Endpoint Protection

If I have a CD ROM, its class ID is {4d36e965-e325-11ce-bfc1-08002be10318}, device ID is IDE\CDROMATAPI_DVD*.

From the Device control policy, I added the class ID to hardwre exclusion list and added Device ID to hardware block list, my expectation was CD Rom should be blocked, but unfortunately I still can access to CD Rom after refresh the policy,  it seems to me that exlcusion list takes priority over the blocked list, is this correct result? 

It is correct result.What is your exact requirement?.You remove the exception it will get blocked....

Check the following and see if this helps

Title: 'After setting up an Application and Device Control policy to block CD writing, CD writing is not blocked as expected, and write attempt is not logged'
Web URL: http://www.symantec.com/business/support/index?page=content&id=TECH104800&locale=en_US