cpak Administrator

1. 1. Your ceiling contains "network": true and a package asks for nothing. What can it reach?

   The network, for accounts that opted in The network, because the host allows it Nothing off the machine It depends on the enforcement level
2. 2. A key your ceiling does not name is:

   Denied, because a ceiling is a list of what is permitted Granted, because the ceiling did not object Left to the manifest and the owner of the installation Refused at install time as undeclared
3. 3. Your ceiling names socketSystemBus. What happens to socketBluetooth?

   It is held too, because it opens the same socket The ceiling is refused as ambiguous Nothing, it was not named It is granted, to keep the bus usable
4. 4. A package asks for the whole home read-write and your ceiling allows the home read-only. What runs?

   Nothing: the request exceeds the ceiling The application, with read-only access to the home The application, with the access it asked for and a warning The application, with no filesystem access at all
5. 5. The same manifest also asks for /mnt/work, which the ceiling does not cover. What happens to that one?

   It is gone It is downgraded to read-only It is kept, because the ceiling is silent about it It makes the launch refuse
6. 6. You are turning on verified launch across a fleet. What do you set first?

   warn off, and set a ceiling instead refuse, on one machine, then the rest refuse
7. 7. What does enforcement decide?

   How wide any installation on the host may be Whether users may write their own overrides Which publishers a machine will install from Whether a launch has to match what was recorded when it was installed
8. 8. Which of these can a ceiling do?

   Remove a package from another account Narrow what a package and the installation owner agreed on Make an unsigned package count as signed Give a package access its manifest never asked for
9. 9. Setting a ceiling asks for an administrator password. When is the file read?

   At the next launch of each application After authenticating, so a bad file costs a password Only when cpak system ceiling is run Before anybody is asked to authenticate
10. 10. cpak installs into a person's own home as that person. What can you do to another account's installation?

    Re-enrol it under the fleet policy Nothing directly: what you set is the policy the host permits Remove it, as the machine administrator Read what it holds with cpak list
11. 11. A host requires signatures and receives an unsigned package. Which statement is accurate?

    The package is installed but left unenrolled, and enforcement handles any later launch The package is deleted before its manifest can be recorded The package runs once while the desktop asks for approval The package is enrolled under the local account identity
12. 12. An approved signer entry contains only a GitHub Actions issuer and leaves the other signer fields out. What does it accept?

    Only packages whose origin matches the signing workflow repository Any package signed through that issuer, unless another policy condition narrows it Only repositories below the approved_origins list Nothing, because every signer field is mandatory
13. 13. A trust policy revokes an origin without naming a generation. What is revoked?

    Future generations only The signer, across every origin Every generation of that origin The currently installed generation only
14. 14. Which command changes state while diagnosing a refusal left by a removed package?

    cpak system trust cpak system status cpak system explain cpak system clear-removal

0 of 14 answered. Finish the 14 remaining questions to hand it in.