CISSP Practice Question: The security team in a large enterprise is deploying a next-generation firewall…

Correct Answer: A. Implement egress filtering with a default-deny outbound policy, permit only documented business services via explicit allow rules, and apply stateful/application-layer inspection to authorized sessions.

Explanation (CISSP Manager Logic):

This approach enforces the principle of least privilege by ensuring only authorized business traffic leaves the network. Combining a default-deny stance with deep packet inspection provides management with granular control and visibility into potential data exfiltration or command-and-control activity.

By implementing this solution, you:

• Enforce a proactive security posture that prevents unauthorized shadow IT.
• Reduce the attack surface by blocking unapproved outbound ports and protocols.
• Ensure all permitted traffic undergoes rigorous content validation and inspection.

While the other options are relevant, they fall short because:

• B: Reactive deny-lists are error-prone and fail to block unknown threats or unauthorized services.
• C: Focusing only on inbound traffic ignores the critical risk of data exfiltration and internal compromises.
• D: Application filtering without a default-deny policy still permits unapproved traffic by default, increasing risk.

Think like a manager:

Prioritize "Default Deny" as the strategic baseline for all access control. Security must be baked into the architecture through explicit authorization rather than relying on reactive blacklisting.