M3.3 module quiz
Ten questions. 80% to pass (8 of 10). Open book, unlimited retakes.
Answers are collapsed under each question. Answer first, then check.
Q1
The audit log records mutations only, for three reasons. Which is one?
A. Providers limit log volume, and the read stream would exceed the quota
B. Reads are already logged by the cloud provider, so it would duplicate
C. Reads outnumber mutations roughly 1,000 to 1, so logging them would multiply storage for minimal forensic value
D. Compliance forbids logging reads, since a read entry would record which user viewed which cost data and when
Show answer
Correct: C. The others are redundancy, since RBAC already controls read access, and focus, since the incident question is almost always what changed rather than who looked.
Q2
Request and response bodies are:
A. Stored verbatim, so an auditor sees exactly what was sent
B. Captured with a redaction pass and size limits, at the shared audit middleware layer
C. Captured only on failure, since success is evident from state
D. Captured only for Admin actions, which is what a compliance review examines
Show answer
Correct: B. The middleware is shared across all backend services, so capture is uniform with no per-service wiring, and the redaction happens before anything is persisted.
Q3
Audit events are written to:
A. MySQL directly, on the request write path
B. Object storage, appended per org
C. The cloud provider’s log service
D. Per-org Redis Streams, then synced to MySQL
Show answer
Correct: D. Per-org streams give real-time delivery, org-scoped isolation so one customer’s volume cannot affect another’s, and a durable buffer during the window before the database flush.
Q4
For SOC 2 evidence, the audit log can prove:
A. Everything an auditor asks about access control history
B. What changed, by whom, and when, with the request payload
C. Nothing usable without a SIEM export first
D. Only that the system was available and up
Show answer
Correct: B. It cannot prove what a user read, nor that a control was effective. Knowing the boundary is what stops an audit response over-claiming and failing on a follow-up.
Q5
Audit-log CSV export runs:
A. Synchronously, blocking the request until it finishes
B. On a nightly cron, with the request only registering it
C. Through the recommendations pipeline and its jobs table
D. As a background goroutine, streaming rows in timestamp chunks
Show answer
Correct: D. In-process concurrency is bounded, and there is no jobs table, so a pod restart drops progress silently and the user re-triggers.
Q6
A crashed recommendation export differs from a crashed audit-log export because it:
A. Retries automatically from the start
B. Resumes from the last checkpoint row
C. Appears as a failed row with a reason
D. Notifies the user immediately by email
Show answer
Correct: C. Recommendation exports persist; audit-log and cost-report exports do not. The sweeper does not auto-respawn, so the retry counter measures crashes rather than attempts on your behalf.
Q7
The recommendation workbook’s summary savings are:
A. De-duplicated per resource as a sum of max
B. A raw sum of every recommendation’s savings
C. The average per resource
D. The median
Show answer
Correct: A. Mutually-exclusive levers do not stack, so breakdown rows may not add to the overall total, and the sheet says so. A naive sum would promise savings the org could never capture.
Q8
Severity appears in the workbook’s summary but not as a detail column because:
A. It would make the exported sheet too wide to read
B. It is derived at read time and is not stored on the record itself at all
C. It is not surfaced in the product UI, and the export shows what the UI shows
D. It is only meaningful in aggregate, not per record
Show answer
Correct: C. An export mirroring the product rather than exposing everything the database holds is what keeps it defensible as a description of what the customer can see.
Q9
Completed exports are delivered via:
A. An email attachment sent directly to the requesting user
B. Direct download only, from the same page
C. An S3 bucket the customer owns and names
D. A short-lived signed download URL, also emailed for long jobs
Show answer
Correct: D. That URL is what the export.ready notification event carries, which is what makes closing the tab safe.
Q10
Which is NOT captured in an audit log entry?
A. The rendered UI state at the time
B. The acting user’s own identity
C. The full response body
D. The HTTP method and path
Show answer
Correct: A. The log records the API interaction. Reconstructing what a screen looked like is not something an API log can do, and claiming otherwise in an audit response is a trap.
What’s next
Back to Audit logging.