An administrator receives reports that users cannot access a cloud-hosted web server. The access control policy was recently updated with several new policy additions and URL filtering. What must be…

Immediately creating a broad 'allow 80/443 to FQDN' rule without verifying the cause of the block could be an over-permissive change that sacrifices security posture if the original block was legitimate.

The most efficient and secure troubleshooting step is to examine Cisco FMC connection events, which will clearly show which traffic is being blocked, by which rule, and why. Once identified, a precise access control rule can be crafted to permit only the necessary traffic, thus restoring access without compromising the security posture.

While packet capture can verify blocks, reviewing connection events is generally a more efficient first step in FMC, providing immediate policy-level details. Creating a 'monitor' rule might not restore access if the issue is a hard block by URL filtering or an IPS rule.

Downloading a PCAP is an advanced troubleshooting step after connection events have been reviewed. Using FlexConfig objects is generally for advanced or unsupported configurations and is not the primary method for creating standard access control rules.