問題文
Why does controlling web access by the category of the destination site exist as a separate capability from blocking individual addresses?
選択肢
- Because addresses cannot be written into a rule at all in a modern design, so the only supported way of expressing a web policy is to name the class of content and let the system resolve the members of that class for each request.
- Because categories are faster to evaluate than addresses, and the capability therefore exists mainly to keep the rule lookup cheap on the busiest links in a large network.
- Because the set of sites in any given class of content changes constantly, so a policy written against the class keeps working without a list being maintained by hand.
- Because a class of content can be inspected without decrypting the session, while an individual address can only be matched after the session has been decrypted at the boundary.