5. ______ security models allow only what access is explicitly listed and exclude all other access by default, while _____ security models allow all access by default and only eliminate explicitly listed. _________ is considered to be a best practice.

A. Negative , postitive, negative.

B. Positive, negative, positive.

C. positive, negative, negative

D. Negative, positive, positive