A security audit uncovers two issues: (1) all end users share a single API key, and (2) tool calls are executed without logging the initiating user.
Which two mitigations directly address these specific findings? (Select two.)

• A. Replace the shared API key with per-user OAuth tokens carrying scope-restricted permissions.
• B. Add actor attribution to tool-call logs so each call records the initiating user identity.
• C. Validate structured outputs against a schema before downstream actions are executed.
• D. Move credentials out of the prompt context and resolve them from a server-side secret store.
• E. Enforce RBAC at the retrieval layer before content enters the model context.

You are evaluating an evaluation set used to score a Claude-based hiring-support tool. The set is drawn from one geographic region and one tenure band.
Which response is most appropriate?

• A. Continue using the narrow evaluation set drawn from one region and one tenure band because the existing benchmark scores are already high on that subset.
• B. Discard all quantitative evaluation and replace it with qualitative impressions collected from a small, convenience-selected group that may not represent the tool's full user population.
• C. Expand the evaluation set to cover the geographic regions and tenure bands the tool will serve, and rescore the system on the expanded set before broader release.
• D. Reduce the evaluation set further to a single demographic subgroup to simplify score interpretation, narrowing coverage rather than expanding it to match the intended user population.

You are reviewing an integration specification for security gaps.
Which two findings constitute valid security gaps in the specification? (Select two.) Each correct answer presents a complete solution.

• A. Role-based access control is enforced only at the response-rendering layer after the model accesses restricted data.
• B. Tool inputs and outputs are encrypted in transit using transport-layer security between services.
• C. Service credentials are placed in the prompt context, where they can leak into logs and traces.
• D. Tool calls execute server-side under a least-privilege service principal scoped to the requested action.
• E. Per-user OAuth tokens are exchanged with scope-restricted permissions and refreshed within the active session.

You are diagnosing a Claude Code session whose subagent uses 50,000 tokens of context before the engineer types a single message.
Which root cause is most likely?

• A. The developer ' s keyboard layout or input-method configuration is the cause of the elevated context consumption, introducing extra tokens before the engineer types any message.
• B. Many MCP servers are configured, each contributing tool definitions to the context budget; Tool Search is not enabled, so all definitions load upfront.
• C. The model has internal personal preferences or default behaviors that silently consume large portions of context budget before any user message is processed, independent of tool configuration.
• D. The font rendering or display-scaling settings of the IDE are converting visual output into additional context tokens, causing the high pre-session context consumption.

You are assessing a Claude-based system whose dominant risk is silent quality drift on safety-relevant outputs after a model-version upgrade.
Which assessment activity most directly addresses this risk?

• A. Maintain an adversarial evaluation set with version-attributed scoring so each upgrade is measured against the same set before promotion.
• B. Rotate adversarial inputs randomly so no two upgrades are scored on the same set.
• C. Skip evaluation on each model-version upgrade and rely on user-submitted complaints to surface safety drift after the upgraded model has already served production traffic.
• D. Disable adversarial evaluation entirely during model-version upgrade cycles to reduce evaluation cost, accepting that safety drift will go undetected until it appears in production.