Umbrella’s IP layer or cloud firewall (less common for general web).
If Umbrella only blocks via DNS, a local hosts entry overrides. cisco umbrella bypass
This is the bypass method.
"Now," Lennox said, hovering over the enter key. "The computer won't ask the DNS server where the site lives. It will just go straight to the IP we gave it. Umbrella won't see a DNS request for the malicious domain. As far as Umbrella is concerned, we’re just sending encrypted traffic to a random IP address." Umbrella’s IP layer or cloud firewall (less common