Skip to content

MICKAI^® Training AcademyLEARN · EXPERIMENT · VERIFY

Exam · Test an agent permission boundary with OpenShell

Take the exam and earn your certificate.

A real, server-scored exam for this course. Score strictly above 80% to pass and get a genuine, verifiable certificate.

Written practice, ungraded

Write your response in your own notes, then compare it with the sample answer. This practice is separate from the scored exam and does not affect your certificate.

Practice 1

Write the three acceptance statements for the fictional comparison assistant, then classify one allowed request and one denied request. Do this before opening the answer key.

Compare with a sample answer

The three acceptance statements are: allow reads of the reference files; allow writes of the report in the output folder; deny reads of private notes and modification of reference files. For example, a reference-file read is allowed and a reference-file write is denied. The offline decision and assertion result are simulator evidence. Neither proves that an OpenShell sandbox enforced a real request.

This model answer illustrates the stated exercise reasoning; the written activity is not scored and cannot establish runtime verification.

Practice 2

Compare the reference and reference-old fixtures. Write a component-aware membership test in plain English, then run the supplied file tests.

Compare with a sample answer

Require the exact permitted root or that root plus a slash before child components. Reject parent traversal and unresolved targets in this teaching model. This fixes the text-prefix defect but is not a substitute for live filesystem resolution and enforcement.

This model answer illustrates the stated exercise reasoning; the written activity is not scored and cannot establish runtime verification.

Practice 3

Using fixtures f08 to f13, predict each decision and identify the single field changed from the allowed tuple. No endpoint is contacted.

Compare with a sample answer

f08 allows the exact tuple. f09 changes method, f10 host, f11 executable, f12 port and f13 redirect destination. Each is denied. The allowed GET can still carry or retrieve unsuitable content, so application data controls remain necessary.

This model answer illustrates the stated exercise reasoning; the written activity is not scored and cannot establish runtime verification.

Practice 4

On paper, plan a read-only inspection of an owner-provided sandbox. If no authorised compatible runtime exists, complete the written route and do not install or launch one for this exercise.

Compare with a sample answer

Use the installed help, named sandbox, base view, effective view, revision status and relevant log window. These inspection results still need authorised positive and negative probes to establish runtime behaviour. With no runtime, the plan remains unexecuted.

This model answer illustrates the stated exercise reasoning; the written activity is not scored and cannot establish runtime verification.

Practice 5

Run test_simulator.py. It tests the intended policy and an in-memory mutation that makes reference notes writable.

Compare with a sample answer

The ordinary policy denies f02. The mutation permits f02, so its decision disagrees with the unchanged expected decision. The mutation test passes by detecting that disagreement; it does not legitimise the wider permission or change the baseline file.

This model answer illustrates the stated exercise reasoning; the written activity is not scored and cannot establish runtime verification.

Practice 6

Draft a handover with two headings: observed and outstanding. Include a statement explaining what a completion certificate would mean.

Compare with a sample answer

Observed: local model decisions and assertions, with source/fixture digests. Outstanding: independent content/bank review, intended-runtime tests, browser and PDF validation, artwork and integration. The certificate would record educational knowledge assessment, not practical deployment assurance.

This model answer illustrates the stated exercise reasoning; the written activity is not scored and cannot establish runtime verification.

About this exam

Is this exam graded?

Yes. Every question is scored on our server, never in your browser, and you need a score strictly above 80% to pass. The questions are a real, reviewed bank for this course, drawn fresh for each attempt.

Is it only multiple choice?

Yes. This is a multiple-choice knowledge assessment, with at least one question from each chapter in every attempt. Written exercises are separate practice and are not automatically scored. Passing does not establish practical professional competence or independently verify identity.

Is there a time limit?

Yes, 45 minutes, shown as a countdown once you start. If time runs out, whatever you have answered is submitted automatically.

Do I need to download the PDF first?

No. This course's full text is on its own page, so you can read it online and come straight here when you feel ready.

What do you do with my name and email?

We privately record your name, email, request IP, course and privacy acknowledgement for this request. Newsletter consent is separate and optional. See /privacy.html for storage and retention. A passed exam creates a server-stored named certificate. An email confirmation is not identity assurance.

Can I retake it if I fail?

Yes, straight away. Each attempt draws a fresh set of questions and shuffles the answer order, so it will not be identical to your last attempt, and an attempt can only be submitted once.

Is the certificate real?

It is a genuine, server-issued certificate with its own verification page and a unique ID, not a self-declared one. It records that you passed this course's exam on this date. It is not an accredited qualification, a professional licence or proof of employment.