フリー問題

問題文

A production deployment asks what should happen if the controller becomes unreachable. What does the guide recommend?

選択肢

1. New connections should be allowed without authorization until the controller returns, so that business continuity is preserved and the outage stays invisible to its users.
2. Controllers should run in high-availability mode with synchronized state, and implementations should enforce cached policies locally until reconnection.
3. All existing sessions should be terminated immediately, since a session that cannot be re-evaluated has to be treated as unauthorized, and the rule applies to every session open when the controller went away.
4. The gateways should elect one of themselves as an interim controller using a consensus protocol, so that authorization decisions continue to be made from the current policy set rather than from a cached copy that may already be stale.