An engineer is creating an URL object on Cisco FMC How must it be configured so that the object will match for HTTPS traffic in an access control policy?

The correct answer is D. Use the subject common name from the website certificate. With HTTPS, the URL path and host header are encrypted inside the TLS tunnel, so FMC cannot directly read the URL string. Instead, FMC uses the Subject Common Name (CN) or Subject Alternative Name (SAN) from the server's SSL/TLS certificate, which is visible during the TLS handsh

Configuration

Question

Options

ASpecify the protocol to match (HTTP or HTTPS).
BUse the FQDN including the subdomain for the website
CDefine the path to the individual webpage that uses HTTPS.
DUse the subject common name from the website certificate

How the community answered

(64 responses)

A
14% (9)
B
9% (6)
C
5% (3)
D
72% (46)

Explanation

With HTTPS, the URL path and host header are encrypted inside the TLS tunnel, so FMC cannot directly read the URL string. Instead, FMC uses the Subject Common Name (CN) or Subject Alternative Name (SAN) from the server's SSL/TLS certificate, which is visible during the TLS handshake, to identify and match the site. Specifying a protocol (A) is not required in the object itself. Using a full FQDN with subdomain (B) or a path (C) only works for plaintext HTTP where the URL is readable; those approaches fail for HTTPS without SSL inspection.

Topics

#FMC URL Objects#HTTPS Inspection#SSL Certificate Matching#Access Control Policy

Community Discussion

No community discussion yet for this question.

Full 300-710 Practice