A branch maintenance window is running, so a rule blocking the whole branch subnet sits near the top of the access control policy, and the policy default action must stay block all packets. A rule allowing the analytics server was added at the end of the list, but connections to that server are still dropped. Two allow rules below the block open branch traffic to monitoring hosts, and those flows must stay blocked until the window ends. Which access control rule change lets only the analytics server through?

Place the analytics-server allow rule above the broad branch-subnet block. Access control rules are evaluated in order, so the server’s connection matches the specific allow before reaching the subnet-wide deny. Other branch traffic does not match that host-specific allow and still encounters the block; the default-block policy remains unchanged, and the monitoring allows below the block remain ineffective during the maintenance window. Placing the analytics allow immediately below the branch block does not help: the block matches first, so evaluation never reaches the allow. Targeting the full analytics subnet instead of the named server puts an allow above the block but may admit other hosts, contrary to the requirement that only the analytics server pass. Moving the branch block below the monitoring allows lets monitoring traffic match those allows first, so those flows would no longer stay blocked. Exam caveat: confirm that the platform uses first-match processing and check whether any higher-priority policy or implicit rule changes that behavior. Practical check: inspect the effective rule order, then test a connection from the branch to the analytics server and to a monitoring host; confirm the server is permitted and the monitoring host is denied.