What is the default action when a new custom category is created and added to an access policy?

When a new custom URL category is created on the Cisco Secure Web Appliance (WSA), its default action within all existing Access Policies is set to Monitor. This design choice prevents the unintentional blocking of potentially critical web traffic. The "Monitor" action permits the traffic to proceed to its destination but ensures that all transactions matching the new category are logged. This provides administrators with visibility into the traffic patterns, allowing them to make an informed decision later whether to change the action to "Allow" or "Block" based on the observed activity.

B. allow: While "Monitor" does allow traffic, it specifically includes logging for review. "Allow" is a distinct action that does not imply this default level of scrutiny for a new category.

C. block: Blocking a new, un-evaluated category by default would be disruptive and could inadvertently deny access to necessary resources, violating the principle of least disruption.

D. decrypt: Decryption is an action configured within Decryption Policies to inspect encrypted traffic, not the default access control action for a URL category in an Access Policy.

1. Cisco Web Security Appliance User Guide

AsyncOS 14.0

Chapter: Controlling Web Access

Section: URL Filtering

Subsection: Actions for URL Categories.

"When you create a custom URL category

the default action for that category is Monitor in all access policies." This statement explicitly confirms the default behavior. The guide further explains that the Monitor action is intended for tracking traffic to specific categories without blocking it.

2. Cisco Web Security Appliance Configuration Guide

AsyncOS 15.0

Chapter: Access Policies

Section: Configuring URL Filtering.

The documentation details the process of adding categories to an access policy. It shows that for any newly defined category

the initial state in the policy matrix is "Monitor

" which an administrator must then consciously change to "Allow

" "Block

" or another action. This default ensures visibility without immediate impact.