CCSA R82 flashcards
CCSA R82 · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- SIC initialization
- Secure Internal Communication uses certificates from the Internal CA; a gateway must have SIC initialized and its fingerprint verified before it can be trusted and receive policy.
- Management HA
- An Active and Standby management server pair; the Standby synchronizes the object database and logs, and promotion to Active is manual or automatic.
- Standalone vs distributed
- Standalone runs management and gateway on one machine; distributed separates management from enforcement, with gateways receiving compiled policy from the management server.
- ClusterXL modes
- ClusterXL supports High Availability, Load Sharing, and Multicast modes; the cluster object defines members and the Virtual IP used by clients.
- Publish vs Install Policy
- Publish commits session changes to the management database; Install Policy compiles and pushes the published rule base to selected gateways.
- Session locks
- SmartConsole uses per-administrator sessions; concurrent edits are controlled by locks so two administrators do not overwrite each other's changes.
- Management API session
- The Web API authenticates over HTTPS and returns a session ID and CSRF token; subsequent calls use these to read and modify objects.
- Administrator profiles
- Profiles such as Super User and Security Admin determine which blades and objects an administrator can view or edit in SmartConsole.
- First-match evaluation
- Rules are evaluated top-down and the first matching rule is enforced; rules below a matching rule never fire, creating shadowed rules.
- Implicit cleanup rule
- Traffic not matched by any explicit rule hits the implicit cleanup rule, which drops it; logging on cleanup can reveal missed traffic.
- Reject vs Drop
- Drop silently discards packets; Reject sends a TCP reset or ICMP unreachable so the client is informed of the refusal.
- Inline Layer
- A nested sub-policy called from a parent rule; the inline layer's rules evaluate before the parent rule's action is applied.
- Hide NAT
- Many internal addresses are translated to one public address using port translation; concurrent sessions are limited by available ports.
- Static NAT
- A one-to-one mapping of an internal address to a public address, preserving ports; used for inbound published services.
- NAT rule order
- NAT rules are matched top-down independently of security rules; the first matching NAT rule applies, so specific rules go above general ones.
- Proxy ARP
- When a static NAT public address is not on a directly connected subnet, the gateway answers ARP for it so traffic reaches the gateway.
- AD Query
- An identity source that reads domain controller security event logs to map users to IP addresses; it needs a read-only service account.
- Identity Collector
- An agent-based identity source that receives user-to-IP events directly from domain controllers and scales better than AD Query.
- Captive Portal
- A browser-based authentication method that authenticates users before granting access and creates a time-limited user-to-IP mapping.
- Access Role
- A reusable object grouping users, groups, and machines; it simplifies identity-based rules and can be referenced by multiple rules.
- Application signature
- A pattern used by Application Control to identify an application by traffic characteristics rather than by port; signatures update via the update service.
- Risk level
- Application categories carry risk levels (low, medium, high, critical); rules can block by risk rather than by individual application name.
- HTTPS Inspection need
- Encrypted traffic hides application and URL details; HTTPS Inspection is required for full classification and category-based blocking of SSL traffic.
- Limit action
- An Application Control action that restricts bandwidth for matched applications instead of blocking them, applied to matched sessions.
- URL category
- URL Filtering classifies destinations into categories such as Social Networking or Malware; rules allow or block by category or specific URL.
- HTTPS Inspection CA
- HTTPS Inspection re-signs traffic using a gateway CA certificate; clients must trust that CA or inspection breaks the connection.
- Content Security profile
- A profile combining Anti-Virus, Anti-Bot, and related protections; it is attached to Accept rules, and without it no content inspection occurs.
- Threat Extraction
- A protection that strips active content from downloaded files and delivers a sanitized version immediately while the original is analyzed.
- Threat Emulation
- A sandbox protection that detonates suspicious files in an isolated environment to detect malicious behavior before delivery.
- SmartEvent
- A log-analysis component that correlates logs into events using correlation units; events can trigger alerts and automated reactions.
- fw monitor
- A capture tool with inspection points i, I, o, and O showing traffic pre/post-NAT and pre/post-inspection; filters use -e expressions.
- cpinfo
- A diagnostic collector that gathers versions, licenses, and configuration summaries into a file for support analysis.