Practice advanced OPA and Rego vocabulary: policy evaluation, data documents, partial evaluation, conftest unit testing, and OCI-based policy bundle distribution.
0 / 10 completed
1 / 10
'The Rego policy evaluates to ___.' Which word describes a blocking policy decision?
In OPA/Rego, policies evaluate to 'deny' (or 'allow'). A 'deny' decision means the policy violation was detected and the admission controller or authorization layer should block the action.
2 / 10
'The policy uses ___ documents.' Which noun describes external reference data in OPA?
OPA 'data documents' are external reference data loaded into OPA alongside policies — e.g., allowed registries, approved namespaces, or cost tags. Policies can query data documents to make decisions.
3 / 10
What is 'partial evaluation' in OPA?
Partial evaluation in OPA evaluates policy rules against known static data ahead of time, producing a simplified residual policy. This dramatically speeds up runtime evaluation by reducing repeated computation.
4 / 10
'We unit test policies with ___.' Which tool is designed for testing OPA policies?
Conftest is a tool for writing tests against structured configuration (YAML, JSON, Terraform) using OPA/Rego policies. It integrates easily into CI pipelines for policy testing.
5 / 10
'The policy bundle is distributed via ___ registry.' Which standard is used for distributing OPA bundles?
OPA bundles (collections of policies and data) can be distributed via OCI (Open Container Initiative) registries — the same registries used for Docker images. This simplifies distribution and versioning.
6 / 10
Review Comment: 'This policy is returning 'violation' for users with less than 500 gold coins. It seems overly restrictive.' Which term best describes the reviewer's assessment of the policy's behavior?
The reviewer uses the word 'restrictive,' indicating that the policy *actively prevents* something. 'Non-compliant' refers to failing to meet requirements, but doesn't capture the specific action of blocking. 'Violative' is a general term for breaking rules; 'Permissive' describes the opposite behavior. Understanding this nuanced difference is key when discussing OPA policies.
7 / 10
Slack Message: 'Hey team, I'm seeing a lot of 'deny' responses from the opa-engine when evaluating user permissions. It's impacting API access for new users.' Which of the following best explains why this might be happening?
While a malfunctioning engine or overloaded gateway could cause issues, the message specifically mentions 'deny responses.' This strongly suggests the problem lies with the policy bundle itself – an outdated bundle means the opa-engine is evaluating old rules. The other options represent different types of problems that wouldn't manifest as 'deny' responses.
8 / 10
PR Description: 'Implemented a new Rego policy to enforce MFA for all users accessing the production database. The policy utilizes a lookup function against an external identity provider.' What is the primary purpose of the lookup function in this context?
The description explicitly states that the lookup function is used against an 'external identity provider.' This means it's responsible for querying and retrieving data *about* the user – specifically, information relevant to MFA enforcement (like secret keys). Direct authentication or token generation are separate processes.
9 / 10
Standup Update: 'We're currently using OPA to manage access control for our microservices. We've been running integration tests with opaTest and are seeing a high number of 'denied' results when testing new features.' What is the most likely root cause of these 'denied' results?
While code errors or incorrect test data could cause 'denied' results, the standup update focuses on OPA. A misconfigured policy – lacking appropriate conditions or permissions – is the most probable reason for frequent denials during integration tests. The tool itself and application logic are less likely to be the immediate source of the problem.
10 / 10
API Response: The opa-engine returned a JSON response with the following key: policyResult. This field contains an object with a decision property. What does this decision property typically indicate?
The policyResult object contains the outcome of the opa-engine's evaluation. The `decision` property within this object explicitly represents whether the policy allowed or denied access – this is fundamental to how OPA operates and communicates its results.
What will I practice in "Advanced OPA/Rego Vocabulary"?
This is a Policy As Code exercise set. It walks through 10 scenario-based multiple-choice questions built around real usage of policy as code terminology that IT professionals encounter on the job.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to complete with no account, sign-up, or paywall.
How many questions are in this exercise?
This set contains 10 questions. Each one shows immediate feedback and a detailed explanation after you answer, so you learn the correct usage right away rather than waiting for a final score.
Do I need prior experience to complete this exercise?
No prior experience is required. Each question includes a full explanation covering the reasoning behind the correct answer, so the exercise itself teaches the policy as code vocabulary as you go.
Can I retry the exercise if I get questions wrong?
Yes — use the "Try again" button on the results screen to reset your answers and go through all the questions again. There is no limit on attempts.
Is my progress saved?
Your answers and score for the current session are tracked in the browser as you go. No account or login is needed, and there is nothing to install.
What if I don't understand a term used in a question?
Read the explanation shown after you answer each question — it breaks down the correct term in plain English with a real-world example. You can also check the site Glossary for quick definitions.
How is this different from reading a blog article on the topic?
Exercises like this one are interactive drills that test and reinforce specific vocabulary through multiple-choice questions, while blog articles explain concepts in prose. Practising here after reading builds active recall, not just passive recognition.
Where can I find more Policy As Code exercises?
See the Policy As Code exercises hub for the full set of related pages, or browse all exercise categories from the main Exercises index.
Can I use this exercise to prepare for a technical interview?
Yes — policy as code vocabulary comes up often in technical discussions and interviews. Pair this exercise with our dedicated Interview Preparation section for role-specific practice.