M1.6 module quiz
Ten questions. 80% to pass (8 of 10). Open book, unlimited retakes.
Answers are collapsed under each question. Answer first, then check.
Q1
The audit log captures:
A. Mutating requests with request and response bodies
B. Every API request, both reads and writes
C. Only the requests that failed, with the error
D. Only actions taken through the web UI
Show answer
Correct: A. Reads are excluded because volume runs about 1,000:1 against mutations and RBAC already controls read access. MCP tool calls are the deliberate exception: those are audited including reads.
Q2
State history retains:
A. 7 days
B. 30 days
C. Indefinitely
D. 90 days
Show answer
Correct: B. Thirty days covers the operational question (“what happened to this resource recently”) without the storage profile of an indefinite per-resource event log.
Q3
The five trigger types in the state-history column are:
A. Start, stop, restart, pause, resume
B. User, system, cron, API, webhook
C. Schedule, manual, override, auto-remediation, drift
D. Success, failure, retry, skip and timeout only
Show answer
Correct: C. Reading the trigger column is how you distinguish “the schedule did this” from “somebody did this”, which is the first question in any state-change investigation.
Q4
resource.started and resource.started.manual are separate event keys so that:
A. Manual actions can be billed separately
B. Manual actions bypass the notification service
C. Scheduled actions have higher severity
D. You can subscribe to each independently
Show answer
Correct: D. Scheduled starts produce hundreds of events a day and are noise; manual starts produce a few a week and each is worth a glance. One subscription buries the second in the first.
Q5
resource.alert is a single key covering every category and all six producing services because:
A. It reduces the number of subscriptions a team must manage
B. The rule categories overlap so much in practice that the alerts always end up duplicating across two of them somewhere
C. The cross-service notify gate collides on the fingerprint, so which service dispatches a given root cause is not deterministic
D. Per-category keys cannot carry a severity level with them
Show answer
Correct: C. Under per-category keys, which key paged the customer depended on who won that race. platform.alert.provider_incident keeps its own key precisely because it has no race.
Q6
A permission.denied card fires when a new denial appears and carries:
A. The whole current denied set, grouped by feature and resource type
B. Only the permission that was newly denied
C. Every permission probed during that cycle
D. A link through to the settings page, carrying no further detail
Show answer
Correct: A. Sending the current picture rather than a delta is the right call for an operator. An unchanged denied set is not re-sent at all.
Q7
export.ready fires when:
A. A scheduled cost report is generated and then delivered for the whole organisation
B. Billing sync completes for an account
C. A cost-report, audit-log or recommendation export finishes, carrying the signed download link
D. A dashboard is saved by any user
Show answer
Correct: C. It is what turns “check back later” into “you will be told”, which matters for exports long enough that you close the tab.
Q8
The two lifecycle emails (Onboarding Complete and Recommendations Ready):
A. Escalate automatically if they are left unacknowledged
B. Send monthly until dismissed
C. Are alerting-policy events
D. Send once per org ever, carry no severity, and never escalate
Show answer
Correct: D. Nothing failed, so they go through the notification service without the alerting policy. Orgs that predate the feature were muted by a backfill migration.
Q9
The three notification severity levels are:
A. P1, P2 and P3
B. CRITICAL, WARNING, INFO
C. High, medium and low
D. Page, email, log
Show answer
Correct: B. Severity drives routing rather than delivery: the same event can reach a Slack channel or a pager depending on the severity assigned and the channel subscribed.
Q10
Sensitive values in captured request and response bodies are:
A. Stored verbatim
B. Omitted entirely, leaving the body empty
C. Encrypted with a per-org key
D. Redacted before persistence
Show answer
Correct: D. Account ids, subscription ids and project ids are among the values stripped. The body is still useful for forensics; it is simply not a copy of your secrets.
What’s next
Back to History, notifications, audit.