Which of the following actions can be specified in a policy by default?

Access management policies, such as those in PingAccess, operate at the HTTP layer to protect web applications and APIs. Policies are defined using rules that inspect attributes of the HTTP request, including the HTTP method (or verb). HEAD is a standard HTTP method, alongside GET, POST, PUT, and DELETE. Therefore, a policy can be configured by default to allow or deny requests based on whether the method is HEAD. The other options are not standard HTTP methods.

B. INSERT: This is a database (SQL) command, not a standard HTTP method.

C. CREATE: This is a CRUD operation concept, typically implemented using the HTTP POST method, but it is not an HTTP method itself.

D. UPDATE: This is a CRUD operation concept, typically implemented using HTTP PUT or PATCH methods, but it is not an HTTP method itself.

1. PingAccess 7.3 Documentation, "Managing Rules", section "Add an HTTP Request Rule". The documentation for the "HTTP Method Rule Type" lists the standard HTTP methods that can be specified in a policy, including GET, POST, PUT, DELETE, HEAD, OPTIONS, PATCH, and TRACE.

2. MDN Web Docs, "HTTP request methods". This resource, maintained by Mozilla, is a standard reference for web technologies and lists HEAD as a primary HTTP request method. While not a Ping Identity source, it defines the standard upon which PingAccess operates.