change failure rate, review turnaround, satisfaction

Vanity metric to avoid? Lines of AI-generated code

Rollout sequence? Volunteer pilot, templates, training, measure, expand

Personal production tokens in MCP configs? Replace with approved servers and scoped or per-user credentials