Why Can't Users Reach a Cloud Web Server After Access Control Changes?

300-710 By islever Editorial Last updated

Troubleshoot with Secure Firewall Management Center GUI and device CLI Analyze risk and standard reports such as events (connection, discovery, intrusion, malware, and unified) and network map

Short answer

B Review connection events to validate the block, then modify the access control policy to allow the required traffic.

Question

An administrator receives reports that users cannot access a cloud-hosted web server. The access control policy was recently updated with several new policy additions and URL filtering. What must be done to troubleshoot the issue and restore access without sacrificing the organization's security posture?
  1. Download a PCAP of the traffic to verify the blocks and use the FlexConfig to override the existing policy.
  2. Review the output in connection events to validate the block, and modify the policy to allow the traffic. Correct Answer
  3. Create a new access control policy rule to allow ports 80 and 443 to the FQDN of the web server.
  4. Verify the blocks using the packet capture tool and create a rule with the action monitor for the traffic.

Key Takeaways

Tests the FMC troubleshooting workflow: use connection events to identify the block before modifying the access control policy, rather than applying a broad allow rule or FlexConfig override.

When a recently updated access control policy blocks a cloud-hosted web server, Cisco FMC connection events reveal the exact rule or URL category causing the block. This page explains why reviewing connection events and then making a targeted policy change is the correct troubleshooting step (B).

Common mistake: Most candidates choose C and immediately create a new allow rule for ports 80/443 to the FQDN, but this skips the validation step and can weaken the security posture by bypassing URL filtering or other policy intent.

Expert Analysis

Why the Answer Is Correct

In Cisco Secure Firewall Management Center, the connection events view is the primary tool for troubleshooting access control policy blocks. Because the policy was recently updated with new rules and URL filtering, the block is most likely caused by a specific rule or URL category. Reviewing connection events shows the exact rule, action, and reason for the block, so the administrator can make a targeted change. Modifying the policy only after confirming the block restores access while preserving the organization's security posture, which is what option B describes.

Why the Other Options Are Wrong

Option A is wrong because FlexConfig is designed for CLI-level configuration, not for overriding access control policy decisions; a PCAP alone does not identify the responsible rule. Option C is tempting but creates a new allow rule without first validating what blocked the traffic, which can bypass URL filtering or other policy intent and weaken security. Option D uses the packet capture tool to verify blocks, but setting the action to monitor does not properly remediate the policy block and leaves the root cause unaddressed. The best practice is to diagnose with connection events before changing rule actions.

Community Comment Notes

Community consensus points to option B: MB2222 wrote that "Connection Event view you should see the blocks" and then you can take action to unblock. Doris8000 also confirmed "yes correct" and referenced a similar earlier question. The comments reinforce the FMC evidence-based troubleshooting approach, though the final answer should always be validated against Cisco's official documentation.

Official Reference

https://www.cisco.com/c/en/us/support/security/defense-center/products-installation-and-configuration-guides-list.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

For troubleshooting questions on Cisco exams, always prefer analysis of existing logs or events before making policy changes. Connection events in FMC are the fastest way to see which rule or URL category blocked traffic, so options that suggest blind allow rules or FlexConfig overrides are usually distractors.

Frequently Asked Questions

Why is creating a new allow rule (C) wrong without checking connection events?

It bypasses the validation step and may override URL filtering or other policy intent; connection events show which rule or category actually blocked the traffic before you change the policy.

Can the packet capture tool in option D restore access to the cloud web server?

Packet capture can confirm a block, but setting a rule to monitor only logs traffic and does not represent a targeted fix; option B's connection-event review is the proper troubleshooting step.

More 300-710 FAQ →

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors, not of islever. The comments shown first are the most substantive of the thread — ranked by depth, community endorsement and relevance; expand the list below to read the rest.

From public community threads 3

  1. MB2222 👍 1
    Yes, (B) seems to be the best fit, since in the Connection Event view you should see the blocks and then take particular actions to unblock the connections.
  2. Doris8000 👍 2
    same question as 181
  3. Doris8000 👍 1
    yes correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Changing FTD from Routed to Transparent Mode

S-grade

How Do You Isolate BVI Traffic on a Routed FTD?

S-grade

Cisco FTDv Licensing Model Valid Statements

S-grade

Duo and RTC for FTD Remote Access VPN

S-grade

← Back to 300-710 Study Guide