A county elections office uses a time-based ACL for contractors but still sees after-hours access because a broader entry matches first. What ACL principle explains the failure?
Select an answer to reveal the explanation.
Short Explanation
You can think of an ACL as a checklist that stops at the first match. If a broad permit comes before your business-hours rule, the schedule cannot help—so check which entry matches first.
Full Explanation
The failure is explained by top-down, first-match ACL evaluation: the ACL stops at the first matching entry, so a broad permit any any—or a similarly broad permit—above the time-ranged contractor entry allows the traffic before the schedule can apply. Time-based rules are not evaluated independently of their position, and the ACL does not check every matching entry before deciding; that description fails because evaluation stops at the first match. The claim that broader permits always evaluate after time-based denies regardless of sequence also fails: ACL entries are evaluated in their listed order, not according to an automatic preference for time-based rules. The idea that time-based ACLs ignore sequence and randomly choose an ACE each hour is incorrect as well; matching is deterministic and follows the ACL order. Exam caveat: a time-ranged deny below a broad permit is just as ineffective for traffic that already matches the permit. Practical check: inspect the ACL order, confirm the time range is attached to the contractor entry, and move or remove any earlier broad permit that shadows it. Then test access after hours to verify contractor traffic no longer matches an unrestricted entry first.