Which statement best describes the recommended ordering of SOA rules?

• A. The order of rules is irrelevant and can be random.
• B. Always start with a deny rule and end with a permit rule.
• C. Most specific rules should be at the top, with more generic rules toward the bottom; a deny all rule at the end is recommended.
• D. Most generic rules should be at the top.

Answer: (C)

Rule evaluation is typically top-down, so the order of rules determines which one applies. Place the most specific rules first so narrow, explicit cases are checked before broader ones. This way a precise restriction isn’t bypassed by a later, more general rule. Keep more generic rules toward the bottom so they can cover wider situations without shadowing the specifics above. Ending with a deny-all rule provides a safe default—anything not explicitly permitted is blocked.

If you put generic rules first, a broad allowance could match before a specific restriction is checked, potentially permitting access you intended to block. Ending with a permit instead of a deny-all defeats the default-deny security posture, since anything not matched by explicit permits would be left unblocked. Placing most generic rules at the top also undermines the principle of least privilege.