Anthropic CCAR-P Valid Test : Claude Certified Architect - Professional

You are investigating an MCP server that fails on first launch but succeeds on subsequent runs. System permission dialogs appeared during the first launch.
Which response is most appropriate?

• A. Recognize the first-run permission grant as the cause, document the expected behavior in onboarding guidance, and confirm that subsequent runs succeed.
• B. Disable operating-system permission dialogs entirely, accept the resulting security implications, and proceed without confirming whether the failure recurs.
• C. Treat the first-run failure as a permanent fault, replace the MCP server, and do not verify whether subsequent runs succeed.
• D. Reinstall the operating system to clear all permission state without first confirming whether the one- time permission grant caused the failure.

You are compiling continuity practices that span the deployment lifecycle.
Which two practices belong on the list? (Select two.)
Each correct answer presents a complete solution.

• A. Lock decisions made in early phases to prevent revisiting them as later phases begin.
• B. Capture lessons learned at the end of each phase and surface them as inputs to the next phase.
• C. Maintain a stakeholder register and notify the listed parties at every phase transition event.
• D. Carry the evaluation framework and reference set forward across iterations rather than rebuilding each time.
• E. Archive every phase deliverable in long-term storage to preserve a record of what was produced.

A security audit uncovers two issues: (1) all end users share a single API key, and (2) tool calls are executed without logging the initiating user.
Which two mitigations directly address these specific findings? (Select two.)

• A. Replace the shared API key with per-user OAuth tokens carrying scope-restricted permissions.
• B. Validate structured outputs against a schema before downstream actions are executed.
• C. Add actor attribution to tool-call logs so each call records the initiating user identity.
• D. Move credentials out of the prompt context and resolve them from a server-side secret store.
• E. Enforce RBAC at the retrieval layer before content enters the model context.

You are compiling team-setup practices for a Claude Code rollout across an engineering organization.
Which two practices belong on the list? (Select two.)
Each correct answer presents a complete solution.

• A. Use project scope for team-shared Model Context Protocol (MCP) servers and permission rules under version control.
• B. Apply managed configuration centrally for security-critical settings that must not be overridden by individual engineers.
• C. Use user scope for team-shared MCP servers so every engineer on the team has consistent access.
• D. Use local scope for security-critical permission rules so each engineer can adapt them to ongoing work.
• E. Use project scope for personal editor preferences so the preferences apply consistently within the project.

You are choosing the level of detail for an implementation guide. The audience is a delivery team that will build the deployment.
Which guidance composition best serves them?

• A. An architecture overview and a list of known limitations, without component-level diagrams, interface contracts, configuration parameters, or operational runbooks to support implementation.
• B. Component responsibilities and interface contracts only, without sequence diagrams of the dominant flows, configuration parameters with defaults, or runbooks to guide operational tasks.
• C. Component responsibilities, contracts between components, sequence diagrams of the dominant flows, configuration parameters with defaults, and operational runbooks.
• D. An architecture overview and sequence diagrams for the dominant flows, without interface contracts, configuration-parameter tables, or operational runbooks for the delivery team to follow.