M6.5 module quiz
Ten questions. 80% to pass (8 of 10). Open book, unlimited retakes.
Answers are collapsed under each question. Answer first, then check.
Q1
The four write tiers are:
A. read, write, admin and owner, granted per user
B. off, low, medium and high, set per organisation
C. viewer, editor, admin and superadmin, mirroring RBAC
D. none, metadata-only, reversible, irreversible
Show answer
Correct: D. none is the default, and tier 3 additionally requires a token bound to the organisation, so a personal token cannot reach it even in an org configured for it.
Q2
Raising the org tier to 2 gives a Viewer:
A. All reversible mutations
B. Nothing
C. Reversible mutations on their own team’s resources
D. Metadata-only mutations
Show answer
Correct: B. The gateway intersects org tier with the caller’s live role. The tier is a ceiling, not a grant: raising it never gives anyone a capability they lacked in the UI.
Q3
Which is never exposed at any tier?
A. Deleting a budget or schedule
B. Stopping or starting a resource
C. RBAC and user management
D. Setting a schedule override
Show answer
Correct: C. Along with organisation and cloud-account deletion, credential access and bulk actions. Raising to tier 3 does not reach any of them.
Q4
No bulk-action tool exists at any tier because:
A. A fan-out mutation turns one mis-parsed instruction into an estate-wide event
B. Bulk actions are slow and would time out at the MCP request boundary
C. The API does not support them, so there is no tool to expose in the first place
D. They were removed later, after an incident, and have not been reinstated since
Show answer
Correct: A. The product does have bulk start/stop in the UI, so this is a deliberate exclusion from the agent surface rather than a capability gap.
Q5
Credentials are never exposed because:
A. They are encrypted at rest, so the plaintext is never available to return
B. A credential in an LLM context window is a secret that does not come back
C. Providers forbid it in their terms, and doing so would breach the contract
D. They are not stored in a retrievable form, only as a one-way hash
Show answer
Correct: B. get_service_config redacts every environment-variable value for the same reason: the context window is not a place a secret can be recalled from.
Q6
The global kill switch relates to the org tier as:
A. An alternative to the per-org write tier, so an organisation configures one or the other but never both
B. A UI-only control, so the setting hides the mutating tools without changing what the gateway will run
C. A layer above it: with the switch off, the whole write surface is inert regardless of any org’s tier
D. A per-org setting, so one organisation can disable writes while others carry on unaffected
Show answer
Correct: C. It exists so an in-development surface is inert at merge, which is the one legitimate use of an environment variable in this design.
Q7
The right first question when asked to enable MCP writes is:
A. “Which write tier do we need to unlock the tools engineers keep asking for?”
B. “What does security think about letting an agent mutate production infrastructure?”
C. “What do our peers do, and are we behind the industry on agent-driven operations?”
D. “Which specific write does someone do repeatedly, where the agent already did the reasoning?”
Show answer
Correct: D. Starting from the tier is unanswerable because it is a capability class rather than a workflow. If the question produces no specific write, the answer is to stay at none.
Q8
A request to let the agent apply cost recommendations should be:
A. Granted at tier 2, since a scale-down is reversible and reversible writes are what tier 2 unlocks
B. Granted at tier 3 with an org-bound token, because scaling a production workload is treated as irreversible
C. Routed to auto-remediation, which has an allowlist, an approval gate, a fail-closed safety gate and per-step audit
D. Refused without explanation, so an agent cannot infer which capabilities exist behind the tier boundary
Show answer
Correct: C. The request is legitimate and the surface is wrong. Moving it to MCP would trade a purpose-built control for a general-purpose one.
Q9
Moving from tier none to tier 2 changes the threat model by:
A. Giving prompt injection an executable path, bounded by the caller’s RBAC role
B. Nothing, since RBAC still applies and bounds every call to the caller’s role
C. Allowing privilege escalation, because a write tier widens what the role can do
D. Enabling bulk deletion, since a mutating surface exposes the fan-out tools too
Show answer
Correct: A. RBAC bounds the damage; it does not prevent the class. Being able to state that precisely, in both directions, is what makes the decision defensible.
Q10
The strongest reason to stay at tier none is:
A. Writes are inherently unsafe, and no configuration makes an agent-driven mutation acceptable
B. Security has not approved it, and the review is still open with no decision expected this quarter
C. The org worked the decision and could not name a specific, frequent write where an agent is genuinely faster
D. Nobody has asked, so the capability sits unused rather than being deliberately left switched off
Show answer
Correct: C. A overstates the case and will not survive a conversation with someone who has read the tier model. B and D are both “not yet”, which invites the question again next quarter with no better information.
End of document. 600 questions across 60 modules.