SASE
What this domain tests
SASE questions test how security and networking are delivered from a cloud service. You need to distinguish Prisma Access connectivity methods, explain traffic steering, and apply consistent security policy to mobile users, branches, and private applications.
Core rules
- SASE combines cloud-delivered firewall, secure web gateway, CASB, DLP, ZTNA, and SD-WAN. The exam expects you to choose the right on-ramp rather than treat every user the same.
- GlobalProtect connects mobile users to the nearest Prisma Access location. Remote networks use IPSec tunnels from branches. Service connections link Prisma Access to data centers or cloud VPCs for private applications. Explicit proxy is for traffic that cannot use an agent or tunnel.
- ZTNA Connector publishes individual private applications without exposing the whole network. Use it for contractors and least-privilege access.
- Policy remains PAN-OS-style: zones, App-ID, User-ID, decryption, and security profiles. Identity provider integration supplies user and group context.
Worked example
A branch has 50 employees who need Microsoft 365 and one internal payroll app in a data center. Contractors need only the payroll app. Design: a remote network IPSec tunnel sends branch internet and SaaS traffic to Prisma Access; a service connection reaches the data center for payroll; contractors use ZTNA Connector, not the branch tunnel. Reason: SaaS is inspected in the cloud, private traffic uses the dedicated service connection, and contractors get application-level access instead of network-level reach. Sending contractor traffic through the branch tunnel would grant broader access than required.
Traps that cost marks
Do not confuse a service connection with an internet on-ramp. Do not assume split tunneling is always wrong; it is a policy choice. Do not forget that private applications need routing or a connector. Do not treat SASE as a license to ignore identity, decryption, or profile attachment.