M4.1 module quiz
Ten questions. 80% to pass (8 of 10). Open book, unlimited retakes.
Answers are collapsed under each question. Answer first, then check.
Q1
ZopNight ships with how many system roles?
A. Two: Admin and Viewer
B. Four, with SuperAdmin
C. Three: Admin, Editor, Viewer
D. It varies by contract plan
Show answer
Correct: C. Admin holds all policies with allResources; Editor has full CRUD on operational entities and view-only on administrative ones; Viewer is view-only everywhere.
Q2
The action vocabulary across entities is:
A. Entity-specific verbs such as apply and dismiss
B. read and write
C. Provider-dependent
D. Mostly view, create, update, delete, with exceptions
Show answer
Correct: D. Most entities use the four verbs, but some are view-only, recommendation has only view and update, and a few carry their own verb such as alert:resolve. There is no apply or dismiss verb.
Q3
A FinOps analyst must dismiss recommendations but not apply them. RBAC:
A. Can express it with a custom role scoped to the action
B. Cannot express it; both are recommendation:update
C. Can express it with team scoping on the resources
D. Can express it by granting it at Viewer level
Show answer
Correct: B. There is no recommendation:apply or recommendation:dismiss policy. Separating them is a job for the remediation approval gate, which is the control designed for it.
Q4
The three scope states are:
A. nil, [], [ids...]
B. allow, deny, inherit
C. read, write, none
D. global, team, resource
Show answer
Correct: A. nil is no filter at all, [] is zero visibility, and a list is team-scoped filtering. Collapsing empty into nil would silently promote a scoped-to-nothing user to seeing everything.
Q5
When the frontend gate and the gateway disagree:
A. The frontend wins
B. The gateway wins, always
C. The request is rejected
D. The more restrictive wins
Show answer
Correct: B. Frontend gates are a UX affordance so users are not shown controls that will fail. A user without the policy gets a 403 from the gateway and the backend never sees the request.
Q6
The policy table’s entity list is:
A. Open: every capability that ships with its own surface adds its own entity
B. A closed set of exactly 15 entities, fixed at release
C. Provider-specific, differing across the AWS, GCP and Azure catalogs
D. Configurable per organisation from the settings page
Show answer
Correct: A. Dashboards, budgets, autoscaler policies, IaC policy and the AI capabilities all arrived that way. New entities mostly reuse the same small set of verbs.
Q7
Editor cannot manage roles because:
A. Role management is Admin-only by convention rather than design
B. Editors lack the technical knowledge to manage roles safely
C. Roles are managed outside ZopNight, in the customer’s IdP
D. It prevents a compromised Editor account escalating itself
Show answer
Correct: D. It also means RBAC drift cannot happen silently: every role change is an Admin action and is audit-logged.
Q8
Team scoping and role scoping differ in that:
A. They are the same mechanism under two different names
B. The role defines what actions are possible; the team scope defines which data those actions apply to
C. Role scoping is deprecated in favour of team scoping
D. Team scoping is provider-specific, while role scoping applies across every provider alike
Show answer
Correct: B. They are independent dimensions, so a team-scoped Editor is a normal and useful combination rather than a special case.
Q9
Two rules explain most Editor-versus-Admin boundaries. They are:
A. Connecting a credential is Admin; changing who can change things is Admin
B. Read versus write access, and prod versus non-prod resource scope
C. Cost versus governance, and org versus team
D. Reversible versus irreversible operations
Show answer
Correct: A. Applying those two predicts the AI Gateway split, the cloud-account split and the integrations split without having to memorise each one.
Q10
IsResourceScopeablePolicy() determines:
A. Which policies a Viewer is allowed to hold at all
B. Which policies get written into the audit log whenever any caller uses them
C. Which policies can be narrowed to a set of resources versus being org-management-only
D. Which policies apply per cloud provider connected
Show answer
Correct: C. Organisation-management policies are all-or-nothing by nature, and the product decides which are scopeable rather than leaving it to the role author.
What’s next
Back to RBAC.