The Rule That Never Gets Reached
At a university, a two-node NGFW cluster protects 12,000 students. The access policy has rule 10: source Student-Net (10.50.0.0/16), destination Any, service Any, action Allow, no deep inspection, logging on. Rule 20: source Student-Net, destination Malware-C2 category, action Deny, logging on. Rule 30 allows Staff to Any. After an incident, a student host 10.50.12.77 was seen connecting to a known command-and-control IP 203.0.113.77 on TCP 443. The connection log shows rule 10 matched; rule 20 has zero hits. The security team wants to block C2 immediately without breaking a mandated 'open internet' for students, and without relying on a proxy. The firewall has URL filtering and IPS licenses, but TLS inspection is not enabled.
1. Explain why rule 20 has zero hits and what policy change would make the block effective.
Read the worked answer
Forcepoint access rules are evaluated from top to bottom, and a matching rule with a Stop action ends evaluation. Rule 10 matches every student flow because its destination is Any and its service is Any, so rule 20 is never reached; rule specificity does not override rule order. The connection log showing rule 10 confirms this. The safest immediate fix is to place a deny rule for the Malware-C2 category above rule 10, or to narrow rule 10 so it does not cover destinations that must be denied. Using Continue on rule 10 is possible, but it makes the final action depend on later rules and is easier to misconfigure. After the change, generate a test from a student host to the known C2 IP and confirm the deny rule logs the hit.
2. Propose a policy design that preserves the mandated open internet while blocking C2 traffic, and describe how you would validate it.
Read the worked answer
Keep a broad student allow rule, but put explicit deny rules above it for malicious URL categories, IP reputation blocklists, and known C2 destinations. Add an inspection rule for allowed student traffic that uses the IPS/malware profile so allowed sessions can still be inspected for C2 signatures. If URL filtering and IPS are licensed, use them together rather than relying on one control. If the mandate permits it, enable TLS inspection selectively for high-risk categories, but do not make that a prerequisite for the immediate block. Validate by testing from 10.50.12.77 to 203.0.113.77, checking that the new deny rule receives the hit and that ordinary student traffic still matches the allow rule. Review false positives and rule counters before enforcing broadly.
3. The C2 IP is not in any URL category and the session is TLS-encrypted. What options remain without full TLS break-and-inspect?
Read the worked answer
Without TLS inspection you cannot see the encrypted payload, so use layered controls: IP reputation and threat-intelligence feeds to block known C2 addresses, DNS filtering or sinkholing for associated domains, endpoint detection on student devices, and flow-level anomaly detection for beaconing behavior. TLS metadata such as SNI, certificate reputation, and destination reputation can help if those features are available and legally acceptable. Combine these with the access-layer deny rules and IPS inspection of unencrypted metadata. Be explicit that this is risk reduction, not full content inspection; if the threat model requires payload visibility, TLS inspection must be added with the appropriate privacy and legal review.