Which statement best reflects the principle of fail-safe defaults?

• A. Systems should default to a secure state; access should be denied unless explicitly allowed, minimizing privileges by default.
• B. Systems should always grant access unless blocked by a rule.
• C. Default credentials should be used for convenience.
• D. Security settings should never be audited.

Answer: (A)

Fail-safe defaults means designing the system so it starts in a secure state and denies access unless there is an explicit permission. In practice this is a deny-by-default approach: access is not granted unless a policy or rule specifically allows it. This minimizes privileges by default and reduces the chances of accidental exposure or exploitation, because every access requires explicit authorization.

That idea is why the statement saying systems should default to a secure state and deny access unless explicitly allowed best captures fail-safe defaults. The other options describe opposite or insecure practices—granting access unless blocked, using default credentials, or avoiding audits—which do not align with this principle.