M4.5 module quiz
Ten questions. 80% to pass (8 of 10). Open book, unlimited retakes.
Answers are collapsed under each question. Answer first, then check.
Q1
In the first 15 minutes of a cost anomaly, the highest-value action is:
A. Establish whether the spike is expected
B. Kill the top-spending resource first
C. Page the FinOps lead immediately
D. Open a postmortem document now
Show answer
Correct: A. Severity times expectedness is the triage matrix. Confirming expectedness fast is what prevents a three-hour investigation of a planned load test.
Q2
The daily 20:55 UTC cron means an anomaly is:
A. A live, real-time signal requiring an immediate operational response now
B. An evaluation of the previous full day, so there is time to check before acting
C. Delayed by a week, so it is historical only
D. Triggered by a fixed threshold being crossed
Show answer
Correct: B. Which is why the 15-minute discipline is about triage quality rather than speed: the spend already happened.
Q3
An “event” differs from an “incident” in that an event is:
A. Expected, and therefore documented rather than escalated
B. Smaller than the threshold
C. In a non-production account
D. Under a stated dollar-per-day floor for that whole org
Show answer
Correct: A. A large expected spike is an event; a small unexpected one may be an incident. Size alone is the wrong axis.
Q4
Which is NOT among the common anomaly root causes?
A. A newly created resource
B. An instance being resized
C. A reservation expiring
D. A provider pricing error
Show answer
Correct: D. Provider pricing errors happen and are rare enough not to be a first hypothesis. The five categories are resizes, new resources, reservation expiry, schedule failures and unscheduled usage increases.
Q5
The three discipline mistakes that turn a 30-minute investigation into a 3-hour one include:
A. Using the wrong dashboard as the starting point for the whole investigation
B. Involving too many people at once
C. Starting at the resource dimension instead of cascading from the broadest
D. Not opening a ticket immediately
Show answer
Correct: C. Skipping levels means you find a resource that grew rather than the cause, and the cascade exists to avoid exactly that.
Q6
The escalation matrix maps:
A. Cost dimensions to owning teams
B. Cloud providers to resource owners
C. Anomaly dimensions to dashboards
D. Severity to responders and SLAs
Show answer
Correct: D. Its purpose is preventing diffusion of responsibility, which is the failure mode where an alert reaches five people and none of them owns it.
Q7
A first responder on a cost anomaly should be able to:
A. Terminate any resource that happens to be involved in the spike
B. Approve a budget increase alone
C. Triage, document and escalate, with a bounded set of safe actions
D. Modify or disable the schedules
Show answer
Correct: C. Defining what they can do without further approval is what makes a 3 AM page actionable rather than a wake-up call to fetch someone else.
Q8
A blameless cost postmortem should focus on:
A. Who provisioned the resource originally
B. The conditions that allowed the spend to happen unnoticed
C. Preventing every possible future anomaly outright, forever
D. The dollar amount of the overrun itself
Show answer
Correct: B. The dollar amount sizes the incident; the conditions are what you can change. Naming the individual reliably stops people reporting the next one.
Q9
Postmortem action items should be:
A. Aspirational and broad
B. Assigned to the team collectively
C. SMART, with a single named owner
D. Reviewed annually
Show answer
Correct: C. Collective ownership is the same diffusion failure as an escalation matrix with no names, and it is why action items age without closing.
Q10
Postmortems compound when:
A. Patterns across them are reviewed and turned into structural changes
B. They are archived for the record
C. They are shared widely across every single team in the organisation
D. Every incident gets one written up
Show answer
Correct: A. Writing them is necessary and not sufficient. The value arrives when the fourth postmortem on the same root cause triggers a change to the system rather than a fourth action item.
What’s next
Back to Cost anomaly response.