Cisco 300-745 SDSI key terms

Cisco's microsegmentation platform that discovers application dependencies, builds workload policy, and enforces least-privilege communication across data centers, clouds, and containers.

A deployment mode where a software agent installed on each workload captures process, package, and network flow data and enforces policy locally on the host.

A deployment mode where flow and inventory data are collected from network devices, hypervisors, or cloud APIs without installing software on the workload itself.

The process of analyzing observed traffic to build a graph of which workloads communicate, on which ports and protocols, so policy can be written around application boundaries.

The analysis phase in Secure Workload that converts raw flow and inventory data into candidate policy rules, labeling traffic as allowed, unknown, or potentially unwanted.

The staged progression of a segmentation policy from discovery through analysis, enforcement in simulation or monitor mode, and finally active enforcement.

A scoped logical container in Secure Workload that groups inventories, flows, and policies for a specific application or tenant, isolating analysis and enforcement boundaries.

A label-based filter that defines which workloads, users, or assets a policy rule or workspace applies to, using dimensions such as environment, location, or application.

A key-value attribute assigned to workloads or endpoints in Secure Workload; labels drive scope selection and policy rule matching instead of IP addresses.

The catalog of workloads, packages, processes, and network interfaces that Secure Workload builds from agent and agentless sources to support policy and compliance.

A Secure Workload component that receives and normalizes flow records from agents, network devices, or cloud connectors for dependency mapping and policy analysis.

The host-resident component that applies Secure Workload policy rules to network traffic on a workload, allowing or denying connections according to the active policy.

The active application of microsegmentation policy so that only explicitly permitted flows are allowed between workloads, blocking lateral movement.

A set of Secure Workload nodes working together to provide scale and high availability for analysis, policy, and data storage functions.

The operational tasks of installing, configuring, upgrading, and monitoring Secure Workload cluster nodes, including health checks and node replacement.

The process of deploying Secure Workload nodes, configuring network settings, and running the initial setup that forms a working cluster.

The first-run configuration of a Secure Workload deployment, including administrative credentials, licensing, and base system settings before data collection begins.

A design in which redundant Secure Workload nodes or components continue service if one fails, preserving visibility and enforcement continuity.

The Secure Workload capability to search historical flow and process data to investigate incidents, verify policy behavior, and support compliance evidence.

The use of Secure Workload inventory and policy data to demonstrate that workloads meet required controls, such as software baselines or segmentation requirements.

Cisco's next-generation firewall software image, managed centrally, that provides access control, intrusion prevention, and VPN services on supported appliances and virtual platforms.

The centralized management console for Cisco Secure Firewall Threat Defense devices, used to configure policies, deploy changes, and monitor events.

An ordered set of rules on a Secure Firewall that determines whether traffic is allowed, blocked, or trusted, and which inspection or discovery action applies.

A policy evaluated before the access control policy that can fast-path or block traffic early, reducing load on later inspection stages.

The sequence in which firewall rules are evaluated; the first matching rule determines the action, so placement affects whether later rules are ever reached.

The translation of IP addresses and ports in packet headers as traffic crosses a firewall, enabling address conservation, hiding, and port forwarding.

A set of intrusion detection and prevention rules applied to traffic permitted by access control, determining which exploit signatures trigger alerts or drops.

The act of pushing configured policies from the management center to managed firewall devices so the running configuration matches the intended design.

Connecting Cisco Secure Firewall with other security and network systems, such as identity sources, SIEM, or Secure Workload, to enrich policy and event data.

The systematic diagnosis of firewall or Secure Workload problems using logs, packet captures, connection events, and health status to isolate the failing component.

An encapsulation that carries traffic between sites or devices; prefilter rules can treat tunneled traffic differently from clear-text flows.