In Cisco Secure Firewall Management Center (FMC), access control policies are processed top-down—meaning the first matching rule is applied, and the remaining are ignored. Based on the exhibit, Rule 4 (Access Controlled Groups) is likely being shadowed by a broader rule above it that permits web traffic. To ensure restricted users are denied access to mobile phone shopping categories, Rule 4 must be moved to the top of the rule hierarchy.

Cisco SCAZT (Section 5: Visibility and Assurance, Pages 94–97) describes best practices for rule ordering and inspection logic. Moving the specific block rule (Rule 4) higher ensures it's enforced before general allow rules are evaluated.