Default HTTPS Inspection Action Before URL ID
What is the default action before identifying the URL during HTTPS inspection in Cisco Secure Firewall Threat Defense software?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests the default HTTPS inspection action before URL identification; the trap is assuming traffic is dropped or buffered before the URL is known.
This page clarifies the default action taken by Cisco Secure Firewall Threat Defense before identifying a URL during HTTPS inspection. It establishes that the system allows initial packets to pass to complete the connection and identify the traffic.
Choosing 'drop' or 'buffer' under the assumption that a firewall blocks or holds all uninspected traffic, which would actually prevent the TLS handshake and URL identification.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is D (pass). In Cisco Secure Firewall Threat Defense, features like URL filtering require the initial packets of a connection to pass through the system. This allows the TLS handshake to complete and the system to identify the URL before applying the matching access control rule. Blocking or resetting the traffic prematurely would prevent the connection from being established.Why the Other Options Are Wrong
Option A (reset) and Option C (drop) would terminate the connection before the URL could be identified, breaking standard HTTPS traffic. Option B (buffer) is not the default action for this process; buffering every connection before identification would introduce massive latency and is not how the system handles initial handshakes.Community Comment Notes
Commenters agree that the default action is to pass, noting that "a few packets must pass in order for the connection to be established" as one user referenced from the official documentation. Another user pointed out that if it didn't pass, "it will not be sent to the IPS," reinforcing the necessity of allowing the initial traffic.Official Reference
Exam Strategy
For questions about firewall inspection actions, remember that the system must allow the initial handshake packets to pass to identify the application or URL. Actions like drop or reset prevent identification entirely.