To restrict contractor access by group membership with the prefix “con,” which expression correctly checks membership?

• A. HTTP.REQ.USERNAME.CONTAINS("con").NOT
• B. HTTP.REQ.USER.IS_MEMBER_OF("con").NOT
• C. HTTP.REQ.USER.IS_MEMBER-OF("con")
• D. HTTP.REQ.USERNAME.CONTAINS("con")

Answer: (C)

Evaluating who can access a resource based on group membership is a common access-control strategy. To restrict contractors by a group prefix, you use the user membership check function. The expression HTTP.REQ.USER.IS_MEMBER-OF("con") tests whether the authenticated user is a member of any group whose name starts with the prefix con. If the user belongs to such a group, the expression evaluates to true, allowing the policy to grant access; if not, it evaluates to false and access is denied. Using NOT would invert that result, which would invert the intended access control. Checking the username for the prefix or merely scanning the username text does not reliably reflect group-based permissions, so that approach is not appropriate for this purpose.