What happens if an access policy ends without an Allow action?

Question

Options

• AUser is redirected
• BSession times out
• CAccess is denied
• DPolicy restarts

• A
  5% (1)
• C
  91% (20)
• D
  5% (1)

Explanation

Access policies follow an implicit deny model: unless an explicit Allow action is granted, the default result is denial. If a policy ends without granting access, the system treats the request as unauthorized and blocks it - this is a foundational security principle called "deny by default" or "least privilege."

• A (User is redirected) is wrong - redirection is a web/HTTP concept, not an access control outcome. Policies don't route users to other locations.
• B (Session times out) is wrong - timeouts are caused by inactivity or token expiration, not by policy evaluation reaching its end.
• D (Policy restarts) is wrong - policies are evaluated once per request; there's no looping or restart mechanism.

Memory tip: Think of access policies like a nightclub bouncer with a strict VIP list - if your name isn't explicitly on the list with an "Allow," you don't get in. No entry = denied, not redirected or given another chance.

No community discussion yet for this question.