0 / 20 answered

1. 1. What is the fleet dashboard responsible for?

   What is the fleet dashboard responsible for?

   Hosting GitHub releases Copying plugin files directly into remote wp-content directories Orchestrating signed REST requests to updater agents on live sites Replacing WordPress cron on every site
   Hint

   Separate local orchestration, remote execution, transport evidence, and verified production state.

2. 2. Where are package backups and updater logs stored during a live-site update?

   Where are package backups and updater logs stored during a live-site update?

   Only inside the local dashboard On the remote site that performs the update In the child theme repository Inside the browser session
   Hint

   Separate local orchestration, remote execution, transport evidence, and verified production state.

3. 3. What should an operator normally do before selecting updates?

   What should an operator normally do before selecting updates?

   Delete every existing backup Change every package slug Run Check all and review versions and errors Enable anonymous REST access
   Hint

   Separate local orchestration, remote execution, transport evidence, and verified production state.

4. 4. Which configured sites are included by enabled_sites?

   Which configured sites are included by enabled_sites?

   Entries with a URL and secret_env that are not explicitly disabled Only localhost installations Every JSON object regardless of fields Only sites whose WordPress admin is open
   Hint

   Separate local orchestration, remote execution, transport evidence, and verified production state.

5. 5. How does the dashboard obtain the secret for a configured site?

   How does the dashboard obtain the secret for a configured site?

   It downloads the secret from the public status endpoint It stores the secret in a page cookie It derives the secret from the domain name It reads the environment variable named by secret_env
   Hint

   Separate local orchestration, remote execution, transport evidence, and verified production state.

6. 6. Why should every live site use a different remote secret?

   Why should every live site use a different remote secret?

   It removes the need for HTTPS It makes PHP execute faster A secret compromise is contained to one site It guarantees GitHub availability
   Hint

   Separate local orchestration, remote execution, transport evidence, and verified production state.

7. 7. Why should real .env and config/sites.json files remain uncommitted?

   Why should real .env and config/sites.json files remain uncommitted?

   WordPress deletes committed files JSON cannot be version controlled They can expose operational site information and secret references or values They prevent CSS caching
   Hint

   Separate local orchestration, remote execution, transport evidence, and verified production state.

8. 8. What does the local CSRF token protect?

   What does the local CSRF token protect?

   WordPress password hashing DNS resolution Dashboard POST actions triggered through the operator browser GitHub release downloads
   Hint

   Separate local orchestration, remote execution, transport evidence, and verified production state.

9. 9. For a non-GET request, what body is included in the HMAC signature base?

   For a non-GET request, what body is included in the HMAC signature base?

   An empty string in every case The exact JSON payload sent to the remote endpoint The contents of packages.json The HTML returned by WordPress
   Hint

   Separate local orchestration, remote execution, transport evidence, and verified production state.

10. 10. Which path is used when constructing the dashboard signature?

    Which path is used when constructing the dashboard signature?

    The local dashboard filesystem path The GitHub repository path only The browser referer The parsed URL path of the complete remote URL
    Hint

    Separate local orchestration, remote execution, transport evidence, and verified production state.

11. 11. How is a request nonce generated by the dashboard?

    How is a request nonce generated by the dashboard?

    Sixteen cryptographically random bytes encoded as hexadecimal The package version repeated twice The site label converted to lowercase A sequential database post ID
    Hint

    Separate local orchestration, remote execution, transport evidence, and verified production state.

12. 12. What are the dashboard cURL connection and total timeout values?

    What are the dashboard cURL connection and total timeout values?

    45 seconds to connect and 15 seconds total One second for both No timeout 15 seconds to connect and 45 seconds total
    Hint

    Separate local orchestration, remote execution, transport evidence, and verified production state.

13. 13. Why does the dashboard explicitly set CURLOPT_PROXY to an empty string?

    Why does the dashboard explicitly set CURLOPT_PROXY to an empty string?

    To bypass an inherited unusable proxy in the local Laragon environment To make remote requests anonymous To disable HTTPS verification To force all traffic through GitHub
    Hint

    Separate local orchestration, remote execution, transport evidence, and verified production state.

14. 14. How does the dashboard choose a CA bundle?

    How does the dashboard choose a CA bundle?

    It disables certificate checking It uses LUBINIK_FLEET_CA_BUNDLE when valid, then known Laragon or XAMPP fallbacks It downloads a new certificate for every request It reads the active theme stylesheet
    Hint

    Separate local orchestration, remote execution, transport evidence, and verified production state.

15. 15. How are packages selected across several sites submitted?

    How are packages selected across several sites submitted?

    All package names are sent to the first site only One global request writes to every server They are grouped by site and each site receives one update-batch request The dashboard opens an SSH session per file
    Hint

    Separate local orchestration, remote execution, transport evidence, and verified production state.

16. 16. Why does update_selected apply array_unique to package names per site?

    Why does update_selected apply array_unique to package names per site?

    To sort sites by storage size To remove failed sites To rotate remote secrets To avoid requesting the same package twice in one site batch
    Hint

    Separate local orchestration, remote execution, transport evidence, and verified production state.

17. 17. Why does the dashboard fetch status again after an update or rollback?

    Why does the dashboard fetch status again after an update or rollback?

    To publish a GitHub release To collect post-action evidence instead of assuming the action changed the site correctly To delete remote logs To renew the browser CSRF token only
    Hint

    Separate local orchestration, remote execution, transport evidence, and verified production state.

18. 18. What extra safeguard applies to updater-agent self-updates?

    What extra safeguard applies to updater-agent self-updates?

    They are always silently installed first They cannot be backed up They require disabling HMAC A separate explicit confirmation must be sent
    Hint

    Separate local orchestration, remote execution, transport evidence, and verified production state.

19. 19. What storage details does the dashboard summary emphasize?

    What storage details does the dashboard summary emphasize?

    Only the global total with no site context Fleet total, temporary item count, and the largest site contributor Only database table sizes Only browser cache usage
    Hint

    Separate local orchestration, remote execution, transport evidence, and verified production state.

20. 20. How are local dashboard operations recorded?

    How are local dashboard operations recorded?

    As PHP code inside wp-config.php As append-only JSON lines with a UTC timestamp and an exclusive write lock By rewriting the complete Git history Only in browser localStorage
    Hint

    Separate local orchestration, remote execution, transport evidence, and verified production state.