M2.14 module quiz
Ten questions. 80% to pass (8 of 10). Open book, unlimited retakes.
Answers are collapsed under each question. Answer first, then check.
Q1
A watch policy runs on:
A. The very same rule engine that already evaluates all of the built-in rules
B. The anomaly detection engine, on a daily cron
C. A separate engine, writing to its own table and surfacing on the User-Defined tab
D. The shared policy engine used for tagging rules
Show answer
Correct: C. They share presentation and discipline: same drawer, same savings basis, same RBAC, same $5 floor. They do not share de-duplication, which is why a duplicate policy corrupts the savings total.
Q2
A policy that duplicates a built-in rule produces:
A. Automatic de-duplication against any built-in rule found
B. Two findings on the same resources with two savings figures
C. A rejection at save time, as a duplicate policy
D. Suppression of the built-in rule for that resource
Show answer
Correct: B. Cross-rec lever exclusivity de-duplicates overlapping built-in rules; it does not span the two engines. Searching the catalogue first is the load-bearing step.
Q3
A signal specifying avg cpu eq 0 over 14 days is:
A. Fired on any resource with no CPU
B. Converted to lt 0.01
C. Fired only on stopped resources
D. Rejected at the write boundary
Show answer
Correct: D. eq is exact float equality, and an average over a fortnight of floating-point samples will not land on exactly 0.0. eq with max or min is allowed and useful.
Q4
p95 in a watch signal computes:
A. The 95th percentile of raw samples
B. The 95th percentile over the last hour
C. The 95th percentile of per-hour peaks
D. The mean of the top 5%
Show answer
Correct: C. A workload spiking for two minutes each hour looks far busier under this definition than a raw-sample percentile would suggest, which suits capacity questions and not idleness questions.
Q5
The window range is:
A. 1 to 90 days
B. 1 to 30 days
C. 7 to 365 days
D. Unbounded
Show answer
Correct: A. The ceiling is the metric store’s serving limit. Choose the window to match the workload’s cycle: a window shorter than one full cycle produces findings that are artefacts of when you looked.
Q6
A terminate outcome on an RDS instance produces:
A. Savings equal to the resource’s full monthly bill
B. Advisory $0, because the resource is stateful
C. A rejection at save, since the outcome is invalid
D. Half the monthly bill, as a conservative estimate
Show answer
Correct: B. Stateful means the same as in the Safety Gate: a managed data-service type, a non-empty engine spec, or a data tier. The finding still surfaces as a worklist without a platform-attributed number.
Q7
A schedule outcome is priced from:
A. A standard 128-of-168-hours weekly assumption
B. The policy’s own observation window length
C. The measured off-hours fraction for that resource
D. The one-tier-down SKU rate delta for the type
Show answer
Correct: C. The same concrete-or-abstain basis every built-in schedule rule uses. With no measured schedule data the finding is demoted to advisory $0 rather than given a fabricated constant.
Q8
An un-priceable cost-driven finding is demoted to advisory rather than shipped at $0 because:
A. Advisory findings are easier for a customer to dismiss
B. A $0 cost-driven finding is dropped by the low-savings suppressor and vanishes silently
C. Advisory findings skip past the $5 low-savings suppression floor entirely anyway
D. A $0 figure breaks the organisation’s savings rollup
Show answer
Correct: B. Demoting keeps it visible and correctly labelled as carrying no recoverable dollar figure, which mirrors why posture findings sit in non-cost-driven categories.
Q9
A malformed scope selector causes the policy to:
A. Match nothing
B. Match everything
C. Be rejected at save
D. Fall back to the previous selector
Show answer
Correct: A. Fail closed, because a broad accidental match combined with a terminate outcome is the failure that cannot be afforded. A policy producing zero findings might have a broken selector.
Q10
A resource emitting no CPU metric at all, evaluated against avg cpu lt 5%:
A. Fires, since no usage means idle
B. Fires with reduced severity
C. Errors the whole policy
D. Does not fire
Show answer
Correct: D. Absence of data is not evidence of a condition. Without this rule, an account whose metrics permission was revoked would have every resource read as 0% and receive a delete recommendation.
What’s next
Back to Watch policies.