Which policy type would enforce a security rule prior to user authentication to prevent changes after login?

• A. Post-authentication policy
• B. Authorization policy
• C. Pre-authentication policy
• D. Global policy

Answer: (C)

Enforcing a security rule before any user credentials are checked relies on pre-authentication checks. These policies are evaluated before authentication, so they control access and enforce controls before a login is completed. That makes them the right mechanism to prevent changes or bypasses that could occur once a session starts.

A post-authentication policy runs after login, affecting the already authenticated session, not preventing actions before access is granted. An authorization policy determines what resources an already authenticated user can reach, again after authentication. A global policy might apply broadly but doesn’t specifically target the timing of authentication, so it doesn’t isolate the pre-login enforcement.