問題文
An architect is asked to justify why the perimeter rule set ends with a deny of everything not explicitly permitted, when a permit of everything not explicitly denied would need far fewer entries. What is the strongest justification?
選択肢
- Auditors require the shorter rule set to be documented, so a permit-by-default set with fewer entries is easier to present at review time.
- A new service that nobody reviewed stays blocked, so an omission fails toward safety rather than toward exposure.
- The rule set is evaluated faster, because the boundary device can stop at the first match and a deny-by-default list places the most frequently matched permits near the top where they are found in fewer comparisons.
- A deny-by-default set cannot contain contradictory entries, so the order in which the entries appear stops mattering once the default is set.