For most pages you expect response codes below 400, typically 200.
Therefore the default handling fails with codes over or equal 400.
In order to check that your resource is protected as expected you would need to write a custom step (maybe subclassing "Invoke").