The front-desk PC is not a thirteenth row

Lesson map

Lesson 15. Map, example, EX061.

flowchart TD
  L["Dictionary length 12"] --> P["Rates use denominator 12"]
  F["Front-desk computer"] --> O["Described in prose, not keyed"]
  M["Fourteen email accounts"] --> E["A mailbox count, not a laptop count"]
  O --> R{"May these enter the denominator?"}
  E --> R
  R -->|No| K["Keep 12"]

Three populations. One of them is the matrix.

Logical drawing

in the script
    FB01 through FB12
in the prose, not in the script
    front-desk computer
    cupboard laptop, wiped
counted and not listed
    fourteen email accounts

Learning outcomes

After this chapter, you should be able to:

1. Keep the front-desk computer outside the twelve-row denominator.
2. Describe its restrictions as operational prose, not as an application-control policy.
3. Keep fourteen mailboxes from becoming fourteen laptops.

15.1 A limited account is not a code-integrity policy, and it is not a row.

len(laptops) is 12 because the dictionary has twelve keys. Every rate in the print uses that denominator. The front-desk computer is real in the case and absent from the dictionary. It is a shared machine at the desk, used by many volunteers, including people Leah may not have met. Its controls are stated in prose. It has a standard account that opens only the browser and the booking system. The screen locks when the machine is unattended. Volunteers sign in to the booking system with their own accounts, so an action can be traced to a person. The shared front-desk login has its own strong password in a shared vault. None of that text appends FB13.

Microsoft's application-control documentation describes a stricter mechanism than "this account is set up to open two programs." A code-integrity policy is enforced by the platform when a binary starts, using signatures or hashes the policy names. Leah's sentence does not include a policy file, a publisher rule, or a hash of the booking program. An administrator can still install software. The everyday front-desk account is not that administrator. Calling the desk "application controlled" borrows a mechanism the file does not implement. The guest account being off is a fourth checklist setting, and it is a different object again: the built-in guest account, not the shared front-desk login, and not a wireless guest network.

Fourteen is a third population. The week-two example says MFA is turned on for all fourteen email accounts. The file does not list the fourteen, so a reader cannot derive which mailboxes are the ones beyond the laptops. Fourteen mailboxes are not fourteen rows, and they are not twelve laptops plus the front desk plus a named spare. The cupboard laptop was wiped and recorded as disposed. It is not available to pad the fleet to a rounder number. CIS Benchmarks are a broad configuration baseline. Leah applied a short checklist by hand. A benchmark score is not in the file. Printing 13 of 13 would require a key the program never allocated.

15.2 Worked example

Lesson table; scroll horizontally to read all columns →

Synthetic case. No policy XML and no hash of the booking system are added.

Errors and limits

Tracing a booking to a person depends on personal booking accounts. The shared vault password does not provide that trace by itself.

Apply

• EX061 — Which population? A classmate adds the front-desk computer as FB13, treats fourteen email accounts as fourteen laptops, and says a code-integrity policy is on file. What is the denominator, and what is missing?
  Show marking criteria

  Rubric: 3 = the denominator stays 12; the front desk, the fourteen mailboxes, and the wiped cupboard laptop stay outside the dictionary; no policy file and no hash are added; the guest account stays distinct from the shared desk login;; 2 = 12 stays 12;; 1 = one population;; 0 = none.