Installation occurs by reading the XML file and importing into the target system metabase. If a web site with the same name exists it is overwritten. If there are multiple web sites with the same name on the system the first matching one will be removed and overwritten.
Special cases include untyped keys/nodes (see below for more info) and SSL certificates, which are not deployed. The relevant settings for SSL certs in IIS (SSLCertHash and SSLStoreName) are preserved during a deployment if they exist on the target, but if they do not exist they are not added.
To bring up a secure site after being deployed (or redeployed) requires a restart of IIS.