FCSS SASE Architect study plan

Define unified SASE in your own words and contrast it with standalone SD-WAN, SSE, and CASB so you can explain where each control sits in the architecture.

Diagram the five planes of a unified SASE reference architecture: identity, network, security inspection, policy orchestration, and management/analytics, labeling at least two concrete components per plane.

Map each of the four exam domains to the architecture diagram and note which planes each domain owns, so later weeks build on a shared mental model.

List the core traffic paths (internet-bound, SaaS-bound, private-app, and site-to-site) and identify which enforcement point handles each.

Explain single-vendor convergence benefits and the main tradeoffs (feature maturity, migration risk, egress dependency) in a short written summary.

Describe how identity becomes the primary policy primitive: user/group attributes, device posture, and context signals feeding a single policy engine.

Trace a sample request end to end from endpoint through the closest enforcement point to the destination, naming every decision checkpoint.

Compare client-based, agentless, and clientless (browser-based) access models and state when each is appropriate.

Identify the logging and telemetry sources a unified architecture must correlate, and explain why a shared data lake matters for cross-domain correlation.

Draft three exam-style scenarios that require choosing between an SSE-first and SD-WAN-first deployment path, then justify each answer.

Define SSE's three pillars (secure web gateway, cloud access security broker, zero trust network access) and state the specific control each one enforces.

Explain zero trust principles as implemented in SSE: least privilege, per-request authorization, continuous verification, and no implicit network trust.

Compare TLS inspection approaches (forward proxy with certificate re-signing, selective bypass, and category-based decryption) and list the operational risks of each.

Describe CASB modes (API-based, inline proxy, and reverse proxy) and match each to a use case such as shadow IT discovery versus inline data protection.

Explain how ZTNA differs from traditional VPN in connection model, application exposure, and lateral movement risk.

Design a policy set that combines URL category, application control, file-type, data-loss-prevention, and tenant-restriction rules without conflicting precedence.

Explain tenant restrictions and their role in blocking unsanctioned cloud instances reached through a sanctioned provider.

Walk through how inline DLP inspects encrypted traffic and where a bypass policy would blind the control.

Describe how DNS-layer security, secure web gateway, and firewall-as-a-service complement rather than duplicate each other.

Diagnose three common SSE misconfigurations (over-broad bypass, missing identity provider attribute mapping, and shadow-IT blind spots) and prescribe a fix for each.

Explain secure SD-WAN building blocks: overlay tunnels, underlay selection, application-aware routing, and centralized policy.

Compare the main connectivity options (broadband, dedicated internet, MPLS, and 5G/LTE) on cost, SLA, and failover behavior for specific application profiles.

Describe how SD-WAN integrates with SSE: local internet breakout, tunnel-to-cloud inspection, and the tradeoff between backhauling and direct-to-internet inspection.

Explain quality-of-service, forward error correction, and packet duplication as remediation techniques and when each is justified.

Design a high-availability topology with dual underlay links, redundant edge devices, and defined failover thresholds.

Model routing and policy behavior for a multi-site deployment, including hub-and-spoke versus full-mesh and the inspection implications of each.

Explain how SD-WAN fabric handles dynamic path selection during brownout versus blackout conditions and what telemetry triggers each.

Describe zero-touch provisioning workflows and the security controls (device identity, certificate enrollment, signed configuration) that must accompany them.

Evaluate SD-WAN security features (local firewall, IPS, segmentation) against the case for steering traffic to a cloud security service instead.

Analyze three failure scenarios (underlay outage, tunnel flap, and asymmetric routing) and state the expected system response and detection signal.

Synthesize the four domains into a single migration roadmap from legacy hub-and-spoke to unified SASE, sequencing SD-WAN and SSE workstreams.

Justify phasing decisions with risk, dependency, and business-continuity reasoning rather than vendor preference.

Explain how to measure success at each phase using adoption, inspection coverage, latency, and incident metrics.

Design a governance model covering policy ownership, change control, and cross-team escalation between network and security teams.

Answer five timed mixed-domain scenario questions and log every wrong answer with the underlying concept gap.

Revisit every logged concept gap from weeks 1 through 7 and close each with a written explanation you can defend aloud.

Practice explaining architecture tradeoffs in concise verbal form, as you would to a stakeholder or in a scenario-based exam item.

Re-derive the domain weightings and confirm your weakest domain now receives proportionally more review time.

Complete a full timed mixed-domain practice set and review every missed item down to the root concept.

Build a one-page final review sheet of decision rules, tradeoff pairs, and commonly confused term pairs.