During a security review, a SOC analyst notices that compromised internal hosts have been able to freely establish outbound connections to arbitrary external IPs and ports, allowing malware to reach command-and-control (C2) servers. The perimeter firewall currently permits all outbound traffic by default. Which network hardening control should the analyst recommend to most directly limit this C2 communication while allowing legitimate business traffic?