Question

A network engineer deploys Cisco Umbrella using only DNS-layer security (no proxy, no SIG tunnel). Marketing complains that a specific SaaS collaboration site is being fully blocked, but security policy only requires blocking the file-upload subsection of that site while allowing the rest. The engineer confirms the domain is categorized in a blocked content category. What is the correct explanation of Umbrella's behavior in this DNS-only deployment?

Accepted Answer

DNS-layer enforcement resolves policy at the domain level, so it cannot allow part of a domain while blocking a specific URL path; granular URL-path control requires the Intelligent Proxy or full web (SWG) inspection.

Answer

DNS-layer security inspects the full URL by default, so the engineer only needs to add a destination-list allow entry for the specific path.

Answer

The behavior indicates a misconfigured DNS forwarder; pointing internal resolvers directly to Umbrella will restore per-path filtering.

Answer

Enabling SafeSearch in the DNS policy will permit the collaboration site while continuing to block only the file-upload path.