M6.2 module quiz
Ten questions. 80% to pass (8 of 10). Open book, unlimited retakes.
Answers are collapsed under each question. Answer first, then check.
Q1
The ZopNight MCP server is:
A. A hosted service reached through a generic bridge, with the PAT as a bearer credential
B. A local npm package, installed alongside the client on every machine
C. A browser extension that injects the tool list into the context window
D. A CLI tool run locally, proxying every request to the ZopNight API over stdio
Show answer
Correct: A. Which is why setup configures a bridge command rather than installing a ZopNight package, and why the endpoint is a URL rather than a binary.
Q2
The correct verification of the tool list is:
A. Confirming the list matches the documented count of 275
B. Counting the read tools only and ignoring the mutating ones
C. Comparing it against another engineer’s advertised list
D. Confirming it is non-empty and matches the org’s write tier
Show answer
Correct: D. The count is a property of the caller, so a fixed number is the wrong check. What matters is whether mutating tools appear when they should not.
Q3
Seeing a create_ or delete_ tool advertised on an org you believe is at tier none is:
A. Normal, since advertised tool lists vary between clients
B. A caching artifact that clears on the next reconnect
C. A finding to escalate before using the connection
D. Expected for Admins, who see the full tool surface
Show answer
Correct: C. The gateway filters tools/list to what the caller may call, so their presence contradicts the stated configuration.
Q4
PAT scope is:
A. The user’s own policies, intersected with the org write tier at the gateway
B. Configured per PAT and fixed at the moment the token is minted
C. Set by the MCP server itself, independently of the caller’s live role
D. Always full access, with RBAC applied only in the web interface
Show answer
Correct: A. Per-PAT scoping is deliberately not supported: it would be a configuration explosion with no additional safety over the user’s own role.
Q5
A PAT should be supplied to a client via:
A. A config file committed to the repo
B. A shared document
C. An environment variable
D. A URL parameter
Show answer
Correct: C. Committing a PAT is the most common setup mistake, and it is why the documented configurations reference environment variables rather than literals.
Q6
Node version required for the bridge is:
A. 14+
B. 16+
C. 20+
D. 18+
Show answer
Correct: D. A mismatched Node version is one of the three most common setup failures, alongside a wrong config path and an unset environment variable.
Q7
Multi-org access from one client is achieved by:
A. Switching orgs in the UI before each agent session
B. One PAT per org, configured as separate server entries
C. A single PAT covering all orgs the user belongs to
D. It is not supported; one org per client at a time
Show answer
Correct: B. A PAT is user-scoped and the org is resolved per call with a membership check, so separate entries with distinct environment variables keep the boundary explicit.
Q8
The verification checklist’s error-path step confirms:
A. That the server handles malformed input without crashing the session
B. That retries work, and that a transient failure resolves on a second attempt
C. That errors are logged with enough detail to reconstruct what was tried
D. That an ungranted tool is never advertised, so the agent has no path to attempt it
Show answer
Correct: D. The refusal you should see is the agent saying it has no such tool, rather than a permission error from an attempted call.
Q9
After a role change, an agent’s available surface:
A. Updates at the next PAT rotation
B. Updates on the next call
C. Requires a client restart
D. Is cached for 24 hours
Show answer
Correct: B. RBAC is resolved live at the gateway rather than snapshotted at grant time, so narrowing a role narrows the surface immediately.
Q10
A shorter-than-expected tool list is most often:
A. A broken connection that needs the client restarting
B. A stale server that has not reloaded its tool list
C. Correct authorisation, following a role or tier change
D. A rate limit, which trims the advertised surface
Show answer
Correct: C. Confirm with an admin before regenerating a PAT: regenerating a token does not widen a role, and treating authorisation as a fault wastes the investigation.