A.The new sessions matching the policy are denied. The existing sessions are dropped.
B.The new sessions matching the policy are denied. The existing sessions, not being allowed to carry any traffic, simply timeout.
C.The new sessions matching the policy might be allowed through if they match another policy. The existing sessions are dropped.
D.The new sessions matching the policy are denied. The existing sessions continue until they are completed or their timeout is reached.