Which policy type defines criteria for granting access to internal resources after user authentication?

• A. Client policy
• B. Access policy
• C. Authorization policy
• D. VPN policy

Answer: (C)

After a user has been authenticated, the system must decide what they are allowed to do. This is governed by an authorization policy, which defines the rules and permissions that control access to internal resources. It uses identity, roles, group membership, and other attributes to determine concrete rights—such as which applications can be launched, which files can be opened, or which actions are permitted. It can also include conditions like time of day, device type, or location.

VPN policy governs how a user connects to the network, not what they can access once connected. Client policy typically refers to settings on the user’s device. While sometimes you’ll see broader terms like access policy, the specific mechanism that determines access after authentication is the authorization policy.