M1.6 module quiz
Ten questions. 80% to pass (8 of 10). Open book, unlimited retakes.
Answers are collapsed under each question. Answer first, then check.
Q1
The audit log captures:
A. Mutating requests with request and response bodies
B. Every API request, both reads and writes
C. Only the requests that failed, with the error
D. Only actions taken through the web UI
Show answer
Correct: A. Reads are excluded because volume runs about 1,000:1 against mutations and RBAC already controls read access. MCP tool calls are the deliberate exception: those are audited including reads.
Q2
State history retains:
A. 7 days
B. 30 days
C. Every recorded action; there is no automatic purge
D. 90 days
Show answer
Correct: C. ZopNight does not purge state history, so a resource’s timeline goes back to the first action it recorded. Use the date filter to look at a recent window.
Q3
The trigger sources the History page distinguishes are:
A. Start, stop, restart, pause, resume
B. User, system, cron, API, webhook
C. Schedule, manual, bulk, override, override expired
D. Success, failure, retry, skip and timeout only
Show answer
Correct: C. An override removed early is shown as its own source too. Reading the trigger column is how you distinguish “the schedule did this” from “somebody did this”, which is the first question in any state-change investigation.
Q4
resource.started and resource.started.manual are separate event keys so that:
A. Manual actions can be billed separately
B. Manual actions bypass the notification service
C. Scheduled actions have higher severity
D. You can subscribe to each independently
Show answer
Correct: D. Scheduled starts produce hundreds of events a day and are noise; manual starts produce a few a week and each is worth a glance. One subscription buries the second in the first.
Q5
resource.alert is a single key covering every category and all six producing services because:
A. It reduces the number of subscriptions a team must manage
B. The rule categories overlap so much in practice that the alerts always end up duplicating across two of them somewhere
C. The cross-service notify gate collides on the fingerprint, so which service dispatches a given root cause is not deterministic
D. Per-category keys cannot carry a severity level with them
Show answer
Correct: C. Under per-category keys, which key paged the customer depended on who won that race. platform.alert.provider_incident keeps its own key precisely because it has no race.
Q6
A permission.denied card fires when a new denial appears and carries:
A. The whole current denied set, grouped by feature and resource type
B. Only the permission that was newly denied
C. Every permission probed during that cycle
D. A link through to the settings page, carrying no further detail
Show answer
Correct: A. Sending the current picture rather than a delta is the right call for an operator. An unchanged denied set is not re-sent at all.
Q7
export.ready fires when:
A. A scheduled cost report is generated and then delivered for the whole organisation
B. Billing sync completes for an account
C. A cost-report, audit-log or recommendation export finishes, carrying the signed download link
D. A dashboard is saved by any user
Show answer
Correct: C. It is what turns “check back later” into “you will be told”, which matters for exports long enough that you close the tab.
Q8
The two lifecycle emails (Onboarding Complete and Recommendations Ready):
A. Escalate automatically if they are left unacknowledged
B. Send monthly until dismissed
C. Are alerting-policy events
D. Send once per org ever, carry no severity, and never escalate
Show answer
Correct: D. Nothing failed, so they go through the notification service without the alerting policy. Orgs that predate the feature were muted by a backfill migration.
Q9
The three notification severity levels are:
A. P1, P2 and P3
B. CRITICAL, WARNING, INFO
C. High, medium and low
D. Page, email, log
Show answer
Correct: B. Severity is fixed by whatever produces the event and is shown on the message. You cannot reassign it; routing is decided by which event keys each channel subscribes to.
Q10
For a REST call under a secret prefix such as cloud-accounts or integrations, the captured body is:
A. Stored verbatim
B. Omitted entirely, leaving the body empty
C. Encrypted with a per-org key
D. Stored with each secret field set to [REDACTED]
Show answer
Correct: B. REST has no per-field list of secrets, so the whole body is dropped for those prefixes. Field-level [REDACTED] (D) is what MCP tool calls get, because each tool declares its secret fields. Either way the log is not a copy of your secrets.
What’s next
Back to History, notifications, audit.