Restrict outbound traffic to essential services (HTTPS/DNS) and block/log all other traffic.
Outbound traffic restricted to HTTPS and DNS only. All other traffic blocked and logged, demonstrating least-privilege enforcement.