M2.8 module quiz
Ten questions. 80% to pass (8 of 10). Open book, unlimited retakes.
Answers are collapsed under each question. Answer first, then check.
Q1
A resource already carries the cloud tag a policy derives. Where does the derived tag appear?
A. In the pending queue, awaiting an accept
B. Nowhere, since it duplicates a real tag
C. In both queues, pending and accepted
D. Auto-accepted at derivation
Show answer
Correct: D. The “cloud implies accepted” invariant. Without it, a well-tagged estate would fill the pending queue with no-op approvals, which is the fastest way to get a queue ignored.
Q2
A tagging policy derives a value from:
A. The resource’s fields, its existing tags, and literal text
B. CloudTrail events plus the identity that created the resource
C. A machine-learning model trained over the org’s historical tags
D. The resource group it belongs to and that group’s own tags
Show answer
Correct: A. Values come from the resource’s fields (provider, region, type, instance_type, name), its existing tags, and literal text or lookup tables written into the policy. There is no metric input, no activity signal and no external ownership lookup.
Q3
Smart Tags have no confidence score because:
A. Scores were removed to simplify the review UI
B. A derivation cannot be wrong about its own inputs
C. All policy derivations are high confidence anyway
D. Confidence moved onto the policy rather than the tag
Show answer
Correct: B. A prediction guesses at something unobservable and needs a confidence and a reject state; a policy computes a deterministic function. What you judge on accept is whether the policy is useful.
Q4
The state model is:
A. pending, then accepted, and then finally rejected outright
B. draft, active and archived
C. pending and accepted, where pending equals derived minus accepted
D. suggested, applied and ignored
Show answer
Correct: C. There is no reject state. A tag you do not want is one you leave pending, or a policy you edit.
Q5
Accepting a derived tag:
A. Makes it count toward attribution inside ZopNight only
B. Writes it to the cloud provider as a real cloud tag
C. Queues it for the nightly cloud tag sync
D. Applies it to AWS resources only
Show answer
Correct: A. It carries dimension_source = auto so reports can distinguish it from a cloud-native tag. Writing to the cloud is a separate, explicit action.
Q6
“Apply to cloud” skips a resource when:
A. The resource is currently stopped
B. The tagging policy behind it is still pending
C. The resource is managed by IaC
D. The tag already matches the live cloud value
Show answer
Correct: D. No redundant write, on both the web and MCP apply paths. A high skip count is good news about your existing tagging rather than a failure.
Q7
Applying a derived tag to an IaC-managed resource:
A. Is blocked outright at the write API boundary layer
B. Succeeds and is silently reverted on the next apply
C. Updates the IaC state to match
D. Triggers a tag drift alert
Show answer
Correct: B. Nothing warns you, so the check has to be yours. The durable fix is a PR against the module’s default tags.
Q8
An accepted tag disappears without anyone revoking it. The cause is:
A. A bug in the reconciler
B. Expiry after 90 days
C. The underlying cloud tag was deleted by someone in the cloud console
D. Reconciliation: it is kept only while still derived with the same value
Show answer
Correct: D. Three things cause it: the resource changed, the policy changed, or a tag the policy reads changed. All three are the invariant working.
Q9
Editing a policy’s derivation rule drops:
A. Only the pending tags under that key
B. Accepted tags whose derived value changed or stopped
C. Nothing; acceptance is final
D. Every accepted tag under that key, whatever its value
Show answer
Correct: B. An accepted tag is kept while it is still derived with the same value, so only the changed ones drop. An edit that changes every value drops every accepted tag under the key at once: treat a policy edit as a change with a blast radius, and re-accept by value rather than by resource.
Q10
Smart Tags reconciliation differs from tag-drift detection because reconciliation:
A. Runs far less often than the tagging policy engine itself does
B. Covers only AWS resources, not GCP or Azure
C. Has no notion of an expected tag, so it never reports a violation
D. Only checks tags that have been accepted
Show answer
Correct: C. Whatever the policy derives now is the expectation. “Which resources are missing a required tag” is a question for a validate-mode tagging policy; reconciliation structurally cannot answer it, though the Smart Tags page shows validate-mode violations separately.
What’s next
Back to Smart Tags.