ai-engineering-from-scratch/phases/19-capstone-projects/13-mcp-server-with-registry/quiz.json at main · CSTurtle/ai-engineering-from-scratch · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
{
  "lesson": "13-mcp-server-with-registry",
  "title": "Capstone 13 — MCP Server with Registry and Governance",
  "questions": [
    {
      "stage": "pre",
      "question": "Why does the 2026 MCP revision favor StreamableHTTP for production servers?",
      "options": [
        "It is the only transport that supports tool calls",
        "It is stateless by default, so a single endpoint behind a load balancer can scale horizontally",
        "It encrypts payloads automatically",
        "It removes the need for authentication"
      ],
      "correct": 1,
      "explanation": ""
    },
    {
      "stage": "pre",
      "question": "Which authorization model gates tool calls in this capstone?",
      "options": [
        "OAuth 2.1 tokens carrying per-tool scopes, checked at tool-call time",
        "API keys per IP address",
        "Mutual TLS without scopes",
        "A shared admin password"
      ],
      "correct": 0,
      "explanation": ""
    },
    {
      "stage": "check",
      "question": "What is the role of the .well-known/mcp-capabilities document?",
      "options": [
        "Lists outbound IP ranges",
        "Holds the OPA policy bundle",
        "Exposes the tool manifest, transport URL, and auth requirements so the registry can validate and index the server",
        "Stores audit logs for the server"
      ],
      "correct": 2,
      "explanation": ""
    },
    {
      "stage": "check",
      "question": "Why do destructive tools live on a separate MCP server in this design?",
      "options": [
        "They run on slower hardware",
        "They require a different programming language",
        "They cannot be exposed over StreamableHTTP",
        "They are gated behind an approval token elevated via a Slack card within a short window"
      ],
      "correct": 3,
      "explanation": ""
    },
    {
      "stage": "check",
      "question": "What does OPA / Rego decide on every tool call?",
      "options": [
        "Whether the caller's scopes permit invocation, plus PII redaction and payload caps",
        "How the server should re-rank the response",
        "Which model to invoke",
        "Where to write the audit log"
      ],
      "correct": 0,
      "explanation": ""
    },
    {
      "stage": "post",
      "question": "Which evidence demonstrates StreamableHTTP horizontal scaling in the load test?",
      "options": [
        "Adding a second replica and showing the load balancer redistributing without session stickiness",
        "Running everything in a single process",
        "Reducing concurrency to one client",
        "Switching to stdio transport"
      ],
      "correct": 0,
      "explanation": ""
    },
    {
      "stage": "post",
      "question": "Why does the audit log scrub PII via Presidio before being persisted per tenant?",
      "options": [
        "To meet enterprise security requirements while keeping per-call lineage queryable",
        "PII improves search performance",
        "To make logs shorter",
        "Presidio reduces ClickHouse write amplification"
      ],
      "correct": 0,
      "explanation": ""
    }
  ]
}