M6.3 module quiz
Ten questions. 80% to pass (8 of 10). Open book, unlimited retakes.
Answers are collapsed under each question. Answer first, then check.
Q1
A ZopNight PAT is:
A. User-scoped, bound at mint to orgs you pick
B. Org-scoped, with no user identity behind it
C. Resource-scoped, listing the allowed ids
D. Role-scoped, carrying a role frozen at mint
Show answer
Correct: A. It carries your identity and is bound at mint to the orgs you choose (only ones you belong to). Membership and your live role are still checked on every call.
Q2
Removing a user from the organisation:
A. Leaves their PATs working there
B. Requires manual PAT revocation
C. Transfers PATs to an admin
D. Ends their PATs’ access to it
Show answer
Correct: D. Membership is re-resolved on every call, so offboarding takes effect on the next request without a separate credential-cleanup step. That is also why a PAT is not a service credential.
Q3
For a non-human integration, the right pattern is:
A. Share one human’s PAT across the whole team
B. A PAT against a purpose-made user with an appropriate role
C. An org-level API key with no user behind it
D. A cloud provider service account, reused for ZopNight access
Show answer
Correct: B. It keeps attribution meaningful and makes revocation a single action that does not disrupt a person.
Q4
The org-level MCP toggle is:
A. On by default, and disabled per organisation
B. Per user, set from the user’s own profile page
C. A central kill switch for the whole MCP surface
D. Per PAT, chosen when the token is minted
Show answer
Correct: C. Disabling it stops all MCP access for the org regardless of individual PATs, which is what makes it usable as an incident control.
Q5
MCP audit logging captures:
A. Mutations only, exactly like the REST audit log
B. Reads and mutations, with read responses dropped
C. Nothing; MCP traffic bypasses the audit path
D. Failures only, recorded with the error message
Show answer
Correct: B. Every row carries a source discriminator, which is what allows MCP usage to be separated from UI activity in reporting.
Q6
A stolen PAT lets an attacker:
A. Change the organisation’s configuration and tier
B. Reach other orgs that the user does not belong to
C. Read what that user could read, subject to the org tier
D. Escalate privileges beyond that user’s live role
Show answer
Correct: C. Which bounds the incident to data exposure at tier none, and is why the audit trail plus revocation are the response rather than a broader lockdown.
Q7
PAT rotation should:
A. Mint the replacement, update clients, then revoke the old one
B. Revoke the old token first, then mint and distribute
C. Happen only on compromise, since rotation breaks clients
D. Be automatic, with the gateway reissuing tokens on expiry
Show answer
Correct: A. Revoking first creates a window where nothing works, which is the avoidable outage in an otherwise routine operation.
Q8
Rotation is best automated through:
A. A shared spreadsheet holding one row per issued token and owner
B. A secret manager holding the PAT, with clients reading from it
C. Manual calendar reminders set for each token’s expiry
D. Re-running the setup flow, which mints a fresh token
Show answer
Correct: B. It converts rotation from a coordination problem across every client into a single write, which is what makes a real rotation cadence sustainable.
Q9
On a lost or stolen device, the first action is:
A. Change the user’s account password
B. Disable the organisation’s MCP toggle
C. Audit the last week of tool calls
D. Revoke the PATs on that device
Show answer
Correct: D. Revocation is immediate and bounded; auditing follows to establish what was accessed. Reversing the order leaves the credential live during the investigation.
Q10
MCP audit anomalies worth alerting on include:
A. Any tool call at all, since a PAT should not be calling tools unattended
B. Read calls specifically, since reads are what an exfiltration attempt looks like
C. Unusual volume, unusual hours, or tool diversity inconsistent with the user’s role
D. Failed calls only, because a call that succeeded was authorised by definition
Show answer
Correct: C. These are the signals a stolen PAT produces, and they are detectable precisely because reads are audited rather than dropped.
What’s next
Back to PATs, org-level toggle, audit.