8 questions on what you just read. Nothing is saved or issued. Use the result to see which of the 4 lessons to revisit while they are still open in the rail.
1. Your ceiling contains "network": true. A package asks for nothing. What can it reach?The network, because the host allows it Nothing off the machine The network, but only for accounts that opted in
2. An application asks for List and Open on one session service. Its ceiling allows only List. What survives?Only List Neither method, because a ceiling cannot contain bus rules Both methods, because the destination is allowed
3. A package asks for the whole home read-write. Your ceiling allows the home read-only. What runs?Nothing. The request exceeds the ceiling, so the launch is refused The application, with read-only access to the home The application, with the read-write access it asked for, and a warning
4. You want to turn on verified launch across a fleet. What do you set first?warn, and read what it would have refused off, and set a ceiling instead refuse, so nothing unrecognised ever starts
5. The host requires signatures and an unsigned application is installed. What happens?The application stays installed but unenrolled, then enforcement decides whether it may launch It launches once so the user can approve its signer The install is rolled back and its files are removed
6. What is the difference between require_publisher and require_approval?Publisher applies to public registries; approval applies to private registries They are aliases kept for manifest version 1 compatibility Publisher checks an accepted signer; approval requires the organisation to countersign the exact package state
7. A revocation names an origin but no generation. What does it withdraw?Only generations installed after the policy was written Every generation of that origin Only the newest installed generation
8. A removed package refuses enrolment after reinstall. What is the safe order to investigate?clear-removal, status, explain remove the trust policy and reinstall status, explain, then clear-removal only after reading what will be lost
