M3.9 module quiz
Ten questions. 80% to pass (8 of 10). Open book, unlimited retakes.
Answers are collapsed under each question. Answer first, then check.
Q1
Cloud IAM Import writes to:
A. The customer’s cloud IAM, written back
B. Both, to keep the two models in sync
C. A staging table pending a scheduled sync
D. ZopNight’s own users, teams and roles only
Show answer
Correct: D. It reads the customer’s cloud IAM and never modifies it in any direction. Being exact about this is the first thing a security reviewer tests.
Q2
Nothing applies automatically because:
A. The translation is unreliable across the three cloud providers’ models
B. Cloud IAM encodes intent about infrastructure, not about who should see the bill
C. Provider APIs are rate-limited on the principal listing calls
D. Emails are frequently missing from cloud IAM principals
Show answer
Correct: B. An S3 read role granted for a data pipeline would become a view of the organisation’s entire cloud spend, which nobody decided to give.
Q3
The three translation tiers are:
A. Automatic, manual and skipped
B. Read, write and admin grants
C. Per-provider, then per-account, then per-principal
D. Curated mapping, action translation, Needs Attention
Show answer
Correct: D. The staircase never guesses at the bottom: an unrecognised grant stops and asks rather than falling through to a default.
Q4
A role assumed only by a service account, with no human behind it, should usually be:
A. Imported with a PAT
B. Dropped
C. Imported as a team
D. Imported with Viewer for auditability
Show answer
Correct: B. A cost platform’s users are people who look at costs. If a non-human identity is genuinely needed, a PAT against a purpose-made user is the mechanism.
Q5
Which four policy families are never auto-imported?
A. role, user, assignment, organisation
B. resource, schedule, override, recommendation
C. report, audit-log, state-history, dashboard
D. cloud-account, integration, budget, team
Show answer
Correct: A. Not even for a principal holding AdministratorAccess. A tool that can import the ability to change the access model can import a wider one on the next run.
Q6
Promotion to Admin after an import happens:
A. Automatically on the second import run
B. By hand from Settings, as a separate audit-logged action
C. By re-running the import with a deliberately wider scope
D. Not at all; imported users keep their role
Show answer
Correct: B. An imported grant carries the intent of whoever wrote the cloud policy; a promotion carries the intent of the person clicking it, now, about ZopNight specifically.
Q7
An imported team named s3-readers should usually be:
A. Renamed after the suggestions are applied
B. Kept, since it reflects a real cloud group
C. Renamed after applying
D. Imported as a role rather than a team
Show answer
Correct: A. Cloud groups organise around infrastructure boundaries; importing one that does not correspond to a cost-accountable group degrades attribution while appearing to improve coverage.
Q8
Imported teams arrive empty when:
A. The teams were empty in the cloud
B. Membership is always assigned manually
C. The optional group-read grant is absent
D. Members were filtered during translation
Show answer
Correct: C. Reading a group’s existence and reading its membership are different permissions, and the group-read scope is optional because it is a wider read than cost management needs.
Q9
Re-import is:
A. Idempotent: the same principals resolve to the same entities
B. Blocked after the first run, to avoid duplicate entities
C. Additive, creating a duplicate entity for each principal
D. Destructive, replacing whatever prior state existed
Show answer
Correct: A. Which makes staged adoption safe and turns import into a reconciliation tool: run it quarterly and it shows the drift between your cloud and ZopNight access models.
Q10
The most valuable line in a quarterly re-import diff is:
A. New principals appearing since the last import run
B. Principals whose role changed
C. Principals that have disappeared from cloud IAM
D. The total principal count
Show answer
Correct: C. Those are usually leavers whose cloud access was removed during offboarding while their ZopNight access was not, because offboarding did not know ZopNight existed.
What’s next
Back to Cloud IAM Import.