cpak Administrator

1. 1. Your ceiling contains "network": true and a package asks for nothing. What can it reach?

   Nothing off the machine It depends on the enforcement level The network, for accounts that opted in The network, because the host allows it
2. 2. A key your ceiling does not name is:

   Granted, because the ceiling did not object Refused at install time as undeclared Left to the manifest and the owner of the installation Denied, because a ceiling is a list of what is permitted
3. 3. An application asks for List and Open on one session service. Its ceiling allows only List. What survives?

   Open only, because it changes state Only List Both methods, because the destination is allowed Neither method, because a ceiling cannot contain bus rules
4. 4. A package asks for the whole home read-write and your ceiling allows the home read-only. What runs?

   Nothing: the request exceeds the ceiling The application, with read-only access to the home The application, with no filesystem access at all The application, with the access it asked for and a warning
5. 5. The same manifest also asks for /mnt/work, which the ceiling does not cover. What happens to that one?

   It makes the launch refuse It is kept, because the ceiling is silent about it It is gone It is downgraded to read-only
6. 6. You are turning on verified launch across a fleet. What do you set first?

   off, and set a ceiling instead refuse, on one machine, then the rest warn refuse
7. 7. What does enforcement decide?

   Which publishers a machine will install from Whether users may write their own overrides How wide any installation on the host may be Whether a launch has to match what was recorded when it was installed
8. 8. Which of these can a ceiling do?

   Remove a package from another account Make an unsigned package count as signed Narrow what a package and the installation owner agreed on Give a package access neither its manifest nor its owner requested
9. 9. Setting a ceiling asks for an administrator password. When is the file read?

   At the next launch of each application Only when cpak system ceiling is run After authenticating, so a bad file costs a password Before anybody is asked to authenticate
10. 10. cpak installs into a person's own home as that person. What can you do to another account's installation?

    Remove it, as the machine administrator Nothing directly: what you set is the policy the host permits Re-enrol it under the fleet policy Read what it holds with cpak list
11. 11. A host requires signatures and receives an unsigned package. Which statement is accurate?

    The package runs once while the desktop asks for approval The package is installed but left unenrolled, and enforcement handles any later launch The package is enrolled under the local account identity The package is deleted before its manifest can be recorded
12. 12. An approved signer entry contains only a GitHub Actions issuer and leaves the other signer fields out. What does it accept?

    Nothing, because every signer field is mandatory Only repositories below the approved_origins list Any package signed through that issuer, unless another policy condition narrows it Only packages whose origin matches the signing workflow repository
13. 13. A trust policy revokes an origin without naming a generation. What is revoked?

    The currently installed generation only Future generations only The signer, across every origin Every generation of that origin
14. 14. Which command changes state while diagnosing a refusal left by a removed package?

    cpak system explain cpak system trust cpak system clear-removal cpak system status

0 of 14 answered. Finish the 14 remaining questions to submit the exam.