M1.1 module quiz
Ten questions. 80% to pass (8 of 10). Open book, unlimited retakes.
Answers are collapsed under each question. Answer first, then check.
Q1
A cloud account is at permission level read_only. A user clicks Stop on a discovered EC2 instance. What happens?
A. The executor checks the account’s live level and returns a read-only error before any cloud API call
B. The instance stops; the permission level affects only discovery, never any of the actions
C. The action queues until the account is upgraded to write
D. The UI hides the button, so the case cannot arise at all
Show answer
Correct: A. Enforcement is server-side in the executor, not a UI affordance. Discovery and recommendations still work at read_only; attaching its resources to a schedule and every action that changes the cloud are refused.
Q2
An account’s permission level is changed from read_write to read_only while schedules are attached to its resources. At the next scheduled stop:
A. The stop runs anyway, because the schedule was attached while the account was read_write
B. ZopNight refuses the stop before any call reaches the cloud, with no restart needed
C. Stops go ahead until the services restart and reload the new level
D. The schedules are detached automatically when the level changes
Show answer
Correct: B. The level is enforced by ZopNight’s servers every time an action runs, not only when a schedule is attached, and running schedules pick up a change without a restart.
Q3
Permission Visibility shows a resource type as Denied. The 6-hour periodic discovery cron will:
A. Retry it on every discovery cycle until it does eventually succeed
B. Disable the whole cloud account until reauthorised
C. Skip recently-denied providers for 24 hours to avoid repeated failing calls
D. Fall back to a different discovery method entirely
Show answer
Correct: A. Every scan checks every provider again, denied ones included, so a newly granted permission is picked up by the next scan. If you cannot wait up to 6 hours, start a scan through the API (POST /resources/refresh); there is no refresh button in the app.
Q4
ZopNight stores cloud credentials:
A. In the frontend session, held only for the lifetime of that one single browser tab
B. Only in memory, re-entered once per user session
C. In plaintext in the shared configuration database
D. Encrypted at rest with per-organization isolation, rotatable in place without downtime
Show answer
Correct: D. The vault model gives encryption at rest, per-org isolation and in-place rotation with no downtime. To cut a credential off, you revoke it in your own cloud.
Q5
The AWS IAM policy is described as “read-mostly” because:
A. Reads are unrestricted and writes are enumerated to a narrow set of start/stop and scoped-remediation actions
B. It contains rather more read actions than it does write actions across the whole of the policy document
C. Writes require a second, separately-issued credential
D. It is read-only in non-prod and read-write in prod
Show answer
Correct: A. The distinction that matters in a security review is that the write half is enumerated rather than broad, so the boundary is mechanical rather than a matter of trust.
Q6
WIF-based AWS connection is recommended over static keys because:
A. It is considerably faster to configure at onboarding time than the alternative
B. It supports a wider range of resource types
C. No long-lived secret is stored; the role is assumed via federated identity
D. It avoids the cross-account setup step
Show answer
Correct: C. The credential that does not exist cannot leak. That is the same reasoning behind the GCP one-click and Azure workload-identity options.
Q7
GCP one-click connect provisions:
A. A ZopNight-managed service account with roles bound for the selected permission level
B. A user account created in the customer’s own org
C. A single shared credential used across every ZopNight customer account alike
D. Nothing at all; the integration only ever reads
Show answer
Correct: A. The signed-in Google user must be able to administer the project’s IAM. A custom role, a group grant or an inherited folder binding all qualify; roles/owner is not required.
Q8
An Azure account connected at tenant scope:
A. Is a leaf node exactly like a subscription is, so it covers only the one billing boundary at all here
B. Requires a separate credential for each subscription
C. Cannot be used for discovery, only for billing rollup
D. Auto-discovers accessible subscriptions and creates a child account per subscription, with cascading operations
Show answer
Correct: D. Credential, auth-method and delete operations on the tenant parent cascade to its children, which is the part that surprises people during a rotation.
Q9
Changing an account’s credentials or auth method:
A. Requires deleting the whole cloud account and then recreating it again completely from scratch afterwards, losing all of its history
B. Resets the cost history for that account
C. Preserves resources, groups, recommendations, cost history and schedules, after verifying the new credential resolves to the same cloud identity
D. Is only possible for AWS accounts
Show answer
Correct: C. If the new credential resolves to a different identity, the request is rejected and nothing changes. An account can be re-authenticated, never silently repointed.
Q10
In the Permission Visibility drawer, a permission shows Restricted. What does that mean?
A. The permission is missing from the role or policy ZopNight uses
B. An AWS Organizations Service Control Policy (SCP) blocked ZopNight from checking it
C. ZopNight has not checked the permission yet
D. The permission works in some regions and not in others
Show answer
Correct: B. Restricted is about the check, not the grant, so the permission may still work where your SCP allows it. A missing permission shows Not attached, an unchecked one shows Not checked, and a region-by-region result shows Partial.
What’s next
Back to Connect a cloud account.