cpak Developer

1. 1. Which order describes the main launch decisions before the application process begins?

   Compose layers, grant addon permissions, resolve package, start the broker Start the process, mount the image, verify the manifest, apply the ceiling Create namespaces, resolve package, ask the storage driver, calculate policy Resolve package, calculate policy, compose layers, prepare the boundary
2. 2. A user override removes network and the system ceiling allows it. What is the effective network policy?

   Denied only when verified launch is set to refuse Allowed because the system ceiling has priority Allowed only for nested packages Denied because a ceiling cannot restore a removed grant
3. 3. Which mechanism prevents a process from gaining privilege through a setuid executable after launch setup?

   OverlayFS The package lock no_new_privs The runtime index
4. 4. Why is an arbitrary command field invalid for a host action provider?

   It prevents cpak from choosing Podman or Docker It requires a system bus It turns a finite policy-gated operation into general host execution It cannot preserve standard output
5. 5. A container action asks to remove a host container without the requesting package ownership label. What should the provider do?

   Ask the desktop user for confirmation Remove it when manage-owned is granted Forward it only to a rootless backend Refuse it before selecting the backend operation
6. 6. What may a storage driver change while repairing a derived checkout?

   The package manifest digest Only rebuildable data under its assigned driver root The application's writable data The immutable source layer
7. 7. Why must a storage driver publish a checkout atomically?

   So a failed preparation never replaces the last valid checkout with a partial one So the driver can run as another user So OverlayFS can sort the lower directories So source layers can be removed immediately
8. 8. An external storage driver returns a symlink that escapes its assigned root. What happens?

   cpak rejects the returned path after symlink resolution The system ceiling decides cpak follows it when the socket owner matches cpak mounts it read-only
9. 9. Which runtime source installer is the smaller boundary for a Debian package whose maintainer scripts are not needed?

   tar, after renaming the package dpkg deb-extract file
10. 10. A runtime source download returns one byte more than its declared size. What happens?

    The extra byte is ignored and SHA-256 is checked The source is installed when the package is signed The download is rejected before installation The runtime source is retried without a size check
11. 11. What is the correct slot mode for choosing either Go or TinyGo as the active sdk.go provider?

    exclusive nested multiple layer
12. 12. A provider exports a library_path and include_path. What does that change?

    The provider paths join the runtime and compiler search environments The parent receives new host filesystem permissions The provider becomes a required dependency The Store selects it for every installed parent
13. 13. A nested request claims a different parent origin from the process that opened the private socket. Which identity is authoritative?

    The desktop account name The authenticated package instance bound to the connection The origin written in the request The installed dependency's publisher
14. 14. A package session declares an identifier already owned by a system session. What should registration do?

    Register both and let the display manager decide Rename the system session Replace it after Polkit approval Refuse the collision
15. 15. Verified launch finds a checkout that contradicts the state bound to its layer. Enforcement is off. What happens?

    The storage driver chooses whether to continue The launch is refused as tampered The launch starts with a warning The layer is enrolled again automatically
16. 16. An update fails after staging new runtime sources but before switching the active package record. Which version remains active?

    Whichever version has the newer OCI digest Neither version until audit repairs the transaction The previous version The staged version, without its exports

0 of 16 answered. Finish the 16 remaining questions to submit the exam.