An engineer must define a URL object on Cisco FMC. What is the correct method to specify the URL without performing SSL inspection?

The correct answer is A. Use Subject Common Name value. When defining a URL object in Cisco FMC to match HTTPS traffic without performing SSL decryption/inspection, the firewall cannot read the encrypted HTTP headers to see the full URL path. However, it can read the TLS handshake in plaintext, which contains the Subject Common Name…

Configuration

Question

Options

AUse Subject Common Name value.
BSpecify all subdomains in the object group.
CSpecify the protocol in the object.
DInclude all URLs from CRL Distribution Points.

How the community answered

(53 responses)

A
81% (43)
B
4% (2)
C
4% (2)
D
11% (6)

Explanation

When defining a URL object in Cisco FMC to match HTTPS traffic without performing SSL decryption/inspection, the firewall cannot read the encrypted HTTP headers to see the full URL path. However, it can read the TLS handshake in plaintext, which contains the Subject Common Name (CN) from the server's SSL certificate (and/or the SNI extension). By using the Subject Common Name value in the URL object, FMC can match HTTPS destinations based on the certificate's CN without needing to decrypt and re-encrypt the session. Listing subdomains (B) is redundant if wildcards or CN matching is used. Specifying the protocol (C) alone is insufficient to distinguish specific URLs. CRL Distribution Points (D) are used for certificate revocation checks, not URL filtering.

Topics

#Cisco FMC#URL Filtering#SSL Inspection#Firepower Threat Defense

Community Discussion

No community discussion yet for this question.

Full 300-710 Practice