Anthropic CCAR-P Value Pack (Frequently Bought Together)

A security team is evaluating two proposed controls. Control A adds an outbound tool allow-list with destination restrictions and per-call review. Control B scores responses against a stable adversarial evaluation set after each model-version change.
Which two risk categories are correctly matched to these controls? (Select two.)

• A. Control B - silent quality drift after a model-version upgrade
• B. Control A - data exfiltration via outbound tool calls
• C. Control A - silent quality drift after a model-version upgrade
• D. Control B - data exfiltration via outbound tool calls
• E. Control A - prompt injection from adversarial content in retrieved data

You are supporting an EU-based deployment with GDPR obligations.
Which combination of measures best supports the deployment's GDPR posture?

• A. disabling all data-retention configuration, redaction controls, and data-subject-rights handling to simplify day-to-day operations, accepting the resulting GDPR compliance exposure
• B. enterprise-tier deployment with a signed Data Processing Addendum, defined data-retention configuration, redaction of personal data not needed for the task, and documented data-subject-rights handling
• C. using a personal Claude account tier for processing EU personal data at scale, with no signed Data Processing Addendum and no documented data-subject-rights handling procedure
• D. pasting full EU personal data into every prompt to "give Claude complete context" without considering purpose limitation, data minimization, or the organization's Data Processing Addendum obligations

You are integrating AI-assisted tooling into the team's documentation workflow. The team wants generated documentation that stays grounded in the actual code.
Which integration approach best fits this requirement?

• A. Disable all filesystem and code-search tools so the subagents cannot read any repository code, accepting that documentation generation will be entirely disconnected from the actual implementation.
• B. Generate documentation from the model's training-data recall without reading any of the actual repository code, accepting that the output will not reflect the current implementation.
• C. Configure subagents that read the relevant code files via filesystem and code-search tools, generate the documentation, and emit changes through the team's normal review workflow.
• D. Have the subagents publish generated documentation directly to the public-facing site without passing through the team's normal review workflow or any human approval step.

A managed agent deployment for claims triage has grown from 6 tools to 34 tools over 18 months as product teams added capabilities. Triage accuracy has declined from 91 percent to 78 percent, and average tool- selection latency has increased by 2.3 seconds. A junior engineer has proposed adding a tool-router agent in front of the current agent to filter the tool list per request.
Which two findings should you present to justify capability decomposition before adding the router? (Select two.) Each correct answer presents part of the solution.

• A. Several tools have not been invoked across the most recent 90 days of traffic.
• B. The proposed router introduces an additional model call on every incoming request.
• C. Tool descriptions overlap across multiple claim categories within the agent's tool set.
• D. The router pattern is well documented across publicly available agent literature.
• E. The 34 tools serve four distinct claim-workflow domains within the triage scope.

You are defining escalation criteria for ambiguous cases in an automated workflow.
Which set of criteria best supports consistent escalation?

• A. No escalation criteria; the model decides independently on every turn whether to escalate, without explicit confidence thresholds, impact categories, or classifier-based ambiguity flags.
• B. A confidence score below a defined threshold, presence of high-impact decision categories, ambiguity flags raised by content classifiers, and the user's explicit request for review.
• C. Escalation at the discretion of whoever is available when the team's on-call engineer has spare capacity, without a defined threshold, category, or ambiguity criterion.
• D. Escalation only after an affected customer has contacted support to complain, after the automated workflow has already completed without human review.