AnthropicGovernance, Safety, and Risk Management

Threat Model & Prompt Injection — CCAR-P Practice Question

A representative Claude Certified Architect - Professional (CCAR-P) exam question on Threat Model & Prompt Injection. Work through it below, then read why each option is right or wrong.

This question is part of the free Claude Certified Architect - Professional practice test.

Short answer

The correct answer is C. Untrusted content can inject instructions that influence a consequential tool call.

The system combines untrusted external content with write authority. Separation of data and instructions, constrained tools, validation, approvals, and monitoring are required.

The Question

A procurement agent reads vendor websites and can create purchase orders. What is the most important architectural risk?

AThe model may write concise summaries

BWeb pages may use unusual fonts

CUntrusted content can inject instructions that influence a consequential tool callCorrect

DPurchase orders have identifiers

Why C is correct

The system combines untrusted external content with write authority. Separation of data and instructions, constrained tools, validation, approvals, and monitoring are required.

Why the other options are wrong

Option A: The model may write concise summaries

Option A does not satisfy the requirement in the scenario. Review the explanation above: the correct choice (C) is the only one that fully meets every constraint stated in the question.

Option B: Web pages may use unusual fonts

Option B does not satisfy the requirement in the scenario. Review the explanation above: the correct choice (C) is the only one that fully meets every constraint stated in the question.

Option D: Purchase orders have identifiers

Option D does not satisfy the requirement in the scenario. Review the explanation above: the correct choice (C) is the only one that fully meets every constraint stated in the question.

Key idea: Threat Model & Prompt Injection

The system combines untrusted external content with write authority. Separation of data and instructions, constrained tools, validation, approvals, and monitoring are required. On the CCAR-P exam, questions in the "Governance, Safety, and Risk Management" domain test whether you can map a scenario's constraints to the right choice. Read the requirement carefully, eliminate options that violate any single constraint, and pick the one that satisfies all of them with the least operational overhead.

Ready to see how you'd score?

Take the free practice quiz and find out which Claude Certified Architect - Professional domains you need to focus on. No signup required.

Take the free quiz See all 20+ practice questions

Practice 5 similar questions

Same cert, same or adjacent domain. Use these after reviewing the explanation.

Take the quiz →

1Discovery & Requirements — CCAR-P Practice QuestionSolution Design and Architecture 2Model Routing & Governance — CCAR-P Practice QuestionClaude Models, Prompting, and Context Engineering 3RAG & Evaluation — CCAR-P Practice QuestionIntegration 4Evals & Release Gate — CCAR-P Practice QuestionEvaluation, Testing, and Optimization 5Governance & Data Retention — CCAR-P Practice QuestionGovernance, Safety, and Risk Management

Related Claude Certified Architect - Professional Practice Questions

Discovery & Requirements — CCAR-P Practice Question→Model Routing & Governance — CCAR-P Practice Question→RAG & Evaluation — CCAR-P Practice Question→

Official sources used

Verify program and exam details at the source before scheduling.

AnthropicWriting Tools For Agents