An early broad rule overrides the intended guest condition
A fictional ExtremeControl configuration uses the explicitly supplied first-match ordered-rule model. A broad authenticated-device rule appears before a more specific guest-device rule. The supplied evaluation record shows the broad rule matching and the endpoint receiving its associated profile, while the enforcing switch has the relevant configured capabilities. A colleague proposes changing every user password because the desired guest profile did not appear. Another proposes reviewing the conditions, order and intended least-privilege outcome. This written exercise performs no authentication or policy push. It asks the learner to distinguish successful identity verification from the actual first-match authorization result and to preserve an accountable narrow test before changing access for real users.
1. Why did the specific guest rule not determine this result?
Read the worked answer
The earlier broad rule matched first under the supplied model. Successful authentication does not guarantee that the desired later authorization condition is evaluated as the decisive rule.
2. What should the controlled correction examine?
Read the worked answer
Review intended populations, rule conditions/order and profile enforcement, then test representative cases through an approved narrow change. A broad password reset is unsupported by the recorded policy result.