Challenge 3: Why ApplicationPoolIdentity Beats a Shared Identity for
Multiple Pools — Solution Walkthrough

The isolation argument:

ApplicationPoolIdentity gives each individual Application Pool its
own unique, dynamically-created virtual account, with its own
unpredictable security identifier (SID) distinct from every other
pool's. File-system permissions, registry access, and other resources
can then be granted specifically to one pool's own identity, meaning
an application running in a different pool -- even on the same
physical server -- has no automatic access to those same resources at
all.

Using a shared built-in account like NetworkService for multiple
pools removes that separation. If several different applications'
pools all run under the same NetworkService identity, any permission
granted to that identity is effectively available to every one of
those pools' applications, not just the one it was actually intended
for. A vulnerability or a malicious script running inside one
application's pool could potentially reach resources that were meant
to belong only to a completely different application, simply because
they share the same underlying Windows identity.

Why this matters more with multiple pools specifically:

With only ever one pool on a server, the distinction matters less --
there's nothing else to isolate FROM. Once multiple genuinely separate
applications share one server, each in its own pool, the whole point
of separating them into different pools in the first place is
undermined if they're then all given the same broad identity anyway.
ApplicationPoolIdentity is what actually makes that separation real at
the operating-system permission level, not just at the level of
"different worker processes."

WHY THIS WORKS AS AN ANSWER
------------------------------
This exercise checks that the reader understands WHY per-pool identity
isolation matters specifically in a multi-application, multi-pool
scenario -- connecting the security identity choice to the same
underlying isolation goal that separate Application Pools already
exist to provide, rather than treating identity as an unrelated,
arbitrary setting.