M2.8 module quiz
Ten questions. 80% to pass (8 of 10). Open book, unlimited retakes.
Answers are collapsed under each question. Answer first, then check.
Q1
A resource already carries the cloud tag a policy derives. Where does the derived tag appear?
A. In the pending queue, awaiting an accept
B. Nowhere, since it duplicates a real tag
C. In both queues, pending and accepted
D. Auto-accepted at derivation
Show answer
Correct: D. The “cloud implies accepted” invariant. Without it, a well-tagged estate would fill the pending queue with no-op approvals, which is the fastest way to get a queue ignored.
Q2
A tagging policy derives a value from:
A. provider, region, type, instance_type and name
B. CloudTrail events plus the identity that created the resource
C. A machine-learning model trained over the org’s historical tags
D. The resource group it belongs to and that group’s own tags
Show answer
Correct: A. Five fields, nothing else. There is no metric input, no activity signal and no ownership lookup, which is why a policy cannot derive an owner.
Q3
Smart Tags have no confidence score because:
A. Scores were removed to simplify the review UI
B. A derivation cannot be wrong about its own inputs
C. All policy derivations are high confidence anyway
D. Confidence moved onto the policy rather than the tag
Show answer
Correct: B. A prediction guesses at something unobservable and needs a confidence and a reject state; a policy computes a deterministic function. What you judge on accept is whether the policy is useful.
Q4
The state model is:
A. pending, then accepted, and then finally rejected outright
B. draft, active and archived
C. pending and accepted, where pending equals derived minus accepted
D. suggested, applied and ignored
Show answer
Correct: C. There is no reject state. A tag you do not want is one you leave pending, or a policy you edit.
Q5
Accepting a derived tag:
A. Makes it count toward attribution inside ZopNight only
B. Writes it to the cloud provider as a real cloud tag
C. Queues it for the nightly cloud tag sync
D. Applies it to AWS resources only
Show answer
Correct: A. It carries dimension_source = auto so reports can distinguish it from a cloud-native tag. Writing to the cloud is a separate, explicit action.
Q6
“Apply to cloud” skips a resource when:
A. The resource is currently stopped
B. The tagging policy behind it is still pending
C. The resource is managed by IaC
D. The tag already matches the live cloud value
Show answer
Correct: D. No redundant write, on both the web and MCP apply paths. A high skip count is good news about your existing tagging rather than a failure.
Q7
Applying a derived tag to an IaC-managed resource:
A. Is blocked outright at the write API boundary layer
B. Succeeds and is silently reverted on the next apply
C. Updates the IaC state to match
D. Triggers a tag drift alert
Show answer
Correct: B. Nothing warns you, so the check has to be yours. The durable fix is a PR against the module’s default tags.
Q8
An accepted tag disappears without anyone revoking it. The cause is:
A. A bug in the reconciler
B. Expiry after 90 days
C. The underlying cloud tag was deleted by someone in the cloud console
D. Reconciliation: it is kept only while still derived with the same value
Show answer
Correct: D. Three things cause it: the resource changed, the policy changed, or the cloud tag changed on an auto-accepted tag. All three are the invariant working.
Q9
Editing a policy’s derivation rule invalidates:
A. Only the pending tags under it
B. Every accepted tag under that key
C. Nothing; acceptance is final
D. Only tags on changed resources
Show answer
Correct: B. Treat a policy edit as a fleet-wide change with a blast radius equal to the accepted count under that key, and re-accept by value group rather than by resource.
Q10
Smart Tags reconciliation differs from tag-drift detection because reconciliation:
A. Runs far less often than the tagging policy engine itself does
B. Covers only AWS resources, not GCP or Azure
C. Has no notion of an expected tag, so it never reports a violation
D. Only checks tags that have been accepted
Show answer
Correct: C. Whatever the policy derives now is the expectation. “Which resources are missing a required tag” is a tagging-policy governance question, and Smart Tags structurally cannot answer it.
What’s next
Back to Smart Tags.