Anthropic CCAO-F Exam Questions

Under the objective Manage uploaded knowledge and connectors (e.g., Google Drive, Gmail), establishing data connectors requires adhering to the principle of least privilege, strict scope boundary management, and robust data classification.

Option B is an authorized, safe integration: connecting Claude to an approved, bounded project management workspace with explicit scope controls allows the model to summarize tasks and sprint updates safely. Option D is an ideal read-only integration, granting access to public documentation and reference repositories where confidential data leakage risks are zero. Conversely, connecting AI tools to core payroll infrastructure (Option E) or sensitive personnel/HR databases (Option A) introduces severe compliance, privacy, and unauthorized access liabilities. Linking personal cloud storage repositories containing unvetted mixed personal data (Option C) violates data governance standards by risking unintentional exposure of private files.

Under the objective Align model selection with task requirements (e.g., cost, speed, quality), deploying models effectively requires matching model cognitive capacity to task complexity and throughput requirements.

Option C correctly routes complex, multi-layered tasks---such as synthesizing intricate legal precedents, statutory compliance, or multi-step policy analysis---to high-capability models (e.g., Claude 3 Opus or Sonnet) where deep reasoning is essential. Option E correctly routes simple, high-frequency, low-complexity tasks---such as standard FAQ lookups---to light, fast models (e.g., Claude 3 Haiku) to achieve ultra-low latency and minimal cost per request. Conversely, choosing models purely based on cost (Option A) is inefficient, deploying large frontier models for simple keyword extraction (Option B) wastes financial and rate-limit budgets, and assigning complex strategic synthesis across many documents to lightweight models (Option D) leads to shallow analysis and missed nuances.

Option A is correct because vendor evaluation must begin with an agreed decision framework. The organization should first define relevant criteria, measurement methods, mandatory requirements, scoring weights, acceptable evidence, and disqualification conditions. Typical criteria might cover capability, security, compliance, implementation effort, support, total cost, and contractual risk.

Options B, C, and D reverse or omit essential dependencies. Asking Claude for a recommendation without inputs invites unsupported assumptions. Scoring before defining criteria permits the desired outcome to influence the evaluation framework. Ranking before collecting evidence has no defensible analytical basis. Anthropic recommends defining specific, measurable, relevant success criteria before building evaluations. The same principle applies to vendor selection: criteria must precede measurement and judgment.

Therefore, the sound dependency chain is criteria definition, evidence collection, validation, scoring, and ranking. See Anthropic's guidance on defining success criteria and evaluations.

================

Under the objective Apply data, privacy sensitivity, regulatory policies, and privacy considerations, responsible data management follows a strict, sequential security lifecycle when handling enterprise data for AI tasks.

Before any redaction, sanitization, or masking can occur, the user must first classify the document's data assets and systematically identify which elements constitute sensitive data (Option B)---such as Personally Identifiable Information (PII), Protected Health Information (PHI), or confidential corporate financial figures. Without establishing data classification boundaries, redaction (Option A) becomes incomplete and error-prone. Only after identifying and classifying sensitive fields can one properly redact them (Option A), conduct a quality assurance/peer review (Option D), and ultimately submit the sanitized payload to Claude (Option C).

Option D is correct: 4, 1, 3, 2, 5. First, gather and label the source materials so every requirement can be traced to a stakeholder interview, process document, or other authoritative input. Second, organize related material and identify apparent conflicts or ambiguities. This preparation prevents unrelated statements from being blended and highlights issues that Claude should preserve rather than silently resolve.

Third, submit the consolidated material using a structured extraction prompt that defines the requested fields, such as requirement identifier, statement, source, owner, priority, ambiguity, and status. Anthropic's prompting guidance emphasizes clear instructions, contextual information, and explicit output formats. Fourth, validate Claude's structured output against the original sources. This step is essential because a well-formatted answer can still omit, distort, or combine requirements. Anthropic recommends auditable citations and verification against supporting text, retracting claims that cannot be grounded.

Finally, document the approved requirements set with traceability and resolution status. Options A and C begin analysis or prompting before the sources have been properly gathered and labelled. The missing text in Option B cannot establish a valid alternative, so it has been preserved as missing rather than invented. This sequence combines task decomposition with source-grounded validation. See Anthropic's prompting best practices and hallucination-reduction guidance.

================