You are designing the prompt for a ticket-triage classifier with thirty well-defined categories and clear category descriptions in the prompt.
Which technique is most appropriate as the starting point?

• A. A prompt that demands the model invent new categories when the supplied ones do not fit.
• B. A chain-of-thought prompt for a routing decision that does not require multi-step reasoning.
• C. A prompt with no category descriptions, expecting the model to infer the category set.
• D. A zero-shot prompt that specifies the categories with their descriptions and the required output format.

You are evaluating a Claude-based deployment for adherence to a specific regulation.
Which two steps must be completed BEFORE mapping deployment data flows to specific regulatory clauses?
(Select two.)
Each correct answer presents part of the solution.

• A. Schedule the remediation work with the engineering team based on the prioritized gap findings.
• B. Identify the applicability of the regulation based on data types, jurisdiction, and audience.
• C. Document the identified gaps along with recommended remediations and residual risk for sign-off.
• D. Compare the in-place controls against the regulatory requirements to identify any compliance gaps.
• E. Inventory the vendor-provided compliance tooling and confirm which compliance affordances are in place.

A security audit uncovers two issues: (1) all end users share a single API key, and (2) tool calls are executed without logging the initiating user.
Which two mitigations directly address these specific findings? (Select two.)

• A. Replace the shared API key with per-user OAuth tokens carrying scope-restricted permissions.
• B. Enforce RBAC at the retrieval layer before content enters the model context.
• C. Move credentials out of the prompt context and resolve them from a server-side secret store.
• D. Validate structured outputs against a schema before downstream actions are executed.
• E. Add actor attribution to tool-call logs so each call records the initiating user identity.

You are selecting a model for a new production workload and must complete the upstream steps before testing candidate models empirically.
Which two steps must be completed BEFORE running a representative sample on a candidate model? (Select two.) Each correct answer presents part of the solution.

• A. Sign off the production rollout plan with the platform and security teams.
• B. Define the quality bar, latency tolerance, and expected volume for the workload.
• C. Retest the model choice when a new model version becomes available.
• D. Choose a candidate model based on the requirements profile and known capabilities.
• E. Select the lightest model that consistently meets the quality bar across the sample.

An architect is reviewing a Claude-based candidate-screening tool prior to deployment. A stakeholder asserts that because the model was not trained on company data, no bias evaluation is necessary.
Which two responses most accurately challenge this assertion? (Select two.)

• A. Transparency obligations are satisfied by disclosing that an AI system is in use, without further evaluation.
• B. Fairness testing is required only when the training dataset is known to contain protected-class labels.
• C. The system should be evaluated on outcome-disparity metrics across protected groups before deployment.
• D. The model may carry demographic biases from pretraining that manifest in screening outcomes regardless of fine-tuning.
• E. Bias evaluation is unnecessary when the model provider has published a responsible-use policy.