What is the default setting described for the access control system?

What is the default setting described for the access control system?

• A. Default 'allow-all' setting.
• B. Default 'deny-all' setting.
• C. Default 'deny-all' only for privileged accounts.
• D. Default 'deny-all' only outside business hours.

Answer: (B)

The key idea is fail-safe defaults: start by blocking access unless there is a specific, explicit permit. A default deny-all configuration ensures every access request is denied until there is an explicit rule that grants permission. This minimizes risk from misconfigurations, forgotten permissions, or new accounts that shouldn’t have access by default, and it supports the principle of least privilege—only what is truly needed is allowed. Starting with an allow-all default would create broad, unintended access, which is insecure. Denying access only for privileged accounts or only outside business hours introduces exceptions that are easy to miss or override, creating potential gaps in protection. Time-based or role-based exceptions still rely on trackers and can be exploited; they aren’t as robust as a blanket deny-by-default posture. Thus, the most secure and standards-aligned approach is the default deny-all setting.

The key idea is fail-safe defaults: start by blocking access unless there is a specific, explicit permit. A default deny-all configuration ensures every access request is denied until there is an explicit rule that grants permission. This minimizes risk from misconfigurations, forgotten permissions, or new accounts that shouldn’t have access by default, and it supports the principle of least privilege—only what is truly needed is allowed.

Starting with an allow-all default would create broad, unintended access, which is insecure. Denying access only for privileged accounts or only outside business hours introduces exceptions that are easy to miss or override, creating potential gaps in protection. Time-based or role-based exceptions still rely on trackers and can be exploited; they aren’t as robust as a blanket deny-by-default posture.

Thus, the most secure and standards-aligned approach is the default deny-all setting.