FCSS SASE Architect flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Unified SASE definition

A single-vendor architecture combining SD-WAN networking with cloud-delivered security (SSE), ZTNA, and one management plane, so policy is authored once and enforced consistently at every edge.

Single-vendor vs dual-vendor SASE

Single-vendor SASE terminates networking and security in the same cloud edge. Dual-vendor SASE uses separate SSE and SD-WAN vendors joined by tunnels or API integration, adding interoperability risk.

Zero Trust pillars

NIST SP 800-207 defines identity, device, network, application/workload, and data pillars, supported by visibility/analytics and automation/orchestration. SASE implements the network and application pillars and feeds telemetry to the rest.

Policy follows the identity

In unified SASE, access decisions attach to user identity, group membership, and device posture rather than to IP address or network location, so the same rule applies on-premises, at a branch, or on mobile.

Policy propagation latency

The time between publishing a policy change and every cloud edge and connector enforcing it. It is a key unified SASE operational metric because inconsistent enforcement windows create security gaps.

Digital experience monitoring

End-to-end telemetry across client, tunnel, cloud PoP, and SaaS provider that localizes degradation to a specific hop, separating last-mile ISP faults from inspection or policy faults.

PoP proximity steering

Selecting the cloud point of presence by measured latency and health rather than geography. Backhauling branch traffic to a distant PoP adds latency and is a common unified SASE design error.

SASE definition

Gartner's convergence of SD-WAN with cloud-delivered security service edge: web filtering, CASB, ZTNA, and firewall as a service, enforced where the user and device are, not at a data center perimeter.

SSE components

Security Service Edge comprises Secure Web Gateway, Cloud Access Security Broker, Zero Trust Network Access, and Firewall as a Service, all delivered from a cloud edge and adoptable without SD-WAN.

ZTNA versus VPN

ZTNA grants per-application access gated by identity and device posture with no broad network reachability. VPN grants network-level reachability, enabling lateral movement after compromise and requiring an exposed concentrator.

Local internet breakout

Routing branch traffic directly to the internet or cloud security edge instead of backhauling to a data center, reducing latency to SaaS at the cost of moving inspection to the branch or PoP.

TLS inspection capacity planning

Sizing cloud edge throughput for concurrent inspected TLS sessions, since decryption and re-encryption dominate CPU. Exempt pinned or certificate-authenticated applications via bypass lists to avoid silent failures.

SASE SLA scope

Service level agreements must separately cover underlay path quality (latency, jitter, loss) and edge service availability and inspection throughput; one combined SLA obscures which domain failed.

App connector role

An outbound-only agent placed near a private application that brokers ZTNA connections through the cloud, removing inbound firewall ports and the exposed VPN concentrator from the attack surface.

Non-proxyable traffic

Protocols and clients that cannot use a web proxy, such as legacy thick clients or non-HTTP protocols, require connector-based access or explicit bypass before a SASE migration is considered complete.

SWG inspection order

Secure Web Gateway evaluates URL category and reputation, then threat inspection such as antivirus and sandboxing, then data loss prevention, before allowing traffic. Order determines whether blocked flows consume inspection capacity.

CASB inline versus API

Inline proxy CASB blocks sanctioned and unsanctioned SaaS activity in real time. API-based CASB scans data at rest for retroactive discovery and remediation. Mature programs combine both modes.

TLS break-and-inspect CA

The re-signing certificate authority a secure web gateway uses to decrypt and re-encrypt TLS. It must be trusted by endpoints, and pinned or client-certificate apps must be bypassed or they fail.

FWaaS at the PoP

Layer 3 through 7, identity-aware firewall policy enforced in the cloud edge, able to govern user-to-app and SaaS-to-SaaS flows that never traverse an on-premises firewall.

DLP classification methods

Exact data match and fingerprinting for structured records, machine-learning document classifiers for unstructured content, and OCR for scanned images. Accuracy of classification determines DLP effectiveness.

SSE PoP footprint

The geographic distribution of cloud edge locations serving a tenant. Footprint relative to user population drives latency, and thin coverage forces long-haul backhaul to reach inspection.

Reverse proxy CASB

A CASB deployment where SaaS traffic is steered through the cloud edge via DNS or proxy configuration, giving inline control without installing endpoint agents on every device.

SSE log export

Streaming of web, CASB, ZTNA, and firewall events to a SIEM. Coverage of all SSE services in one schema is required for correlation; partial export leaves blind spots in detection.

Secure SD-WAN definition

SD-WAN edges with integrated next-generation firewall, IPS, URL filtering, and malware inspection, so branch traffic is inspected at the breakout point rather than backhauled to a data center.

SLA-based path selection

Per-tunnel probes measure latency, jitter, and loss; policy steers flows to the path meeting thresholds, with failover or weighted load balancing when a path breaches its SLA.

Full mesh tunnel scaling

In a full-mesh SD-WAN every site tunnels to every other site, so tunnel count grows roughly as n(n-1)/2. Large fabrics usually move to partial mesh with regional hubs.

BFD failover

Bidirectional Forwarding Detection sends rapid liveness probes over each tunnel, letting the SD-WAN edge detect underlay failure in sub-second time and fail traffic to a standby path.

Application-aware routing

Classifying flows by application signature and steering each class onto the path that meets its SLA, so voice and video avoid congested links while bulk traffic uses cheaper transports.

SD-WAN segmentation

Isolating traffic into VRFs or zones on the SD-WAN overlay so policy intent matches the SSE and ZTNA layers. Mismatched segmentation across layers causes policy drift and leakage.

Branch HA design

Dual customer premises equipment with dual underlay transports (for example MPLS plus broadband or 5G) and a validated fail-to-standby time that satisfies the business recovery objective.

DIA and edge sizing

Direct internet access moves inspection to the branch edge, so edge throughput must be sized for breakout plus inter-site traffic rather than WAN capacity alone.

SD-WAN to SASE sequencing

Migrate in stages: enable direct internet access with cloud security for SaaS, move private apps to ZTNA connectors, then retire backhaul. Staging prevents a policy gap during cutover.