CCSE (CrowdStrike Certifications) key terms

A logical grouping of interfaces or subnets that share the same trust level and policy rules. Traffic between zones is inspected and controlled, while traffic within one zone is usually treated alike.

The security zone holding internal networks and users that the organization controls and generally protects. Policies typically allow more outbound traffic from it and restrict unsolicited inbound sessions.

The zone representing external, uncontrolled networks such as the internet. Traffic entering from it is untrusted by default and must match explicit rules before reaching internal resources.

A demilitarized zone: a segmented network for internet-facing services such as web or mail servers. It sits between untrusted and trusted networks so a compromised public host does not expose the internal LAN.

A firewall rule model where rules apply to traffic between named zones rather than individual interfaces. It simplifies administration because many interfaces can inherit one consistent posture.

The default action that drops any traffic not explicitly permitted by a rule. It enforces a deny-by-default posture and appears as the final rule in most firewall rulebases.

The sequence in which firewall rules are evaluated, usually top-down with first match winning. Misordering can shadow a deny rule or unintentionally permit traffic, so order is audited carefully.

A configuration flaw where a broad earlier rule matches traffic intended for a later, more specific rule, so the later rule never takes effect. It often silently weakens intended restrictions.

A firewall technique that tracks active connections in a session table and automatically allows return traffic for established sessions. It blocks unsolicited packets that do not belong to a known flow.

A filter that evaluates each packet independently against access control lists of addresses and ports, without remembering prior packets. It is fast but must explicitly permit both directions of a flow.

The in-memory record of active and recent connections a stateful device tracks, including addresses, ports, and state. Table exhaustion or stale entries can cause dropped or mishandled traffic.

A component that understands a specific protocol and inspects or rewrites its payload, such as opening dynamic data ports for FTP. It bridges the gap between port-based filtering and content awareness.

A firewall that combines traditional stateful filtering with application identification, user awareness, intrusion prevention, and threat inspection in one policy engine. Rules can target applications and users, not just ports.

The classification of network traffic by the actual application generating it, regardless of port or encryption. It lets policy allow or block specific applications rather than entire protocols or port ranges.

Examination of packet payloads beyond headers to detect malicious content, protocol anomalies, or application identity. It enables content-aware blocking but requires adequate throughput and careful tuning.

A group of threat-detection settings, such as antivirus, anti-spyware, vulnerability protection, and URL filtering, attached to a firewall rule. Traffic matching the rule is scanned according to the profile.

An inline sensor that inspects traffic for known exploit signatures and protocol anomalies and can drop malicious sessions. It differs from detection-only mode, which alerts without blocking.

A pattern or rule that identifies a known attack, exploit, or malicious file characteristic. Signatures are updated regularly, and stale signatures leave systems exposed to newer threats.

Settings that scan files transferred through the firewall for malware using signatures, heuristics, and reputation. Actions include alert, block, or reset, and scanning may be limited by protocol or file size.

A cloud-based malware analysis service that detonates suspicious files in sandboxes and generates signatures from observed behavior. It helps detect unknown or targeted malware that static signatures miss.

Running suspicious code in an isolated environment to observe its behavior safely. Verdicts and behavioral signatures produced there are shared back to enforcement points to block similar threats.

An attack exploiting a previously unknown vulnerability for which no patch or signature yet exists. Defenses rely on behavior analysis, sandboxing, and least privilege rather than known-signature matching.

The process of terminating encrypted sessions at the firewall, inspecting the plaintext, then re-encrypting toward the destination. Without it, most threat inspection cannot see inside HTTPS traffic.

Rules that decide which encrypted traffic is decrypted, bypassed, or blocked based on category, source, or certificate. It must exclude sensitive or legally protected traffic and pinned applications.

An application's practice of trusting only a specific certificate or public key, which breaks when a firewall re-signs the connection. Pinned traffic must usually be excluded from decryption.

An intermediary that receives client requests and fetches resources on their behalf, applying policy and caching. Explicit proxies require client configuration, while transparent proxies intercept traffic without it.

A proxy configuration where clients are deliberately pointed at the proxy, often via browser settings or a proxy auto-config file. It gives clear control but depends on correct client configuration.

Classifying and controlling web requests by site category, reputation, or custom lists. It reduces exposure to phishing, malware hosting, and policy-violating content and is commonly paired with decryption.

Granting only the access needed for a role or process to function, and nothing more. Applied to firewall rules and administrative roles, it limits blast radius when credentials or hosts are compromised.

Assigning permissions to roles rather than individuals, then mapping users to roles. It simplifies administration and supports separation of duties for firewall and security management tasks.

Dividing sensitive tasks among different people so no single person can both make and approve a critical change. In security management it prevents unilateral policy edits or silent audit tampering.

Requiring two or more independent evidence types, such as a password plus a token or push approval, to verify identity. It protects administrative access even when passwords are stolen or reused.

A controlled process for requesting, reviewing, approving, and documenting configuration changes. It reduces outages and unauthorized modifications and provides an audit trail for firewall policy edits.

A chronological record of administrative actions, policy changes, and security events. It supports investigation and compliance and must be protected from modification and retained for the required period.

A record of sessions or files flagged by security profiles, including threat name, severity, source, and action taken. Analysts use it to triage incidents and tune profiles that generate noise.

A standard protocol for sending log and event messages from devices to a central collector. Centralized logging preserves evidence, enables correlation, and supports alerting across many firewalls.

A summary record of network conversations, capturing addresses, ports, byte counts, and timestamps without full payloads. It supports traffic baselining, capacity planning, and anomaly detection.

A unidirectional or bidirectional stream of packets sharing identifying attributes such as addresses and ports. Firewalls and analyzers track flows rather than isolated packets to apply consistent decisions.

Dividing a data center or cloud network into fine-grained zones with per-workload policy, often enforced in the hypervisor. It stops lateral movement after one host is compromised, unlike coarse perimeter-only controls.

Network traffic between servers or workloads inside the same data center, as opposed to north-south traffic crossing the perimeter. It dominates modern environments and requires internal segmentation controls.

A firewall instance running as software in a hypervisor or cloud environment, enforcing policy for virtual networks and workloads. It can be deployed per host or per tenant and scales with virtualization.

A cloud construct that acts as a stateful virtual firewall for attached resources, allowing rules by address, port, or referenced group. Membership is assigned to instances rather than to network segments.

An isolated virtual network in a public cloud with its own address range, subnets, routing, and gateways. Security controls such as security groups and network ACLs are scoped within it.

A saved copy of device configuration used to restore service after failure or error. Backups should be versioned, stored securely offline, and tested, since they may contain sensitive keys and credentials.

A paired or clustered deployment where a standby device takes over if the active one fails. It preserves connectivity and policy enforcement but requires synchronized state and tested failover behavior.

The process of shifting traffic and control from a failed component to a redundant one. It may be automatic or manual, and untested failover often reveals split-brain or session-loss problems.

Curated information about known malicious addresses, domains, files, and tactics, used to block or prioritize threats. Feeds must be tuned to avoid false positives and kept current to stay useful.

An ordered set of permit or deny statements matched against packet fields such as addresses and ports. On firewalls it is often replaced by zone-based policy, but the matching logic is the same.