M2.10 module quiz
Ten questions. 80% to pass (8 of 10). Open book, unlimited retakes.
Answers are collapsed under each question. Answer first, then check.
Q1
The anomaly severity bands are:
A. warning 30-150%, critical 150-500%, emergency above 500%
B. warning 30-100%, critical 100-500%, emergency above 500%
C. warning 10-50%, critical 50-200%, emergency above 200%
D. Tuned per dimension
Show answer
Correct: A. One global band set, not per-dimension. A parallel z-score path runs alongside, with emergency at z ≥ 5, and the higher of the two severities wins.
Q2
Anomaly detection runs:
A. In real time, as costs arrive
B. Hourly, on the hour
C. Weekly, on Mondays
D. Daily at 20:55 UTC
Show answer
Correct: D. It evaluates the previous full day, which is why an anomaly surfaces the day after the spend rather than the minute of it. Manual trigger is available for investigation.
Q3
The false-positive guards require:
A. At least 4 data points, a $1/day floor, and stddev above 10% of the mean
B. A configured notification channel set up on the organisation first
C. At least 30 days of cost history present
D. Two consecutive days of the same deviation
Show answer
Correct: A. Each guard removes a different class of noise: too little history, trivially small amounts, and metrics too flat for a deviation to be meaningful.
Q4
The z-score path additionally requires:
A. 7 data points
B. 14 data points
C. No minimum
D. 30 data points
Show answer
Correct: B. A z-score computed on a short series is a number without meaning, so the path abstains rather than producing one.
Q5
Evaluation and notification are decoupled, meaning:
A. Notifications fire before evaluation completes
B. Evaluation only runs for orgs with a subscription
C. Notifications are evaluated separately for each dimension in turn, before anything persists
D. Anomalies are evaluated and persisted for every org regardless of whether any channel is configured
Show answer
Correct: D. Previously a missing subscription silently short-circuited evaluation, so an org with no channels saw no anomalies at all. Now they appear in reports and on the trend widget either way.
Q6
Team redistribution suppression fires when:
A. Any team’s cost changing at all
B. A team being deleted from the organisation altogether now
C. Cost shifts between teams with net change below a threshold
D. Team tags going missing entirely
Show answer
Correct: C. Both anomalies are suppressed as a redistribution. Without it, moving a workload between teams produces one spike and one drop, and neither is a real cost event.
Q7
The resource-level cap limits alerts to:
A. The top 10 resources per org by deviation
B. All resources above the deviation threshold
C. One resource per connected cloud account
D. Every resource above $100 per day
Show answer
Correct: A. The rest remain visible in the feed. The cap is about notification noise rather than about detection coverage.
Q8
Adaptive batching classifies orgs by:
A. The cloud provider in use
B. Total spend volume per org
C. The organisation’s own subscription plan tier level
D. Resource count, with smaller batches for larger orgs
Show answer
Correct: D. Larger orgs get smaller batches to cap peak memory, which is counter-intuitive until you realise the batch is being held in memory during evaluation.
Q9
Root-cause analysis identifies:
A. The specific engineer who was responsible for making the change, as identified from the audit log
B. The cloud provider’s own incident feed
C. Instance resizes, new resources, reservation expiry, schedule failures and unscheduled usage increases
D. The team affected by the deviation
Show answer
Correct: C. Five categories, ranked by probability. When the top candidate is wrong, the ranking is still the fastest path through the remaining four.
Q10
Anomaly detection is NOT:
A. A daily evaluation across dimensions
B. A replacement for budget thresholds and cloud-native alarms
C. Multi-dimensional in its scope, rather than total-only
D. Persisted for later reporting and review
Show answer
Correct: B. It detects unexpected deviation from a baseline, not crossing a planned limit. A budget answers “are we over plan”; an anomaly answers “did something change”.
What’s next
Back to Cost anomaly detection.