Anthropic CCAR-P Value Pack (Frequently Bought Together)

You are reviewing a peer's Claude Code permission rules for an enterprise rollout. The rules grant unrestricted Bash access to all projects across all developers.
Which response is most appropriate?

• A. Approve the unrestricted Bash access as written on the grounds that narrowing the rules would add configuration complexity, accepting the full attack surface for all engineers across all projects.
• B. Add unrestricted access to additional tool categories as well, so that Bash is not asymmetrically more permissive than other tools, expanding the attack surface further in the name of consistency.
• C. Disable all permission rules for the enterprise rollout so every command across every project runs without any tool-pattern scoping or explicit deny rules for sensitive operations.
• D. Replace unrestricted Bash with narrowly scoped tool patterns that allow only the specific commands the workflows require, and add explicit deny rules for sensitive operations.

A technical team is cataloguing risks specific to Claude's use in a document-grounded Q & A system.
Which two items represent failure modes intrinsic to LLM-based systems rather than generic software defects? (Select two.)

• A. The model refuses a legitimate query because surface features trigger an overly broad safety pattern.
• B. An expired TLS certificate blocks outbound API calls to Claude.
• C. The model generates a plausible-sounding answer unsupported by any retrieved document.
• D. A database connection timeout causes retrieval to return an empty result set.
• E. A misconfigured load balancer routes requests to a deprecated API version.

You are supporting an EU-based deployment with GDPR obligations.
Which combination of measures best supports the deployment's GDPR posture?

• A. pasting full EU personal data into every prompt to "give Claude complete context" without considering purpose limitation, data minimization, or the organization's Data Processing Addendum obligations
• B. using a personal Claude account tier for processing EU personal data at scale, with no signed Data Processing Addendum and no documented data-subject-rights handling procedure
• C. disabling all data-retention configuration, redaction controls, and data-subject-rights handling to simplify day-to-day operations, accepting the resulting GDPR compliance exposure
• D. enterprise-tier deployment with a signed Data Processing Addendum, defined data-retention configuration, redaction of personal data not needed for the task, and documented data-subject-rights handling

You are compiling team-setup practices for a Claude Code rollout across an engineering organization.
Which two practices belong on the list? (Select two.)
Each correct answer presents a complete solution.

• A. Use user scope for team-shared MCP servers so every engineer on the team has consistent access.
• B. Use project scope for personal editor preferences so the preferences apply consistently within the project.
• C. Use local scope for security-critical permission rules so each engineer can adapt them to ongoing work.
• D. Use project scope for team-shared Model Context Protocol (MCP) servers and permission rules under version control.
• E. Apply managed configuration centrally for security-critical settings that must not be overridden by individual engineers.

You are selecting a model for a new production workload and must complete the upstream steps before testing candidate models empirically.
Which two steps must be completed BEFORE running a representative sample on a candidate model? (Select two.) Each correct answer presents part of the solution.

• A. Define the quality bar, latency tolerance, and expected volume for the workload.
• B. Retest the model choice when a new model version becomes available.
• C. Choose a candidate model based on the requirements profile and known capabilities.
• D. Select the lightest model that consistently meets the quality bar across the sample.
• E. Sign off the production rollout plan with the platform and security teams.