Which term describes a set of rules that govern how resources are accessed?

• A. Encryption
• B. Policy
• C. Access Control
• D. Authentication

Answer: (B)

Policy defines the rules and guidelines that determine who may access which resources and under what conditions. This governance layer establishes permissions, constraints, and the overall approach to security, guiding how access decisions are made and ensuring consistency across the system. That’s why it’s the best fit for describing a set of rules that govern access to resources. Encryption protects data by turning it into unreadable form, not by specifying who can access resources. Authentication is about verifying identity, not detailing who may do what. Access control is the mechanism that enforces rights defined by policy, applying those rules to grant or deny access, but the rules themselves come from the policy.