HOTSPOT
Your network contains an Active Directory domain named contoso.com. The domain contains 25
servers. All servers run Windows Server 2012 R2.
You need to create a Windows Firewall rule to prevent administrators from using Internet Explorer
to access the Internet while they are logged on interactively to the servers. The solution must not
prevent administrators from accessing websites on the internal network.
How should you configure the rule?
To answer, select the appropriate options in the answer area.
Answer: 
Explanation:
Could anyone explain this please?
I just don’t get it and spent way too much time already searching for the answer.
Thanks!
In this case, the users are logged into the server already. The Firewall is going to prevent the users from accessing websites outside of the server (Hence, outbound). The firewall is targeted at preventing them from doing this with Internet explorer (Hence, Program vs port which would be used if you want to block all web traffic like http or https). From there, you are doing this on the domain, so profile is domain based.
How does that satisfy the requirement of not blocking internal websites? If you block the program then you can’t go outbound period. Why not by port and proxy the internal sites?