14% of the exam — about 9 of the 63 questions — across 5 sub-objectives.
The recurring mistake here is treating one filter as a finished design.
A guarded request path has three separate decision points, each answering a different question. Input screening runs before the model call and decides whether the request reaches the model. Output screening runs before the response reaches the user. Tool-call authorization runs before any action with a side effect and decides whether this caller may do this thing. A control at one point does nothing for the other two, which is why questions describing a single output filter usually want you to name what it cannot see.
Fairness is worth more attention than its share of the syllabus suggests. Several questions on the real paper turned on it, enough to be noticeable rather than incidental.
Implement guardrails and safety controls
Match the kind of check to the decision point. Input screening often wants a model-based check, because injection and jailbreak phrasing cannot be enumerated in rules. Output screening often wants one too, since toxicity and policy compliance need language understanding. Tool-call authorization wants a deterministic check almost always, because authorization has to be auditable and an allowlist can be reasoned about after the fact.
Chain them, because they fail in opposite directions. A model-based classifier can be talked around. A deterministic rule blocks exactly what it was written for and nothing adjacent. Layering covers each one's blind spot.
Two vectors get missed. Instructions can arrive through retrieved content and tool output, not only through the user's message, so anything ingested is untrusted data rather than instruction. And a guardrail layer needs a defined behavior when it fails: whether it fails open and lets traffic through, or fails closed and blocks it, is a decision the design should state rather than discover during an outage.
From the free practice form
A regional bank deploys a Claude-powered assistant that answers customer questions about their own accounts. The team's only safety control is a system-prompt instruction: 'Never reveal information about accounts other than the authenticated user's.' During a red-team exercise, a tester uses a multi-turn injection to get the model to summarize another customer's transactions, because the retrieval layer fetches records by whatever account number appears in the conversation. Which change most directly fixes the vulnerability?
Second question, same objective
A pediatric clinic's patient-facing chatbot answers logistics questions about appointments and billing. Occasionally patients type messages describing urgent symptoms or self-harm. The current design relies on the LLM's general helpfulness to respond appropriately, and post-launch transcripts show inconsistent handling — sometimes an escalation suggestion, sometimes a generic reply. The team wants deterministic handling of these safety-critical messages. Which architecture best achieves this?
Identify risks, limitations, and failure modes of LLM systems
The risk assessment is a deliverable, not a mood. The exam wants categories you can point at in an architecture: where does unverified content enter, where can the model take an action, where does the system assert something it cannot substantiate, and where would a failure be invisible.
The limitation worth naming precisely is that the model has no reliable way to know its information is stale and will not flag the gap. Any design that makes the model the source of truth for something a system already owns inherits that silence.
Failure modes differ by architecture. A single call fails visibly. A workflow fails at a step you can identify. An agent can fail by succeeding at the wrong thing, repeatedly, without erroring once, and that is the one requiring deliberate detection.
From the free practice form
A hospital's clinical documentation assistant summarizes physician dictations into structured notes. During validation, reviewers find that in about 2% of notes the summary includes a plausible-sounding medication dosage that was never dictated. The engineering team insists this is a retrieval bug, but the system performs no retrieval — it works only from the dictation transcript provided in the prompt. What is the most accurate characterization of this failure?
Second question, same objective
A brokerage launches an LLM agent that can read customers' portfolio data and file support tickets via internal APIs. It also summarizes attachments customers upload with their support requests. Security review must prioritize the two most serious risks introduced by this specific design before launch. Which two should top the list?
Apply human-in-the-loop validation strategies
Checkpoint placement is a design decision, and the exam tests where rather than whether.
A review that happens after a side effect is theatre. If an agent can send the email, issue the refund, or write to the record before a human sees anything, the checkpoint is in the wrong place regardless of how good the review is. Put the gate before the irreversible step.
Calibrate to reversibility and stakes. Routine, reversible, low-cost actions should not queue for approval, because a checkpoint on everything gets rubber stamped and stops being a control. Reserve human attention for the actions where a wrong call is expensive or cannot be undone, and let the rest proceed.
Sampling is a detection method rather than a gate. It tells you the error rate; it does not stop a specific bad action.
From the free practice form
An insurance company uses an LLM to draft claim-denial letters. To satisfy regulators, every letter is routed to a claims adjuster who must click 'Approve' before it is sent. Adjusters each receive roughly 400 letters per day, approve 99.7% of them, and average 11 seconds per review. A regulator's audit later finds several denials that misstated policy terms and were approved. What is the fundamental flaw in this human-in-the-loop design?
Second question, same objective
A government benefits agency processes 50,000 LLM-extracted eligibility summaries per month. Leadership mandates human validation but can staff only enough reviewers to cover about 8% of the volume. The team must decide how to allocate this limited review capacity. Which strategy uses the humans most effectively as a control?
Ensure compliance with regulations (e.g., GDPR, HIPAA, FedRAMP)
Compliance questions are usually data-path questions. What enters the context window, where the request terminates, and what your own application writes to its logs.
The context window is not a governance boundary. Data passed into a call travels, and it lands in your application logging on the way, which is why redaction belongs before the call rather than after an incident. For every field, ask whether the model needs it to produce the output. A claim number usually yes, a full record usually not.
Delivery route is where residency requirements land. If a scenario names a jurisdiction or a cloud commitment, it is constraining where the request terminates and nothing else. Verify residency guidance against the specific regulation rather than assuming a region satisfies a rule.
From the free practice form
A telehealth startup is building an LLM feature that suggests appointment-scheduling responses to patient portal messages. The proposed design sends each patient's full message history — including diagnoses and medication lists — to a third-party LLM API to 'give the model maximum context.' The vendor will sign a business associate agreement (BAA). The privacy officer objects. Under HIPAA's requirements, what is the strongest architectural criticism of this design?
Second question, same objective
A SaaS vendor sells an LLM-based case-management assistant to US federal agencies and to EU-based enterprises from the same multi-tenant deployment. The architecture stores all conversation logs, including user-submitted personal data, indefinitely in a single US region, and the LLM inference endpoint is a commercial API with no government authorization. The compliance team is asked which combination of obligations this design most clearly fails. What should they answer?
Address ethical AI considerations (bias, fairness, transparency)
Fairness questions ask two things: how a system comes to treat groups differently, and what it can account for once it has.
Unequal outcomes enter through data, through prompt framing, and through the threshold you set on a score, and a design that treats fairness as the model provider's problem has no answer for any of them. The credited answers usually involve measuring outcomes across groups rather than asserting neutrality.
Transparency on this exam means the decision can be reconstructed. If a person is affected by a decision the system influenced, can you say what inputs produced it, which version of the prompt and model ran, and who reviewed it. That is a logging and versioning requirement, and it is why decision logging shows up in scenarios that look like ethics questions.
From the free practice form
A city government pilots an LLM system that screens rental-assistance applications and drafts a recommendation of 'likely eligible' or 'needs review.' An advocacy group finds that applications written in non-standard English are flagged 'needs review' at three times the rate of others, even with identical financial facts. The program director proposes adding a disclaimer to every recommendation stating that a human makes the final decision. Why is this response inadequate?
What I would do differently
The other 0% on my score report was here: compliance with regulations, the GDPR and HIPAA and FedRAMP material. Every other sub-objective in this domain scored 100%.
This one is different from the rest of the exam. Most of the paper rewards architectural judgement you can reason your way to from first principles. This does not. It rewards knowing what a specific regulation actually obliges you to do, and reasoning from general privacy instincts will produce a confident wrong answer. Reading the material once, which was enough everywhere else, was not enough here.
If you are short on time, this is the section to read twice.