This question's explanation and your answers so far.
問93
頻出度★★★
S 社の T 営業所では，ID カードによる入室管理システムを導入することになった。T 営業所の施設の種類と管理対象者の区分（以下，対象区分という）を表のように分類し，入室許可の有無の区分（以下，許可区分という）の設定を行う。ここで，表は施設に対して入室を許可する対象区分を“○”，入室を許可しない対象区分を“×”で示す。
表 許可区分の設定
Format 2 has only the single line “Office | ACCEPT | Sales-dept staff”, so a visitor or sales-dept staff member at the reception room matches no line and the default policy DENY is applied. In the table both reception-room entries are “○”, so entry to the reception room would be wrongly prohibited. This is therefore inappropriate.
×Incorrectイ
Format 2 has only the single line “Reception room | ACCEPT | Visitor, Sales-dept staff”, so sales-dept staff at the office have no matching line and the default DENY is applied. In the table Office × Sales-dept staff is “○”, so sales-dept staff could not enter their own office. This is wrong.
×Incorrectウ
“Office | DENY | Visitor” is a redundant line that need not be written at all once the default is DENY, and moreover the essential line “Office | ACCEPT | Sales-dept staff” is missing. As a result, Office × Sales-dept staff matches no line and the default DENY is applied, which conflicts with the “○” in the table. This is the mistake of carrying over, unchanged, the way the figure was written when the policy was ACCEPT (writing only the exceptions).
○エ
正解The policy line is the line that determines the default value applied to any combination that matches none of the Format 2 lines (rule (3)). If the policy is set to DENY, every combination not written explicitly becomes not permitted, so all the “○” combinations that the table permits must be listed using Format 2. The “○” entries in the table are the 3 pairs Office × Sales-dept staff, Reception room × Visitor, and Reception room × Sales-dept staff. By rule (4), person categories that have the same permission category for the same facility can be written together separated by a comma, so the description becomes the 2 lines “Office | ACCEPT | Sales-dept staff” and “Reception room | ACCEPT | Visitor, Sales-dept staff”. Adding the first line “Policy | DENY” to these gives exactly choice エ. Checking it: only Office × Visitor matches no Format 2 line, so the default DENY is applied, which agrees with the “×” in the table, while the remaining 3 pairs all become ACCEPT, agreeing with the “○” entries. Therefore the correct answer is エ.
ここがポイント
Understand the relationship between the default (policy) and the individual rules: the policy is the default value applied when no individual line matches, so when the default is ACCEPT you write only the exceptions to be denied, while when the default is DENY you must write out every target to be permitted — the two are exact opposites. This is the same idea as default-deny / default-permit in firewalls and access control lists (ACLs).
Rules are evaluated in order from the top, the permission category of the first matching line is applied, and no later lines are evaluated (rule (5)). After rewriting, the reliable way to solve the problem is to apply every combination in the table one by one (Office × Visitor = ×, Office × Sales-dept staff = ○, Reception room × Visitor = ○, Reception room × Sales-dept staff = ○) and verify by calculation that the result is the same as in the original table.