Option D removes the rule-shadowing condition and applies least privilege to the exact protocol, hosts, users, and device context involved. Zscaler’s microsegmentation release guidance confirms that microsegmentation access-policy rules are organized by order and that traffic not matching an allow rule is blocked. A broad employee allow placed first can therefore defeat a narrower restriction. Moving the non-finance SMB deny above the general allow and limiting permitted SMB access to authorized finance hosts with acceptable posture directly prevents the observed lateral path. QoS changes traffic priority, not authorization. Deception can improve detection but does not remove access to the real file share. URL Filtering governs web destinations and is not the appropriate control for SMB authorization. The reordered, context-specific policy provides deterministic enforcement and better auditability.