A clientless access policy is composed of which two components?

• A. Rule and profile
• B. Policy and certificate
• C. Condition and action
• D. Rule and policy

Answer: (A)

A clientless access policy is made from a rule and a profile. The rule defines the conditions under which the policy applies—such as which URL or resource is being requested and who the user is. The profile contains the actual clientless access settings that take effect when the rule matches—what web resources are exposed, how authentication and Single Sign-On are handled, any URL rewrites, bookmarks, and other browser-based access details.

This pairing is why the rule plus profile combination is the correct structure. Other options describe pieces that aren’t how clientless access is built: a certificate isn’t what defines the policy’s actions; a general policy with condition and action is broader and doesn’t capture the specific clientless access profile; a rule and policy doesn’t reflect the established two-part construct used for clientless access.