We are securing our builds, and one of the pentest findings was that the jump servers allowed outbound connections meaning from the jump server (we gave them access) they were able to make an outbound connection to establish their C2. For corporate Windows build, I think it makes sense to follow CIS benchmark rationale in that its going to cause more issues. But how about for Jump Server where it is a little more defined in what you do. If we are going to restrict outbound connections, what port do we do (e.g. whitelist approach for which ports?) I will say the Jump Servers are to a SWIFT environment so it is rather important.

CIS benchmark rationale e.g. 9.1.3 (L1) Ensure 'Windows Firewall: Domain: Outbound connections' is set to 'Allow (default)' (Scored)

Some people believe that it is prudent to block all outbound connections except those specifically approved by the user or administrator. Microsoft disagrees with this opinion, blocking outbound connections by default will force users to deal with a large number of dialog boxes prompting them to authorize or block applications such as their web browser or instant messaging software. Additionally, blocking outbound traffic has little value because if an attacker has compromised the system they can reconfigure the firewall anyway.