Network Communication by Exception

Deny by default is a posture, not a long list of deny rules.

Objective [a] wants an implicit deny that catches everything you did not explicitly allow. A ruleset that blocks a list of ports and permits the rest is allow by default with deny exceptions, the opposite of the requirement. It fails the moment you forget a protocol: deny every TCP port, and UDP and ICMP still flow.

Outbound traffic is included, and it is the half that gets missed.

The requirement does not exempt outgoing connections. Set the default outbound action to block, then allow what the business needs: web on 80 and 443, DNS, DHCP, NTP, and the directory service ports if you run one. Build the outbound exception list by observing what the environment actually uses, then close the door.

Filtering by port is sufficient.

Allow rules keyed to ports and protocols meet both objectives. Per-destination address allowlists and per-application rules are tighter than the requirement asks and cost more to maintain than they return. Adopt them for your own reasons, not for this requirement.

Host firewalls managed centrally satisfy this at the endpoint.

Windows Defender Firewall with default deny pushed through Intune or Group Policy carries the requirement to laptops that never sit behind your perimeter. Rules delivered by mobile device management do not appear in the local firewall console. When you need evidence, export them from the management plane or query the MDM policy store with PowerShell.