When an administrator creates a new access policy in the Visual Policy Editor, which three options are included by default? (Choose three.)

The fallback option is included by default to ensure that every policy path has a defined outcome, preventing any unevaluated session from reaching an undefined state. It acts as the catch-all branch leading to the Deny End box.

An Allow End box is not included by default; it must be explicitly added by the administrator to terminate a successful authentication or inspection branch.

The Deny End box is included by default as the terminal action on the fallback path, ensuring that any session that does not satisfy an explicitly configured Allow path is denied access by default. This enforces a deny-by-default security posture out of the box.

An empty Resource Assign item is not part of the default policy structure; administrators must manually add this action when they need to assign specific network resources or webtops to authenticated users.

The Start box is always present by default because it represents the mandatory entry point where policy evaluation begins when a new client session is initiated. Every access policy requires exactly one Start box.

A Block All option is not a standard VPE element; access denial is handled by the Deny End box, which serves this purpose on the default fallback path.