M6.2 module quiz
Ten questions. 80% to pass (8 of 10). Open book, unlimited retakes.
Answers are collapsed under each question. Answer first, then check.
Q1
The ZopNight MCP server is:
A. A hosted service at one URL, reached by OAuth sign-in or a PAT bearer header
B. A local npm package, installed alongside the client on every machine
C. A browser extension that injects the tool list into the context window
D. A CLI tool run locally, proxying every request to the ZopNight API over stdio
Show answer
Correct: A. Which is why setup points the client at the Server URL rather than installing a ZopNight package. OAuth is the default; a PAT is for CI and clients that cannot open a browser.
Q2
The correct verification of the tool list is:
A. Confirming the list matches the total published in the docs
B. Counting the read tools only and ignoring the mutating ones
C. Comparing it against another engineer’s advertised list
D. Confirming it is non-empty and matches the org’s write tier
Show answer
Correct: D. The count is a property of the caller, so a fixed number is the wrong check. What matters is whether mutating tools appear when they should not.
Q3
Seeing a create_ or delete_ tool advertised on an org you believe is at tier none is:
A. Normal, since advertised tool lists vary between clients
B. A caching artifact that clears on the next reconnect
C. A finding to escalate before using the connection
D. Expected for Admins, who see the full tool surface
Show answer
Correct: C. The gateway filters tools/list to what the caller may call, so their presence contradicts the stated configuration.
Q4
PAT scope is:
A. Your live role, the org’s write tier, and the write capabilities ticked at mint
B. A copy of your role, fixed at the moment the token is minted
C. Set by the MCP server itself, independently of the caller’s live role
D. Always full access, with RBAC applied only in the web interface
Show answer
Correct: A. The gateway intersects all three on every call. Per-PAT scoping narrows writes only (and the orgs the token is bound to); reads follow your live role, never a snapshot taken at mint.
Q5
A PAT should be supplied to a client via:
A. A config file committed to the repo
B. An environment variable
C. A shared document
D. A URL parameter
Show answer
Correct: B. Committing a PAT is the most common setup mistake, which is why the PAT configurations reference an environment variable rather than a literal. With OAuth there is no token to supply at all.
Q6
An engineer connecting Cursor on their laptop should usually:
A. Mint a PAT and paste it into the shared team config
B. Install a local ZopNight server package first
C. Send an org header so the gateway can find the org
D. Add the Server URL and sign in with OAuth in the browser
Show answer
Correct: D. OAuth is the default for any client that can open a browser: no token is copied or stored by hand, and the grant can be revoked from Connected Apps. There is no local package and no org header; the org rides in each tool call.
Q7
Multi-org access from one client is achieved by:
A. Switching orgs in the UI before each agent session
B. One PAT per org, required as separate server entries
C. One token bound to several orgs, org chosen per call
D. It is not supported; one org per client at a time
Show answer
Correct: C. A PAT is bound at creation to the orgs you select (an OAuth grant to the orgs you tick at consent), and the org is chosen per tool call with a membership check. Separate entries are allowed but not required.
Q8
The verification checklist’s error-path step confirms:
A. That the server handles malformed input without crashing the session
B. That retries work, and that a transient failure resolves on a second attempt
C. That errors are logged with enough detail to reconstruct what was tried
D. That an ungranted tool is never advertised, so the agent has no path to attempt it
Show answer
Correct: D. The refusal you should see is the agent saying it has no such tool, rather than a permission error from an attempted call.
Q9
After a role change, an agent’s available surface:
A. Updates at the next PAT rotation
B. Updates within about 30 seconds
C. Requires a client restart
D. Is cached for 24 hours
Show answer
Correct: B. RBAC is resolved live at the gateway rather than snapshotted at grant time. The gateway caches permission answers for up to 30 seconds by default, so a narrowed role applies within about that long, with no rotation or restart.
Q10
A shorter-than-expected tool list is most often:
A. A broken connection that needs the client restarting
B. A stale server that has not reloaded its tool list
C. Correct authorisation, following a role or tier change
D. A rate limit, which trims the advertised surface
Show answer
Correct: C. Confirm with an admin before regenerating a PAT: a new token does not widen a role, and treating authorisation as a fault wastes the investigation.