I85PREP
⌘ K
FCSS SASE Architect study materials
FCSS SASE Architect study resources

FCSS SASE Architect practice questions

One question at a time. Build your FCSS SASE Architect understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Unified SASE

In a unified SASE architecture, which component is responsible for applying security policy to traffic that originates from a remote user's device before it ever reaches the internet or a private application?

  1. The identity provider that authenticates the user's credentials
  2. The data center core switch that aggregates private application traffic
  3. The branch SD-WAN edge that connects the site to the WAN
  4. The cloud-delivered security service edge that inspects user traffic Correct answer.

Explanation

In SASE, the security service edge is the cloud-delivered enforcement point that inspects and applies policy to traffic from users and branches. It converges capabilities such as secure web gateway, cloud access security broker, and zero trust network access. The identity provider authenticates but does not enforce traffic policy.

Question 2Unified SASE

Which two core capability sets are most commonly described as converging under the SASE security service edge?

  1. Secure web gateway and cloud access security broker Correct answer.
  2. DNS filtering and email gateway
  3. Load balancing and DDoS scrubbing
  4. WAN optimization and application delivery control

Explanation

The SSE portion of SASE converges secure web gateway and cloud access security broker functions, along with zero trust network access. These capabilities inspect web traffic, govern SaaS usage, and broker private application access. The other pairs are useful technologies but are not the defining SSE convergence.

Question 3Unified SASE

A security architect is designing a SASE deployment where branch traffic must be inspected in the cloud while still allowing direct local internet breakout. Which design principle does this best illustrate?

  1. Routing all SaaS traffic through the identity provider
  2. Terminating all branch tunnels at the headquarters firewall
  3. Enforcing policy at a cloud edge close to the user with local breakout Correct answer.
  4. Backhauling all branch traffic through a central data center security stack

Explanation

SASE moves enforcement to a cloud edge near the user, so branch traffic can break out locally and still be inspected. This avoids the latency and capacity costs of backhauling. It is the core reason organizations adopt SASE rather than traditional hub-and-spoke security.

Question 4Unified SASE

In zero trust network access, what replaces the traditional model of placing a user on the corporate network and granting broad access?

  1. A static firewall rule permitting the user's home subnet
  2. A shared VPN concentrator with a single flat internal subnet
  3. A site-to-site IPsec tunnel from each user laptop to headquarters
  4. A per-application, identity-aware broker that grants least-privilege access Correct answer.

Explanation

ZTNA brokers access to individual applications after verifying identity and device posture, granting least privilege. It avoids placing users on a flat corporate network. The other options describe network-centric access that grants broad reachability.

Question 5Unified SASE

Which statement best describes the role of SD-WAN within a SASE architecture?

  1. It provides the networking fabric that steers traffic to cloud security edges Correct answer.
  2. It authenticates users and issues SAML assertions
  3. It replaces the need for any cloud security inspection
  4. It stores and indexes security logs for compliance

Explanation

SD-WAN supplies the WAN networking layer, including policy-based path selection and connectivity to cloud security edges. SASE combines that networking with cloud-delivered security. SD-WAN itself does not authenticate users or replace inspection.

Question 6Unified SASE

An organization wants to inspect traffic from managed endpoints and unmanaged contractor devices without installing a client on the contractors' machines. Which SASE access method fits the contractors best?

  1. Site-to-site IPsec from the contractor's home router
  2. Static route injection into the corporate routing table
  3. Clientless browser-based proxy access Correct answer.
  4. Client-based endpoint agent with full tunnel

Explanation

Clientless browser-based proxy access lets unmanaged devices reach published applications through a browser without installing software. Client-based agents require installation and are suited to managed endpoints. Site-to-site tunnels and route injection are network approaches unsuitable for individual contractors.

Question 7Unified SASE

Which capability in a SASE platform primarily governs the use of sanctioned and unsanctioned SaaS applications, including granular controls such as blocking uploads to a specific app?

  1. Secure web gateway
  2. Zero trust network access
  3. Cloud access security broker Correct answer.
  4. Branch SD-WAN router

Explanation

A cloud access security broker provides visibility and control over SaaS usage, including API-based and inline controls such as blocking uploads to a specific application. A secure web gateway focuses on web traffic filtering and threat protection. ZTNA brokers private app access, and an SD-WAN router handles WAN connectivity.

Question 8Unified SASE

A SASE architecture uses a single policy engine that evaluates user identity, device posture, and application sensitivity when deciding access. Which term best describes this approach?

  1. Context-aware, identity-centric policy Correct answer.
  2. Static VLAN segmentation only
  3. Implicit trust based on network location
  4. Port-based access control lists

Explanation

SASE policy is context-aware and identity-centric, combining identity, device posture, and application context. This contrasts with implicit trust based on network location. Static VLANs and port-based ACLs are location- and port-based controls that lack identity context.

Question 9Unified SASE

An enterprise routes branch internet traffic to a nearby SASE point of presence, but users in a region report high latency to SaaS applications. Which factor most directly explains this outcome?

  1. The endpoint agent is logging too many events
  2. The identity provider is issuing tokens with a short lifetime
  3. The branch SD-WAN edge is using BGP for path selection
  4. The chosen point of presence is geographically distant from the SaaS hosting region Correct answer.

Explanation

In SASE, the point of presence becomes the inspection and egress point, so its proximity to both the user and the SaaS hosting region drives latency. A distant PoP adds round-trip delay to SaaS traffic. Token lifetime, routing protocol choice, and logging volume do not primarily cause this latency.

Question 10Unified SASE

A company wants to enforce data loss prevention on files uploaded to a sanctioned SaaS application using the SaaS provider's audit APIs rather than inline traffic inspection. Which SASE capability is being used?

  1. Client-based ZTNA connector
  2. Branch SD-WAN forward error correction
  3. API-based cloud access security broker Correct answer.
  4. Inline secure web gateway

Explanation

API-based CASB connects to the SaaS provider's APIs to scan stored content and enforce DLP without sitting inline in the traffic path. Inline secure web gateway inspects traffic in real time. ZTNA connectors broker private app access, and forward error correction is a WAN performance feature.

Question 11Unified SASE

A security team wants to reduce the attack surface by ensuring that users can reach only the specific private applications they are entitled to, with no ability to scan or reach other internal hosts. Which SASE component delivers this?

  1. A perimeter firewall allowing the VPN pool to all internal subnets
  2. A flat corporate VLAN shared by all remote users
  3. Full-tunnel VPN into the data center
  4. ZTNA application connectors that publish individual apps Correct answer.

Explanation

ZTNA publishes individual applications through connectors and grants access per application, so users cannot reach unrelated internal hosts. Full-tunnel VPN and a firewall rule allowing the VPN pool to all subnets grant broad lateral reachability. A flat VLAN similarly removes segmentation.

Question 12Unified SASE

An architect must ensure that traffic from a branch to the internet is inspected by the SASE cloud while traffic to a latency-sensitive on-premises application stays local. Which SD-WAN policy achieves this?

  1. Send all traffic to the SASE PoP regardless of destination
  2. Use application-aware routing to steer internet-bound traffic to the SASE PoP and keep local traffic on-premises Correct answer.
  3. Disable local internet breakout at the branch
  4. Send all traffic through the headquarters data center firewall

Explanation

Application-aware routing in SD-WAN can classify traffic and steer internet-bound flows to the SASE PoP while keeping local application traffic on the local path. This preserves inspection where needed and latency where it matters. Sending everything to the PoP or headquarters defeats the purpose, and disabling breakout forces backhaul.

Question 13Unified SASE

A user authenticates successfully, but the SASE policy still denies access to a sensitive application. Which additional context is the policy engine most likely evaluating?

  1. The user's device posture and compliance state Correct answer.
  2. The user's email signature
  3. The user's browser bookmarks
  4. The user's preferred language setting

Explanation

SASE policies commonly combine identity with device posture, such as patch level, disk encryption, or endpoint compliance, before granting access to sensitive applications. Language, email signature, and bookmarks are unrelated to access decisions. A valid login alone does not satisfy a zero trust policy.

Question 14Unified SASE

Which SASE design choice best supports a hybrid workforce where employees use both corporate-managed laptops and personal mobile devices to reach the same set of private applications?

  1. Publish applications through ZTNA with device-aware policy that distinguishes managed from unmanaged devices Correct answer.
  2. Allow personal devices onto the corporate LAN via a guest VLAN
  3. Require every device to join the corporate domain before access
  4. Issue a single shared VPN account for all personal devices

Explanation

ZTNA can publish the same applications while applying device-aware policy, granting different levels of access to managed versus unmanaged devices. This supports a hybrid workforce without forcing domain join or shared credentials. Shared accounts and guest VLANs do not provide per-device, per-application control.

Question 15Unified SASE

A SOC analyst notices that a SASE deployment blocks a legitimate business SaaS application because its category is classified as unsanctioned. Which action resolves this while preserving governance?

  1. Move the application to the block list permanently
  2. Disable the secure web gateway entirely
  3. Create a sanctioned-application exception with tailored controls for that app Correct answer.
  4. Remove all CASB policies for the tenant

Explanation

The appropriate fix is to sanction the application and apply tailored controls, such as allowing business use while restricting risky actions like uploads to personal accounts. Disabling the gateway or removing CASB policies removes governance entirely. Permanently blocking the app harms the business need.

Question 16Unified SASE

Which statement accurately distinguishes the security service edge from the networking portion of SASE?

  1. SSE and the networking portion are identical and interchangeable terms
  2. SSE provides the security capabilities, while the networking portion provides connectivity and traffic steering Correct answer.
  3. SSE provides WAN routing, while the networking portion provides inspection
  4. SSE provides identity storage, while the networking portion provides authentication

Explanation

SASE combines a networking component, such as SD-WAN, with the security service edge, which delivers security capabilities like SWG, CASB, and ZTNA. The networking portion provides connectivity and steering rather than inspection. The two are complementary, not identical.

Question 17Unified SASE

An organization wants to apply consistent security policy to both branch office traffic and roaming user traffic. Which SASE characteristic enables this consistency?

  1. Distinct VPN concentrators for each region
  2. Per-user manual firewall configuration
  3. A common cloud-delivered policy engine applied across all edges Correct answer.
  4. Separate on-premises appliances per branch with independent rule sets

Explanation

A central cloud-delivered policy engine lets the same rules apply regardless of whether traffic comes from a branch or a roaming user. This consistency is a key SASE benefit. Separate appliances, manual per-user configuration, and regional concentrators fragment policy.

Question 18Unified SASE

A company is evaluating SASE PoP coverage and finds limited presence in a region where it has many users. Which risk is most directly associated with this gap?

  1. Increased latency and reduced inspection capacity for regional users Correct answer.
  2. Inability to use any SaaS applications in that region
  3. Failure of the identity provider to issue tokens
  4. Loss of the ability to authenticate users via SAML

Explanation

Limited PoP presence in a region increases the distance traffic travels for inspection, raising latency and potentially reducing capacity. SAML authentication and token issuance are identity provider functions unaffected by PoP coverage. SaaS access may still be possible but with degraded performance.

Question 19Unified SASE

Which SASE capability is most directly responsible for inspecting encrypted web traffic for malware when the organization performs TLS decryption at the cloud edge?

  1. SD-WAN application-aware routing
  2. Zero trust network access connector
  3. Cloud access security broker API scanning
  4. Secure web gateway with TLS inspection Correct answer.

Explanation

A secure web gateway performs inline inspection of web traffic, and with TLS inspection it can decrypt, inspect for malware, and re-encrypt. CASB API scanning works on stored SaaS content, ZTNA connectors broker private apps, and application-aware routing steers traffic.

Question 20Unified SASE

An architect proposes using ZTNA for a legacy application that relies on a thick client connecting to a fixed internal IP address. Which consideration is most important?

  1. ZTNA connectors generally publish applications via hostnames and may require client or DNS adjustments for fixed-IP thick clients Correct answer.
  2. ZTNA cannot support any thick client applications under any circumstances
  3. ZTNA only works for browser-based applications
  4. ZTNA requires the application to be migrated to SaaS first

Explanation

ZTNA connectors typically publish applications by hostname, so thick clients hard-coded to internal IP addresses may need DNS or client configuration changes. ZTNA can support thick clients with proper design; it does not require SaaS migration and is not limited to browsers.

Question 21Unified SASE

A global enterprise wants to minimize the number of times traffic crosses long-haul links while still applying consistent cloud security. Which combination best achieves this?

  1. Backhaul all traffic to a single central PoP for uniformity
  2. Disable cloud inspection and rely on endpoint antivirus only
  3. Route all traffic through the largest data center regardless of user location
  4. Use regional PoPs with synchronized policy and local breakout near users Correct answer.

Explanation

Regional PoPs with synchronized policy let traffic be inspected near the user, reducing long-haul traversal while keeping policy consistent. A single central PoP forces long-haul backhaul. Routing through one data center reintroduces the same problem, and disabling cloud inspection removes the security benefit.

Question 22Unified SASE

A security architect must justify why SASE reduces lateral movement risk compared with traditional VPN access. Which argument is most accurate?

  1. SASE replaces firewalls entirely, removing the need for segmentation
  2. SASE grants per-application access instead of placing users on a broadly reachable network segment Correct answer.
  3. SASE encrypts all traffic, which prevents lateral movement
  4. SASE assigns each user a static public IP that restricts movement

Explanation

Traditional VPN often places users on a network segment from which many internal hosts are reachable, enabling lateral movement after compromise. SASE with ZTNA grants access to specific applications, limiting reachability. Encryption alone, firewall removal, or static public IPs do not explain reduced lateral movement.

Question 23Unified SASE

An organization wants inline DLP for data moving from users to the web while also scanning data at rest in a sanctioned SaaS application. Which SASE design satisfies both requirements?

  1. Combine inline secure web gateway DLP with API-based CASB scanning Correct answer.
  2. Use only API-based CASB scanning for both requirements
  3. Use only ZTNA connectors for both requirements
  4. Use only SD-WAN application-aware routing for both requirements

Explanation

Inline DLP for web-bound data is delivered by the secure web gateway, while scanning data at rest in a sanctioned SaaS app uses API-based CASB. Combining both covers the two requirements. API-only, ZTNA-only, or routing-only designs each miss one requirement.

Question 24Unified SASE

A regulated customer requires that all traffic to a specific country's SaaS tenants be inspected within that country's borders. Which SASE design element is most critical?

  1. Enabling forward error correction on all SD-WAN links
  2. Selecting PoPs located within the required jurisdiction and steering relevant traffic to them Correct answer.
  3. Shortening SAML token lifetimes
  4. Increasing the number of identity provider replicas globally

Explanation

Data residency requirements are met by ensuring inspection occurs at PoPs within the required jurisdiction and steering the relevant traffic there. Identity replicas, forward error correction, and token lifetimes affect availability, reliability, and authentication but not the geographic location of inspection.

Question 25Unified SASE

A company observes that after adopting SASE, some SaaS applications break because the cloud edge re-signs TLS certificates. Which underlying mechanism explains this behavior?

  1. TLS inspection performing decryption and re-encryption at the cloud edge Correct answer.
  2. ZTNA connector load balancing across regions
  3. SD-WAN path selection choosing a different ISP
  4. Identity provider rotating signing keys

Explanation

TLS inspection decrypts traffic at the cloud edge and re-encrypts it with a certificate the client must trust, which can break applications that pin certificates or distrust the inspection CA. ZTNA load balancing, SD-WAN path selection, and identity key rotation do not cause certificate re-signing on the traffic path.

Question 26Unified SASE

Which two functional planes are combined to form a complete SASE architecture?

  1. Endpoint detection and response and security information and event management
  2. Networking convergence (SD-WAN) and security service edge (SSE) Correct answer.
  3. Identity provider federation and public key infrastructure
  4. Data center switching fabric and web application firewall

Explanation

SASE is defined by the convergence of wide-area networking capabilities with cloud-delivered security services. SD-WAN supplies the networking half while SSE supplies the security half, and the value comes from their integration under shared policy.

Question 27Unified SASE

Which security service is delivered by an SSE platform to protect users accessing the public internet?

  1. Network address translation
  2. Dynamic routing protocol
  3. Secure web gateway Correct answer.
  4. Load balancing

Explanation

The secure web gateway is the SSE component that filters user web traffic, enforcing URL categories, malware inspection, and acceptable-use policy. Routing, load balancing, and NAT are networking functions rather than security services.

Question 28Unified SASE

In a SASE model, which component enforces least-privilege access to private applications without exposing them to the public internet?

  1. Software-defined WAN
  2. Zero trust network access Correct answer.
  3. Domain name system filtering
  4. Cloud access security broker

Explanation

ZTNA brokers application-specific connections so that users reach only the resources they are authorized for, and the applications themselves remain unpublished. This application-level brokering is what distinguishes it from network-level access.

Question 29Unified SASE

Which statement describes the role of a cloud access security broker within SASE?

  1. It provides visibility and control over SaaS usage, including inline and API-based enforcement Correct answer.
  2. It issues and rotates certificates for internal web servers
  3. It terminates branch WAN tunnels and applies quality-of-service markings
  4. It aggregates NetFlow records for capacity planning

Explanation

A CASB discovers sanctioned and unsanctioned cloud services and applies policy both inline and through provider APIs. That dual enforcement model is what lets it govern data in SaaS tenants as well as in transit.

Question 30Unified SASE

What is the primary purpose of a firewall-as-a-service capability in a SASE offering?

  1. To deliver L3-L7 traffic inspection and policy enforcement from the cloud edge Correct answer.
  2. To replace endpoint antivirus agents on managed laptops
  3. To encrypt all data at rest in cloud storage buckets
  4. To provide physical rack-and-stack firewall appliances at each branch

Explanation

FWaaS moves the inspection and filtering role of a next-generation firewall into the cloud edge so policy follows the user. It inspects traffic at the application and transport layers rather than depending on branch hardware.

Question 31Unified SASE

Which identity concept allows a SASE policy engine to make decisions based on group membership sourced from a corporate directory?

  1. Port-based access control lists
  2. Identity federation with directory synchronization Correct answer.
  3. MAC address filtering
  4. Static IP address allowlisting

Explanation

Federating the identity provider and synchronizing directory groups gives the policy engine user and group context. Policies can then reference directory groups instead of brittle network attributes.

Question 32Unified SASE

Which traffic type is the primary focus of a SASE deployment for a roaming laptop user working from a coffee shop?

  1. Storage area network replication traffic
  2. Data center east-west traffic between hypervisor hosts
  3. Out-of-band management traffic to network switches
  4. Internet-bound and private-application traffic steered to the nearest cloud edge Correct answer.

Explanation

SASE follows the user, so roaming traffic to the internet and to private applications is redirected to the closest point of presence for inspection. Data center east-west, SAN, and management traffic remain inside the enterprise network.

Question 33Unified SASE

Which benefit most directly justifies replacing hub-and-spoke backhaul with local internet breakout under SASE policy?

  1. Guaranteed zero packet loss on all WAN links
  2. Reduced latency for cloud and SaaS access while retaining inspection Correct answer.
  3. Removal of the requirement for endpoint patching
  4. Elimination of the need for any user authentication

Explanation

Local breakout avoids tromboning traffic through a central data center, which lowers latency for SaaS and cloud destinations. Because the traffic is still steered through the SASE edge, inspection and policy are preserved.

Question 34Unified SASE

An architect must decide how to apply one consistent web policy to office users behind a branch SD-WAN device and to traveling users on mobile broadband. Which design achieves this with the least policy duplication?

  1. Apply policy only at the branch and rely on endpoint antivirus for travelers
  2. Steer both traffic sources to the same SASE edge and author policy once against identity and application attributes Correct answer.
  3. Maintain separate firewall rule sets on the branch device and on each laptop
  4. Use different vendors for branch and remote users and reconcile logs afterward

Explanation

A single cloud edge with identity-aware policy lets one rule set cover every traffic source regardless of location. Duplicating rules across platforms invites drift and inconsistent enforcement.

Question 35Unified SASE

A SASE tenant must inspect traffic destined for a private application hosted in a colocation facility while keeping the application invisible to internet scanning. Which combination is appropriate?

  1. An internet-facing load balancer with no authentication
  2. A site-to-site VPN terminating on the application server itself
  3. A ZTNA connector publishing the application outbound to the SASE edge Correct answer.
  4. A public DNS record pointing directly at the application's public IP

Explanation

A connector establishes an outbound-only connection to the SASE fabric, so no inbound ports are opened and the application is not discoverable by scanning. Users are authenticated and authorized at the edge before traffic is brokered to the connector.

Question 36Unified SASE

Users in a region complain that SASE-inspected SaaS sessions feel slow, while uninspected traffic is fast. Which factor should the architect evaluate first?

  1. The number of unused VLANs configured at the branch
  2. The color scheme of the SASE administrative console
  3. The firmware version of office printers
  4. The distance and peering quality between users and the assigned SASE point of presence Correct answer.

Explanation

When only inspected traffic degrades, the added path to the point of presence is the prime suspect. PoP proximity, peering, and backhaul to the inspection stack drive the added round-trip time.

Question 37Unified SASE

An organization wants to prevent uploads of files containing regulated identifiers to any unsanctioned cloud storage service. Which SASE control combination best meets this requirement?

  1. Endpoint disk encryption with no network policy
  2. DNS sinkholing of all storage domains without content inspection
  3. CASB API discovery plus inline data loss prevention on the web channel Correct answer.
  4. Static IP blocking of known storage providers

Explanation

Discovery identifies which storage services are in use, while inline DLP inspects the actual content of uploads and blocks regulated data. Blocking by name or address alone cannot evaluate content and breaks legitimate use.

Question 38Unified SASE

A security team wants malware delivered over HTTPS to be detected at the SASE edge. What must the platform be able to do for traffic it is authorized to inspect?

  1. Rely solely on IP reputation without decrypting
  2. Forward all encrypted sessions uninspected to endpoints
  3. Perform TLS decryption with a trusted re-signing certificate distributed to endpoints Correct answer.
  4. Disable HTTPS entirely for all users

Explanation

Inspecting encrypted payloads requires the edge to terminate and re-originate TLS, which only works if endpoints trust the re-signing CA. Without that trust, the platform can see metadata but not content.

Question 39Unified SASE

Which design consideration most affects whether a SASE deployment can satisfy a requirement that traffic to a specific country's SaaS tenants is inspected within that country?

  1. The geographic footprint of points of presence and their local inspection capacity Correct answer.
  2. The number of admin roles defined in the console
  3. The frequency of password rotation
  4. The choice of endpoint operating system version

Explanation

Data residency depends on where inspection actually occurs, so PoP placement and local processing capacity determine compliance. Console roles, endpoint versions, and password policy do not change where packets are inspected.

Question 40Unified SASE

A company wants device posture to influence access to a finance application through SASE. Which input is most appropriate for the policy engine to evaluate?

  1. Whether the endpoint's disk encryption and patch level meet the baseline Correct answer.
  2. The brand of the user's monitor
  3. The user's preferred language setting
  4. The time zone configured on the branch router

Explanation

Posture signals describe the security state of the device, such as encryption status, patch level, and running agents. Those signals let policy step up or deny access when a device falls below baseline.

Question 41Unified SASE

Which outcome best demonstrates that a SASE deployment has reduced lateral movement risk compared with traditional VPN concentrators?

  1. Access decisions are made once at login and never re-evaluated
  2. Users reach only the specific applications they are entitled to rather than the whole internal subnet Correct answer.
  3. All users share one broad internal VLAN after authentication
  4. The VPN concentrator is retained but renamed as a SASE gateway

Explanation

Application-level segmentation means a compromised credential grants access to a narrow set of resources instead of a routable internal network. Traditional VPN often places authenticated users onto a broad segment where they can scan peers.

Question 42Unified SASE

An architect is comparing SASE with a traditional stack of branch appliances and a central data center firewall. Which characteristic is unique to the SASE model?

  1. Support for routing between subnets
  2. Use of stateful packet inspection
  3. Security policy enforced close to the user from a globally distributed cloud edge Correct answer.
  4. Ability to log denied connections

Explanation

The distinguishing trait of SASE is cloud-delivered enforcement near the user rather than at fixed appliance locations. Stateful inspection, routing, and logging are capabilities that traditional stacks also provide.

Question 43Unified SASE

A branch uses SD-WAN with a local internet circuit and a private MPLS circuit. Which policy achieves inspection of internet-bound traffic while sending private data center traffic over MPLS?

  1. Send all traffic over MPLS and inspect it only at the data center
  2. Send all traffic to the SASE edge including data center prefixes
  3. Break out internet traffic to the SASE edge and steer data center prefixes across the MPLS path Correct answer.
  4. Disable the local internet circuit and rely on the MPLS only

Explanation

Application-aware steering lets the SD-WAN edge classify traffic and choose the appropriate path per destination. Internet flows gain cloud inspection while private prefixes keep their optimized private transport.

Question 44Unified SASE

Which statement best explains why SASE policy should be expressed in terms of identity, application, and posture rather than source IP address?

  1. Users and devices move, so IP-based rules become stale and cannot express who is doing what Correct answer.
  2. Identity attributes cannot be synchronized from directories
  3. IP addresses are never routable across the internet
  4. Application names change more often than IP addresses

Explanation

Roaming users and cloud applications make location-based identifiers unreliable and semantically poor. Identity- and application-aware policy remains meaningful regardless of where the user connects from.

Question 45Unified SASE

An organization wants to detect and block access to newly registered domains that are frequently used for phishing, without maintaining its own blocklists. Which SASE capability provides this?

  1. Static firewall rules based on port numbers
  2. Manual host-file entries pushed to each laptop
  3. Endpoint disk quotas
  4. Cloud-delivered DNS security with continuously updated threat intelligence Correct answer.

Explanation

Cloud DNS security applies provider-maintained reputation and category intelligence to every query, including newly registered domains. Manual host files and port-based rules cannot keep pace with rapidly changing infrastructure.

Question 46Unified SASE

An enterprise discovers that a sanctioned SaaS application breaks after SASE inspection begins, and the application uses certificate pinning. Which remediation is most appropriate?

  1. Exclude that application's traffic from TLS inspection while retaining metadata and CASB API controls Correct answer.
  2. Instruct users to ignore browser certificate warnings
  3. Remove the application from the sanctioned list
  4. Disable TLS inspection globally for all destinations

Explanation

Pinned clients reject re-signed certificates, so a targeted bypass preserves functionality while API-based CASB controls continue to govern the data. Global decryption bypass or user workarounds would weaken security broadly.

Question 47Unified SASE

A multinational requires that a compromised user session be terminated across all SASE services within seconds of a risk signal from the identity provider. Which design element is essential?

  1. Per-service local accounts managed separately in each console
  2. Continuous session evaluation that consumes identity risk signals and revokes access at the edge Correct answer.
  3. Long-lived session tokens with no re-evaluation
  4. Batch synchronization of identity data once per day

Explanation

Rapid revocation depends on the edge continuously consuming risk signals and re-evaluating active sessions. Long-lived tokens, siloed accounts, and daily batch syncs all leave a window where a compromised session stays valid.

Question 48Unified SASE

An architect must choose between routing all branch traffic through the SASE edge and using selective steering. Which analysis correctly identifies the main trade-off?

  1. Full steering maximizes inspection coverage but adds latency and cost for traffic that needs neither Correct answer.
  2. Selective steering eliminates all security risk by inspecting only known-bad destinations
  3. Full steering removes the need for identity integration
  4. Selective steering guarantees lower latency for every application

Explanation

Sending everything to the cloud edge broadens visibility but imposes path and processing overhead on traffic such as trusted backups or latency-sensitive voice. Selective steering must be justified with a clear coverage model to avoid blind spots.

Question 49Unified SASE

A regulated workload requires that decryption keys for inspected traffic never leave the customer's controlled environment, yet the provider must still perform inspection. Which approach best fits?

  1. Standard multi-tenant cloud inspection with provider-held keys
  2. Disabling inspection for the regulated workload entirely
  3. A hybrid edge model where inspection runs in a customer-controlled location using provider software Correct answer.
  4. Relying on endpoint agents to decrypt traffic before it leaves the device

Explanation

A hybrid or private edge keeps the inspection stack and key material within the customer's boundary while still benefiting from centrally managed policy. Provider-held keys in a shared environment conflict with the stated key-control requirement.

Question 50Unified SASE

An organization wants to prove that SASE enforcement is actually applied to contractor devices that are unmanaged. Which evidence best demonstrates effective enforcement?

  1. Edge logs showing the contractor sessions authenticated and matched policy decisions Correct answer.
  2. Router interface counters on the branch uplink
  3. Endpoint agent installation reports covering only managed laptops
  4. A spreadsheet listing contractor names

Explanation

Only edge-side records show that unmanaged sessions were actually brokered and evaluated by policy. Managed-agent reports and interface counters cannot attest to enforcement on devices outside management.