Course Test

Please answer the questions below to complete the test.

Question 1

An agent needs to list and watch Pods in the `production` namespace and nothing else. Which RBAC configuration is most appropriate?

Select one answer

ClusterRole with `get`, `list`, `watch` on all resources

Role in `production` with `get`, `list`, `watch` on Pods

ClusterRoleBinding to the built-in `view` ClusterRole

Role in `production` with `create`, `update`, `delete` on Pods

Question 2

Which command audits the effective permissions of a ServiceAccount named `meshery-agent` in the `staging` namespace?

Select one answer

`kubectl get rolebindings -n staging`

`kubectl auth can-i --list --as=system:serviceaccount:staging:meshery-agent -n staging`

`kubectl describe serviceaccount meshery-agent -n staging`

`mesheryctl system check`

Question 3

What two scoping controls should be applied together for an agent that operates through Meshery?

Select all that apply

Kubernetes RBAC with a namespace-scoped Role

Meshery workspace token bound to only target environments

Cluster-admin ClusterRoleBinding for full control

Shared ServiceAccount across all agent roles

Question 4

In the PR-based approval workflow, when does the agent actually apply the change to the environment?

Select one answer

Immediately after generating the diff

After the PR is opened, in the same agent run

After a human approves and merges the PR

After a 10-minute cooling-off period

Question 5

Which sandboxing stage catches admission control policy failures without persisting any state to the cluster?

Select one answer

Ephemeral namespace

Staging environment

Server-side dry-run

Production canary

Question 6

Which of the following blast-radius controls are recommended for production agent deployments?

Select all that apply

API call rate limit (QPS and burst)

Change cap per agent run

Auto-retry that silently resets a tripped circuit breaker

Circuit breaker that blocks mutating actions after an error threshold