URL category in the destination of a security policy will work sort of like a dynamic IP list, it's going to allow a TCP handshake through based on the destination IP belonging to a category
URL filtering profile will not care about the session itself (that relies on a web-browsing policy) but will see which url is being accessed and then apply an action with a user-friendly interface if the action is 'negative': a block page will be presented for blocked categories, a continue page can be presented for 'questionable' categories and so on
URL Category in the security policy match criteria allows you to vary the security profiles based on the URL category. Security profiles are things like AntiVirus Profiles, Vulnerability Profiles, WildFire Profiles, Anti-Spyware Profiles, File Blocking Profiles, Data Filtering Profiles, etc.
One common use-case is to allow users to visit questionable URL categories, but restrict the file types they can download from those locations.
You need 2 security policy rules to accomplish this. The first policy allows web-browsing with URL category = unknown/parked/insufficient, and then you attach a strict file blocking profile that prevents dangerous file types from being downloaded (PE, pdf, office, java, flash, etc.)
The 2nd security policy is for web-browsing in general, no URL category match, but then you can attach a less restrictive file blocking profile that allows PDFs, office docs, etc.
This concept/tactic is discussed in a little more detail in the "Best Practices for Ransomware Prevention" document, Step #4, found here:
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!