I85PREP
⌘ K
FCSS SASE Architect study materials
FCSS SASE Architect study resources

FCSS SASE Architect: SSE: Security Service Edge Components and Enforcement

FCSS SASE Architect · Work through your exam, one topic at a time.

All guide sections

SSE: Security Service Edge Components and Enforcement

SSE is the security-focused half of SASE. This domain tests whether you can choose and combine SWG, CASB, ZTNA, FWaaS, DLP, remote browser isolation, sandboxing, and TLS inspection to protect SaaS and private application access. The key skill is matching the control to the traffic type and the enforcement point.

Core SSE rules

  • SWG inspects web traffic, enforces URL/category policy, and applies antivirus, IPS, and file filtering. TLS inspection is often required to see inside HTTPS.
  • CASB has two common modes: inline CASB enforces real-time policy for sanctioned and unsanctioned SaaS; API-based CASB provides visibility and data scanning for sanctioned SaaS but is not a real-time inline block.
  • ZTNA provides application-level access to private apps after identity and posture checks; it is not the same as a full-tunnel VPN.
  • DLP uses identity, data patterns, and destination context. It can apply to web uploads, SaaS API scans, and email depending on the service.
  • Agent-based enforcement on FortiClient can check device posture; agentless access relies on browser/proxy context and generally cannot enforce the same endpoint posture.

Worked example

A finance user opens sanctioned Microsoft 365 and tries to upload a file to an unsanctioned file-sharing site. Inline SWG/CASB blocks the unsanctioned upload in real time and logs the user identity. API CASB scans the sanctioned tenant for sensitive data and reports DLP incidents. A separate ZTNA policy lets the same user reach the finance ERP after posture check. TLS inspection is enabled for the relevant categories so the inline engine can see the upload.

Reasoning: inline CASB is used where real-time blocking is required; API CASB is used for sanctioned-tenant visibility; ZTNA protects the private app; DLP aligns data protection with identity. Mixing up inline and API modes is the classic SSE design error.

Traps that cost marks

  • Claiming API-mode CASB blocks an upload in real time.
  • Treating SSE as including SD-WAN or branch WAN routing.
  • Forgetting TLS inspection and then expecting HTTPS payload DLP to work.
  • Assuming agentless BYOD can enforce the same posture as FortiClient.
  • Describing ZTNA as another name for IPsec VPN.
  • Selecting DLP without considering identity and data destination.