M4.4 module quiz
Ten questions. 80% to pass (8 of 10). Open book, unlimited retakes.
Answers are collapsed under each question. Answer first, then check.
Q1
The strongest argument for multi-account is:
A. Billing separation
B. Blast-radius isolation
C. Higher API quotas
D. Regional compliance rules
Show answer
Correct: B. Billing separation matters and is easier to explain to finance, but the account boundary is the hardest wall each cloud offers, and that is what limits the damage of a mistake.
Q2
A new AWS account is created under your AWS Organization. ZopNight:
A. Discovers it automatically through the management account
B. Picks it up at the next six-hourly discovery cycle
C. Inherits the role from the OU the account was placed in
D. Does not see it until you create its stack and connect it
Show answer
Correct: D. ZopNight connects each AWS account on its own: there is no Organizations-level connector and no StackSet rollout, so a new account is never found automatically. Put it on your account-creation checklist: launch the CloudFormation stack in the new account, paste the role ARN into ZopNight, and it is discovered straight away.
Q3
An Azure tenant-scoped account:
A. Auto-discovers subscriptions and creates a child account per subscription, with cascading operations
B. Is a leaf node exactly like a subscription, so one credential covers only one billing boundary
C. Requires one credential per subscription, registered separately
D. Cannot be used for discovery, and only groups subscriptions
Show answer
Correct: A. The cascade is what surprises people during a credential rotation: rotating the parent rotates every child.
Q4
Azure workload identity federation, one of the two ways to connect an Azure account, removes:
A. The need for an app registration at all
B. Cross-subscription access to resources
C. The need to store a long-lived client secret
D. The role assignment step at setup
Show answer
Correct: C. The app registration still exists; what disappears is the client secret, which is the artifact that leaks.
Q5
The anti-pattern whose fix is the single highest-impact split is:
A. One separate account per microservice
B. Prod and non-prod mixed in one account
C. Per-engineer accounts
D. A shared services account
Show answer
Correct: B. It defeats the blast-radius argument that justified multi-account in the first place, and it makes non-prod scheduling risky because a mistake reaches production.
Q6
Per-engineer and per-microservice accounts are anti-patterns because they:
A. Multiply operational overhead without adding isolation that matters
B. Are forbidden by the providers’ own account limits
C. Break billing consolidation across the whole of the organisation
D. Cannot be discovered by the inventory APIs at all
Show answer
Correct: A. They are the over-correction: the isolation boundary is placed where nothing needs isolating, and every account carries setup, credential and monitoring cost.
Q7
Rollup and isolation views differ in that rollup:
A. Is faster to compute across a large and steadily growing number of cloud accounts
B. Excludes non-prod accounts from the total
C. Aggregates across accounts for a total; isolation keeps them separate for accountability
D. Uses billing cost only, never rack rate
Show answer
Correct: C. The audience decides which is right: leadership wants the total, a team wants their own account. Presenting the wrong one is how a cost review stalls.
Q8
AWS Organizations, GCP folders and Azure management groups all enable:
A. Cross-account networking between VPCs
B. Shared credentials across the accounts
C. Unified logging into one destination
D. Policy inheritance down a hierarchy
Show answer
Correct: D. Inheritance is what makes governance tractable at scale, and it is why the organisational hierarchy matters to cost attribution even though it is not itself a cost concept.
Q9
A shared-services account holds:
A. Nothing at all; the OU is purely a billing rollup construct here
B. Cross-cutting infrastructure such as networking, CI and shared tooling
C. Production workloads only, by convention
D. Backup copies of the other accounts
Show answer
Correct: B. Its cost then needs attributing back to consuming teams, which is why shared-resource attribution exists as a distinct problem in showback design.
Q10
Cross-account discovery timing on a large estate is bounded by:
A. The total number of resources discovered across all the accounts
B. The billing sync cadence for the organisation
C. The per-account credential assumption plus each account’s own discovery
D. Network latency between the account regions
Show answer
Correct: C. Which is why a many-account estate has a longer first-discovery than a single large account with the same resource count.
What’s next
Back to Multi-account architecture.