問題文
A new analyst at an insurance company asks why a session that clearly matches rule 14 is being handled by rule 6 instead. Which principle of the security rulebase explains the observation?
選択肢
- The rule with the higher hit count is applied first so that the rulebase reorders itself as traffic patterns change and rule 6 has simply been matched more often.
- The rule with the most specific set of criteria wins so that the position of the rules in the list does not matter as long as one of them describes the session more precisely than the others do.
- All matching rules are applied in sequence, and the most restrictive action wins so a permit written above a deny would still be overridden by the deny lower down.
- Rules are evaluated from the top down and the first rule whose criteria all match is applied, so a broader rule placed higher takes the session.