I85PREP
⌘ K
Check Point CCME study materials
Check Point CCME study resources

Check Point CCME: Cloud, SASE and Workspace Security

Check Point CCME · Work through your exam, one topic at a time.

All guide sections

Cloud, SASE and Workspace Security

What the exam tests

This domain covers three related but distinct areas: CloudGuard for cloud estates, Harmony SASE for secure access, and Harmony workspace security for users and devices. The exam tests whether you can separate cloud posture and workload security from user-centric security and choose the right control for SaaS, private applications, endpoints, email, and browsing.

Core rules

  • CloudGuard: cloud-native security. It covers posture management, workload protection, cloud network security, and CNAPP-style visibility. It answers 'what is misconfigured or exposed in my cloud?' and 'what is running in my workloads?'
  • Harmony SASE: cloud-delivered secure access. It combines identity-based access to private applications (ZTNA), secure web gateway, CASB, DLP, and firewall-as-a-service capabilities. It is not a data-center firewall replacement.
  • Harmony workspace: endpoint protection and EDR, email and collaboration security, mobile security, and browsing protection. It secures the user's device and channels.
  • Identity is the control plane: SASE policy is built around user and device identity, not only IP addresses.
  • SSE vs SASE: SSE focuses on security services (SWG, CASB, ZTNA); SASE adds network convergence. Check Point Harmony SASE is positioned as a SASE offering.

Worked example

A company has 500 employees using Microsoft 365, a private ERP, contractors on personal laptops, and an AWS account. Correct design: Harmony SASE for ZTNA to ERP, SWG for web traffic, CASB for SaaS visibility, and DLP for sensitive data; Harmony Endpoint on managed laptops; CloudGuard for AWS posture and workload protection. Contractors get identity-based SASE access with device checks, not a flat VPN.

Traps

  • Treating SASE as a perimeter firewall for the data center.
  • Using CloudGuard for endpoint malware; that is Harmony workspace.
  • Assuming Harmony Browse is full endpoint protection; it is a browsing control.
  • Forgetting identity and device posture in SASE policy.
  • Confusing CSPM findings with workload runtime protection; both are CloudGuard but different jobs.