Why Can't Users Reach a Cloud Web Server After Access Control Changes?
An administrator receives reports that users cannot access a cloud-hosted web server. The access control policy was recently updated with several new policy additions and URL filtering. What must be done to troubleshoot the issue and restore access without sacrificing the organization's security posture?
Community Insight
Tests the FMC troubleshooting workflow: use connection events to identify the block before modifying the access control policy, rather than applying a broad allow rule or FlexConfig override.
When a recently updated access control policy blocks a cloud-hosted web server, Cisco FMC connection events reveal the exact rule or URL category causing the block. This page explains why reviewing connection events and then making a targeted policy change is the correct troubleshooting step (B).
Most candidates choose C and immediately create a new allow rule for ports 80/443 to the FQDN, but this skips the validation step and can weaken the security posture by bypassing URL filtering or other policy intent.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
In Cisco Secure Firewall Management Center, the connection events view is the primary tool for troubleshooting access control policy blocks. Because the policy was recently updated with new rules and URL filtering, the block is most likely caused by a specific rule or URL category. Reviewing connection events shows the exact rule, action, and reason for the block, so the administrator can make a targeted change. Modifying the policy only after confirming the block restores access while preserving the organization's security posture, which is what option B describes.Why the Other Options Are Wrong
Option A is wrong because FlexConfig is designed for CLI-level configuration, not for overriding access control policy decisions; a PCAP alone does not identify the responsible rule. Option C is tempting but creates a new allow rule without first validating what blocked the traffic, which can bypass URL filtering or other policy intent and weaken security. Option D uses the packet capture tool to verify blocks, but setting the action to monitor does not properly remediate the policy block and leaves the root cause unaddressed. The best practice is to diagnose with connection events before changing rule actions.Community Comment Notes
Community consensus points to option B: MB2222 wrote that "Connection Event view you should see the blocks" and then you can take action to unblock. Doris8000 also confirmed "yes correct" and referenced a similar earlier question. The comments reinforce the FMC evidence-based troubleshooting approach, though the final answer should always be validated against Cisco's official documentation.Official Reference
Exam Strategy
For troubleshooting questions on Cisco exams, always prefer analysis of existing logs or events before making policy changes. Connection events in FMC are the fastest way to see which rule or URL category blocked traffic, so options that suggest blind allow rules or FlexConfig overrides are usually distractors.
Frequently Asked Questions
Why is creating a new allow rule (C) wrong without checking connection events?
It bypasses the validation step and may override URL filtering or other policy intent; connection events show which rule or category actually blocked the traffic before you change the policy.
Can the packet capture tool in option D restore access to the cloud web server?
Packet capture can confirm a block, but setting a rule to monitor only logs traffic and does not represent a targeted fix; option B's connection-event review is the proper troubleshooting step.