You are running a discovery engagement for a new Claude-based capability and must complete the requirements-gathering steps before validating with stakeholders.
Which two steps must be completed BEFORE validating the captured requirements with stakeholders? (Select two.) Each correct answer presents part of the solution.

• A. Produce architecture decision records that capture the rationale for major design choices.
• B. Document the consolidated requirements with traceability to the source stakeholder for each item.
• C. Capture the business goals, success criteria, and the in-scope user population for the engagement.
• D. Identify the non-functional constraints covering latency, cost, audit, data sensitivity, and regulatory needs.
• E. Schedule the rollout milestones and dependencies with engineering and product partners.

An architect at Trenova Systems, Inc. is reviewing two draft communication packages for the same architectural decision. Package 1 contains a threat model, residual-risk register, and control-mapping table.
Package 2 contains a list of capabilities delivered and feature-level roadmap dependencies.
Which two audiences are correctly matched to these packages? (Select two.)

• A. Package 2 # security and compliance reviewer
• B. Package 2 # product manager owning the roadmap
• C. Package 1 # security and compliance reviewer
• D. Package 1 # engineering implementation team
• E. Package 2 # executive sponsor

You are reviewing a peer's Claude Code permission rules for an enterprise rollout. The rules grant unrestricted Bash access to all projects across all developers.
Which response is most appropriate?

• A. Disable all permission rules for the enterprise rollout so every command across every project runs without any tool-pattern scoping or explicit deny rules for sensitive operations.
• B. Add unrestricted access to additional tool categories as well, so that Bash is not asymmetrically more permissive than other tools, expanding the attack surface further in the name of consistency.
• C. Replace unrestricted Bash with narrowly scoped tool patterns that allow only the specific commands the workflows require, and add explicit deny rules for sensitive operations.
• D. Approve the unrestricted Bash access as written on the grounds that narrowing the rules would add configuration complexity, accepting the full attack surface for all engineers across all projects.

You are reviewing an integration specification for security gaps.
Which two findings constitute valid security gaps in the specification? (Select two.) Each correct answer presents a complete solution.

• A. Tool inputs and outputs are encrypted in transit using transport-layer security between services.
• B. Per-user OAuth tokens are exchanged with scope-restricted permissions and refreshed within the active session.
• C. Service credentials are placed in the prompt context, where they can leak into logs and traces.
• D. Tool calls execute server-side under a least-privilege service principal scoped to the requested action.
• E. Role-based access control is enforced only at the response-rendering layer after the model accesses restricted data.

You are defining an SLA for a Claude-based assistant.
Which SLA definition is most operationally meaningful?

• A. A measurable target with a defined metric, threshold, evaluation window, and consequence for breach- for example, "p95 per-request latency under 800 ms over a 28-day window."
• B. A target tied to a stakeholder sentiment measure such as "the team feels satisfied," which cannot be measured objectively or used to trigger a documented breach response.
• C. A target that names the metric and threshold but omits the evaluation window and breach consequence, leaving compliance periods and remediation triggers undefined.
• D. A qualitative commitment such as "the system will be fast and reliable," which names no metric, threshold, or evaluation window.