How are user role-mapping rules processed by the Junos Pulse Secure Access Service gateway?

A.
All rules are processed in a top-down fashion for the best match. If no match is found, the user
is not allowed to sign in to the realm.

B.
All rules are processed in a top-down fashion for the best match. If no match is found, the user
is assigned to the default role.

C.
All rules are processed in a top-down fashion for all eligible matches. If no match is found, the
user is not allowed to sign into the realm.

D.
All rules are processed in a top-down fashion for all eligible matches. If no match is found, the
user is assigned to the default role.

Explanation: