Doesn't this security realm allows anonymous to Overall.Read? If so, the test would be ineffective to show that the permission is not needed.