On a Cisco Secure Firewall (FTD), a social-media application must be blocked for all users except members of the Marketing AD group. Identity sources are already mapping users to IP addresses. How should the access control rules be built?
Select an answer to reveal the explanation.
Short Explanation
Access control rules are read top to bottom and the first match wins, so put your exception first. Marketing hits its allow rule; everybody else falls through to the block. Flip the order and the block rule eats Marketing too.
Full Explanation
FTD access control evaluates rules in order and acts on the first rule whose conditions all match. Application Visibility and Control identifies the social-media application regardless of port, and the identity policy supplies the user and group for each connection, so a rule can combine an application condition with a Marketing group condition. Placing that allow rule above a general rule that blocks the application for any user gives Marketing access while everyone else matches the block. Reversing the order means the broad block matches Marketing traffic first, so the allow rule below it is never reached. Blocking a URL category and allowing Marketing subnets replaces user identity with address location; Marketing staff on other subnets would be blocked and non-Marketing users sharing a subnet would be allowed, and category-based blocking may miss traffic the application detector would catch. Allowing everyone and relying on an intrusion policy misuses IPS: intrusion rules detect exploits and malicious patterns, not group membership, so they cannot implement a business access decision. Exam caveat: application identification sometimes needs several packets, so early packets may be allowed until the application is identified. Operational check: generate traffic as a Marketing user and as another user, then confirm in connection events that each hit the intended rule with the expected user, application and action.