Eight questions on what
you have just read. Nothing is recorded
and nothing is issued for it: it is here so you find out which of the four
lessons to read again, while you still have them open in the rail.
1. Your ceiling contains "network": true. A package asks for nothing. What can it reach?The network, because the host allows it Nothing off the machine The network, but only for accounts that opted in
2. Your ceiling names socketSystemBus and nothing else on the bus. What happens to socketBluetooth?Nothing. It was not named, so it is left to the manifest It is held too, because it opens the same socket The manifest is refused as ambiguous
3. A package asks for the whole home read-write. Your ceiling allows the home read-only. What runs?Nothing. The request exceeds the ceiling, so the launch is refused The application, with the read-write access it asked for, and a warning The application, with read-only access to the home
4. You want to turn on verified launch across a fleet. What do you set first?warn, and read what it would have refused off, and set a ceiling instead refuse, so nothing unrecognised ever starts
5. The host requires signatures and an unsigned application is installed. What happens?The application stays installed but unenrolled, then enforcement decides whether it may launch It launches once so the user can approve its signer The install is rolled back and its files are removed
6. What is the difference between require_publisher and require_approval?Publisher applies to public registries; approval applies to private registries They are aliases kept for manifest version 1 compatibility Publisher checks an accepted signer; approval requires the organisation to countersign the exact package state
7. A revocation names an origin but no generation. What does it withdraw?Every generation of that origin Only generations installed after the policy was written Only the newest installed generation
8. A removed package refuses enrolment after reinstall. What is the safe order to investigate?clear-removal, status, explain status, explain, then clear-removal only after reading what will be lost remove the trust policy and reinstall
