M3.8 module quiz
Ten questions. 80% to pass (8 of 10). Open book, unlimited retakes.
Answers are collapsed under each question. Answer first, then check.
Q1
ZopNight’s role in IaC governance is:
A. Enforcement: it blocks the merge itself inside the CI pipeline
B. Both decision and enforcement, in one
C. Decision: it emits a verdict the customer’s required check enforces
D. Advisory only, with no CI integration
Show answer
Correct: C. It never runs apply, so it holds no credential that can change infrastructure; your required check does the enforcing.
Q2
If ZopNight is unreachable when a pull request runs the shipped workflow:
A. The check fails, so a required check blocks the merge until it recovers
B. The last known decision is reused
C. Policies are disabled for the duration of the outage and all deploys proceed anyway
D. The check is skipped and the merge goes ahead unchecked
Show answer
Correct: A. The shipped workflow exits with an error when the ZopNight call fails, so the check goes red. If you want it to fail open instead, change that step and agree the policy before adopting the gate.
Q3
The two modes are:
A. Plan first and then apply, in precisely that order
B. A PR gate over a plan, and an inventory scan over state
C. Dry run first, then enforce
D. Sync and async evaluation
Show answer
Correct: B. The scan is the underused one: it links declared resources to discovered inventory and produces the managed-versus-orphan split.
Q4
An “orphan” in an inventory scan is:
A. A resource in the cloud that is not declared in IaC
B. A resource declared in IaC that no longer exists
C. A resource with no owner tag applied to it
D. A corrupted entry in the state file
Show answer
Correct: A. Orphans are where drift originates, where untagged resources cluster, and where the next apply will not help, which makes the ratio a maturity signal.
Q5
Custom policies are written in:
A. YAML, evaluated in-process by the scanner
B. A ZopNight-specific DSL
C. Rego, sandboxed with no network or clock access
D. Terraform, run in dry mode
Show answer
Correct: C. The sandbox makes a policy a pure function of the plan, so the same plan yields the same decision today and next month.
Q6
The OPA runtime loads:
A. Always, on every scan
B. Lazily, only when a Rego policy is present
C. Per repository, at setup
D. Only on the very first pull request run
Show answer
Correct: B. Native-first, so an org running builtins only never pays for it, which makes “start with builtins and add Rego later” a real strategy.
Q7
Builtin rules are tagged with compliance frameworks so that:
A. Severity can be derived from the framework
B. They can be enabled or disabled per compliance framework from settings
C. Different Rego dialects apply per framework
D. “Which of our IaC controls map to SOC 2” can be read off the rules themselves
Show answer
Correct: D. Each builtin rule carries its framework tags (CIS, PCI, SOC 2, HIPAA, NIST, ISO, FinOps), shown when you pick it in the policy wizard. Otherwise it is someone reading rule descriptions and making a judgement call that is never quite the same the following year.
Q8
A budget_cap_total guardrail firing on 40% of pull requests indicates:
A. The wrong guardrail type: it governs the projected total cost, so any PR touching a large stack trips it
B. The configured cost threshold has been set far too low for this particular repository
C. Warn-only mode was skipped before enabling it
D. Pricing is broken for the resources in the plan
Show answer
Correct: A. A delta guardrail governs the change, which is the actual failure mode and does not re-alarm on an existing large stack.
Q9
A threshold should be set:
A. At a round number that feels responsible
B. At the median delta across recent PRs
C. Above the routine band, measured from two weeks of warn-only data
D. By following whatever the cloud provider’s own guidance recommends
Show answer
Correct: C. A guardrail firing on more than a small minority of PRs is measuring your normal workload rather than catching outliers, and it gets disabled.
Q10
An override log showing 14 of 18 overrides on a single policy means:
A. One miscalibrated policy that has been voted on
B. The team is deliberately routing around governance
C. Fourteen separate legitimate exceptions
D. Overrides should be disabled for that policy
Show answer
Correct: A. The fix is the policy. Without the log it would have quietly trained everyone to click through, which is worse than either outcome.
What’s next
Back to IaC governance.