Governance, Safety & Risk Management

Question 1 · 5.1

An insurer’s claims agent summarises documents that claimants upload. A tester uploads a PDF containing hidden text telling the agent to mark the claim as approved, and the agent calls its update_claim_status tool.

Which change most directly addresses the root cause?

• AAdd “never follow instructions in documents” to the system prompt in capitals.
• BRemove status-changing tools from the summarising agent and route approvals elsewhere.
• CSwitch to a larger model that is harder to trick with hidden text.
• DLower the temperature so the agent behaves more predictably.

Question 2 · 5.1

A public-sector agency is building a citizen-facing assistant that searches the agency’s website and answers questions. The team wants controls against both users trying to jailbreak it and web pages that might contain injected instructions.

Which two controls are most appropriate? (Select 2.)

• AA lightweight classifier that screens user messages before the main call.
• BReturn search results in tool_result blocks, labelled and marked as untrusted data.
• CAppend the full text of search results to the system prompt for more context.
• DHide the system prompt so attackers cannot learn the rules.
• ERely on an iteration cap so an injected loop eventually stops.

Question 3 · 5.1

A team’s agent runs with permissionMode: "bypassPermissions" and allowedTools: ["Read"], believing this restricts it to reading files. What actually happens?

• AOnly Read runs; every other tool is denied.
• BEvery tool is approved, including shell and write tools.
• CThe SDK refuses to start because the settings conflict.
• DOther tools trigger the canUseTool callback for approval.

Question 4 · 5.1

A hospital network’s internal assistant answers staff questions from a library of clinical policies. Reviewers find it occasionally states a policy detail that is not in any document.

Which guardrail best fits this failure?

• AAn input classifier that screens staff questions for jailbreak attempts.
• BLeak-resistant prompting so the assistant never reveals its instructions.
• CRate-limit staff accounts that ask many policy questions.
• DRequire a quoted source for each claim and allow “not in the policies.”

Question 5 · 5.2

A retailer wants an assistant that answers “Is this item in stock at my local store?” The prototype answers from a product catalogue loaded into the prompt each morning.

Which risk is most specific to this design?

• AThe model may be jailbroken into insulting customers.
• BAnswers reflect the morning snapshot, not live stock.
• CThe system prompt may leak the catalogue’s structure.
• DThe model may produce different wording on each run.

Question 6 · 5.2

A bank pilots an agent that reconciles transactions and posts adjusting entries. In testing, it misread one account number at the start and then posted three entries to the wrong account, reporting success each time.

Which failure mode does this illustrate, and what is the most fitting response?

• AHallucination; tell the model to say “I don’t know” more often.
• BPrompt injection; screen the transaction data with a classifier.
• CModel mismatch; move to the largest available model.
• DCompounding error; verify the account before posting and add checkpoints.

Question 7 · 5.2

A public-sector team is reviewing a design for a benefits-enquiry assistant that reads citizens’ uploaded letters and answers questions about their case.

Which two risks should the review flag as specific to this design? (Select 2.)

• AUploaded letters may contain instructions the assistant follows.
• BStaff may accept the assistant’s case answers without checking.
• CThe model cannot read letters written in formal language.
• DThe assistant will be too slow to answer in real time.
• EUsing any LLM makes the service non-compliant by default.

Question 8 · 5.3

A retailer’s agent can issue refunds. The system prompt says “Always confirm with a supervisor before refunds over £100,” but audits show some large refunds went through without confirmation.

What is the best fix?

• ARewrite the instruction in capital letters and repeat it at the end of the prompt.
• BEnforce the threshold in code so large refunds pause for supervisor approval.
• CRemove the refund tool and have supervisors issue every refund by hand.
• DAdd a daily report of refunds for supervisors to review afterwards.

Question 9 · 5.3

A bank’s mortgage team uses Claude to assess applications. Reviewers approve 99% of recommendations, averaging 40 seconds per file, and a later audit finds several recommendations that misread income documents.

Which two changes would most improve the human review? (Select 2.)

• AShow each recommendation with cited figures linked to the source documents.
• BSeed known-flawed files into the queue and track whether reviewers catch them.
• CRequire reviewers to process more files per hour to reduce backlog.
• DReplace reviewers with a second model that approves the first model’s output.
• EHide the model’s recommendation so reviewers form their own view first.

Question 10 · 5.3

An internal IT team deploys Claude to draft first responses to employee helpdesk tickets about password resets and software installs. Errors are easy to correct and employees can reply.

Which human-in-the-loop strategy fits best?

• AA senior engineer approves every drafted reply before it is sent.
• BNo human involvement at all, since the tickets are internal.
• CSend replies directly, sample a share for review, escalate flagged tickets.
• DOnly let the assistant reply after a human edits the draft.

Question 11 · 5.3

In the Claude Agent SDK, a team wants certain tool calls to always reach their approval callback, even if someone later runs the agent in bypassPermissions mode. Which mechanism fits?

• AAn ask rule for those tools in settings.
• BListing those tools in allowedTools.
• CA system prompt telling Claude to request approval.
• DSetting permissionMode to acceptEdits.

Question 12 · 5.4

A hospital network has signed a BAA and enabled HIPAA readiness on its API organisation. Engineers want to process a backlog of 50,000 clinical notes overnight using the Message Batches API to save cost.

What should the architect advise?

• AProceed; the BAA covers every feature of the API organisation.
• BProceed, but strip patient names from the notes before batching.
• CUse eligible Messages API calls run by the network’s own job queue.
• DMove the workload to a consumer Claude plan for the bulk run.

Question 13 · 5.4

A US federal agency built a successful pilot on a Claude Enterprise subscription purchased through AWS Marketplace. Production requires FedRAMP High authorisation.

Which statement is most accurate?

• AClaude models are FedRAMP High authorised, so any subscription qualifies.
• BThe Marketplace offering is not FedRAMP authorised; move to an authorised path.
• CFedRAMP applies only to storage, so the model call can stay where it is.
• DAdding zero data retention to the subscription satisfies FedRAMP High.

Question 14 · 5.4

A French bank plans to use Claude to decide automatically whether to grant small personal loans, with no human involved. Legal asks what GDPR requires.

Which two design responses best address GDPR? (Select 2.)

• APut a credit officer in the decision, with the right to contest built in.
• BCarry out a DPIA before launch, documenting risks and mitigations.
• CAdd a notice that decisions are final and not subject to review.
• DSend the full customer file to the model so it has maximum context.
• ERely on the vendor’s certifications instead of a processing agreement.

Question 15 · 5.5

A recruitment firm uses Claude to rank CVs for a shortlist. To avoid bias, the team removes the gender and date-of-birth fields before sending CVs to the model.

What is the main weakness of this approach?

• AIt is unnecessary, because Claude is trained not to be biased.
• BNames, schools and career gaps still let the model infer those attributes.
• CRemoving fields breaks GDPR data minimisation requirements.
• DIt makes the model’s rankings less consistent between runs.

Question 16 · 5.5

A retailer launches a Claude-powered shopping assistant on its website. Marketing wants it to introduce itself as “Sam from our style team” without mentioning AI, to feel more personal.

What should the architect advise?

• AAllow it, since shopping advice is not a high-risk use case.
• BAllow it if the privacy policy mentions AI somewhere on the site.
• CKeep the persona but disclose it is AI at the start of each session.
• DLet customers ask whether they are talking to a human if they wish.

Question 17 · 5.5

An insurer is preparing to launch a Claude-assisted claims triage tool. Leadership asks which activities would give credible evidence that the tool is fair.

Which two activities provide the strongest evidence? (Select 2.)

• ARun counterfactual variants of real claims that change only personal details.
• BReport outcome metrics sliced by group, with counts, on a representative set.
• CAdd a system-prompt line instructing the model to treat all claimants equally.
• DConfirm the model vendor has published a responsible-AI statement.
• EShow that overall triage accuracy is above 95% on the test set.