A university wants Catalyst SD-WAN to block known malicious URL categories for branch web traffic headed to the internet. Reachability and path selection are already correct. Which policy type does the blocking?
Select an answer to reveal the explanation.
Short Explanation
Picking a faster road does not check what is written on the cargo. You block URL categories with a security policy on the zone pair that faces the internet. An OMP preference only chooses a path, and an SLA only cares about loss and delay.
Full Explanation
URL filtering on Catalyst SD-WAN is part of the security policy, applied with the zone-based firewall to the zone pair that carries internet-bound traffic. It inspects the URL category and can block malicious categories without changing which TLOC is preferred. A centralized control policy that raises OMP preference for the internet TLOC changes routing. The paths are already correct, and preference does not look at a URL. An application-aware routing SLA drops or reroutes when loss, latency, or jitter miss the class. It does not classify URL categories, and the symptom to solve is malicious destinations, not a loss target. Cloud OnRamp for Multicloud builds IaaS connectivity. It does not filter URL categories, and an AWS virtual private gateway is not a URL filter for branch web traffic. Exam caveat: URL filtering sees the name only if the policy can observe it. Encrypted HTTPS may need the TLS inspection feature the security policy provides, or it may only see the SNI, depending on what you enabled. Operational check: request a URL in a blocked category from a branch host and confirm the security log on that zone pair records the drop.