0 / 20 answered

1. 1. What is the fleet dashboard responsible for?

   What is the fleet dashboard responsible for?

   Replacing WordPress cron on every site Hosting GitHub releases Orchestrating signed REST requests to updater agents on live sites Copying plugin files directly into remote wp-content directories
   Hint

   Separate local orchestration, remote execution, transport evidence, and verified production state.

2. 2. Where are package backups and updater logs stored during a live-site update?

   Where are package backups and updater logs stored during a live-site update?

   In the child theme repository Only inside the local dashboard Inside the browser session On the remote site that performs the update
   Hint

   Separate local orchestration, remote execution, transport evidence, and verified production state.

3. 3. What should an operator normally do before selecting updates?

   What should an operator normally do before selecting updates?

   Run Check all and review versions and errors Enable anonymous REST access Change every package slug Delete every existing backup
   Hint

   Separate local orchestration, remote execution, transport evidence, and verified production state.

4. 4. Which configured sites are included by enabled_sites?

   Which configured sites are included by enabled_sites?

   Every JSON object regardless of fields Only localhost installations Only sites whose WordPress admin is open Entries with a URL and secret_env that are not explicitly disabled
   Hint

   Separate local orchestration, remote execution, transport evidence, and verified production state.

5. 5. How does the dashboard obtain the secret for a configured site?

   How does the dashboard obtain the secret for a configured site?

   It reads the environment variable named by secret_env It downloads the secret from the public status endpoint It stores the secret in a page cookie It derives the secret from the domain name
   Hint

   Separate local orchestration, remote execution, transport evidence, and verified production state.

6. 6. Why should every live site use a different remote secret?

   Why should every live site use a different remote secret?

   It makes PHP execute faster It guarantees GitHub availability It removes the need for HTTPS A secret compromise is contained to one site
   Hint

   Separate local orchestration, remote execution, transport evidence, and verified production state.

7. 7. Why should real .env and config/sites.json files remain uncommitted?

   Why should real .env and config/sites.json files remain uncommitted?

   They can expose operational site information and secret references or values They prevent CSS caching JSON cannot be version controlled WordPress deletes committed files
   Hint

   Separate local orchestration, remote execution, transport evidence, and verified production state.

8. 8. What does the local CSRF token protect?

   What does the local CSRF token protect?

   WordPress password hashing Dashboard POST actions triggered through the operator browser GitHub release downloads DNS resolution
   Hint

   Separate local orchestration, remote execution, transport evidence, and verified production state.

9. 9. For a non-GET request, what body is included in the HMAC signature base?

   For a non-GET request, what body is included in the HMAC signature base?

   The exact JSON payload sent to the remote endpoint The HTML returned by WordPress The contents of packages.json An empty string in every case
   Hint

   Separate local orchestration, remote execution, transport evidence, and verified production state.

10. 10. Which path is used when constructing the dashboard signature?

    Which path is used when constructing the dashboard signature?

    The browser referer The GitHub repository path only The parsed URL path of the complete remote URL The local dashboard filesystem path
    Hint

    Separate local orchestration, remote execution, transport evidence, and verified production state.

11. 11. How is a request nonce generated by the dashboard?

    How is a request nonce generated by the dashboard?

    Sixteen cryptographically random bytes encoded as hexadecimal The package version repeated twice The site label converted to lowercase A sequential database post ID
    Hint

    Separate local orchestration, remote execution, transport evidence, and verified production state.

12. 12. What are the dashboard cURL connection and total timeout values?

    What are the dashboard cURL connection and total timeout values?

    One second for both 45 seconds to connect and 15 seconds total No timeout 15 seconds to connect and 45 seconds total
    Hint

    Separate local orchestration, remote execution, transport evidence, and verified production state.

13. 13. Why does the dashboard explicitly set CURLOPT_PROXY to an empty string?

    Why does the dashboard explicitly set CURLOPT_PROXY to an empty string?

    To disable HTTPS verification To bypass an inherited unusable proxy in the local Laragon environment To force all traffic through GitHub To make remote requests anonymous
    Hint

    Separate local orchestration, remote execution, transport evidence, and verified production state.

14. 14. How does the dashboard choose a CA bundle?

    How does the dashboard choose a CA bundle?

    It uses LUBINIK_FLEET_CA_BUNDLE when valid, then known Laragon or XAMPP fallbacks It downloads a new certificate for every request It disables certificate checking It reads the active theme stylesheet
    Hint

    Separate local orchestration, remote execution, transport evidence, and verified production state.

15. 15. How are packages selected across several sites submitted?

    How are packages selected across several sites submitted?

    All package names are sent to the first site only They are grouped by site and each site receives one update-batch request The dashboard opens an SSH session per file One global request writes to every server
    Hint

    Separate local orchestration, remote execution, transport evidence, and verified production state.

16. 16. Why does update_selected apply array_unique to package names per site?

    Why does update_selected apply array_unique to package names per site?

    To remove failed sites To sort sites by storage size To rotate remote secrets To avoid requesting the same package twice in one site batch
    Hint

    Separate local orchestration, remote execution, transport evidence, and verified production state.

17. 17. Why does the dashboard fetch status again after an update or rollback?

    Why does the dashboard fetch status again after an update or rollback?

    To renew the browser CSRF token only To delete remote logs To collect post-action evidence instead of assuming the action changed the site correctly To publish a GitHub release
    Hint

    Separate local orchestration, remote execution, transport evidence, and verified production state.

18. 18. What extra safeguard applies to updater-agent self-updates?

    What extra safeguard applies to updater-agent self-updates?

    They are always silently installed first A separate explicit confirmation must be sent They cannot be backed up They require disabling HMAC
    Hint

    Separate local orchestration, remote execution, transport evidence, and verified production state.

19. 19. What storage details does the dashboard summary emphasize?

    What storage details does the dashboard summary emphasize?

    Only browser cache usage Only the global total with no site context Only database table sizes Fleet total, temporary item count, and the largest site contributor
    Hint

    Separate local orchestration, remote execution, transport evidence, and verified production state.

20. 20. How are local dashboard operations recorded?

    How are local dashboard operations recorded?

    Only in browser localStorage As PHP code inside wp-config.php By rewriting the complete Git history As append-only JSON lines with a UTC timestamp and an exclusive write lock
    Hint

    Separate local orchestration, remote execution, transport evidence, and verified production state.