At a logistics company the FTD access control policy lists, in order: allow the branch subnet to the server farm on any TCP port with logging, block any source to the server farm on TCP 3389, then allow the server farm out to update servers. A warehouse host opens an RDP session to a print server in that farm. Which access control rule action ultimately governs that RDP session?
Select an answer to reveal the explanation.
Short Explanation
Rule order is the whole game, and the policy reads rules from the top like a checklist until one hits. Once an earlier rule claims the packet, you never reach a lower one. It's first match wins, not best match wins.
Full Explanation
Access control policy rules are evaluated strictly from top to bottom, and the moment a rule's conditions are satisfied the assigned action applies and no lower rule is considered, so the broad allow already decides the RDP session and the port-specific block beneath it is shadowed. The logging on that first rule is what puts the connection into the events store. A most-specific-match approach fails because the platform does not weight rules by how narrow they are, and specificity has no influence once an earlier rule matched. A last-match approach fails for the same reason in reverse, because evaluation stops rather than continuing to the bottom of the list. A default-action fall-through fails because the default action applies only when no rule matches at all, and here one clearly does. Exam caveat: an unreached rule still sits in the policy looking valid, so its presence tells you nothing about real traffic. Practical check: move the narrow RDP block above the broad allow, redeploy, and confirm the new order first.