PSE SASE flashcards
PSE SASE · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- ZTNA Connector
- An appliance or VM in the internal network that makes outbound-only tunnels to Prisma Access, publishing private applications to remote users without inbound firewall openings.
- ZTNA app publishing
- The process of defining an internal application by FQDN or IP in Prisma Access so users reach it through the proxy and Connector tunnel instead of a VPN.
- Connector high availability
- Deploying at least two Connectors per site so Prisma Access can load-balance and fail over; a single Connector is a single point of failure for that app.
- IdP group mapping
- SAML/OIDC authentication plus SCIM sync maps users to IdP groups; Prisma Access ZTNA policy matches source user and group to allow or deny app access.
- Split tunneling
- A GlobalProtect setting that sends only specified domains or routes through the Prisma Access tunnel while other traffic goes direct to the internet.
- Prisma Access explicit proxy
- A proxy mode where user traffic is redirected to Prisma Access rather than tunneled by GlobalProtect; ZTNA apps are reached through this proxy path.
- Prisma SD-WAN ION
- The branch device in Prisma SD-WAN that builds encrypted tunnels, classifies applications, and enforces centrally defined path-selection and QoS policy.
- Performance-based path selection
- A Prisma SD-WAN policy that steers an application across WAN links based on measured latency, jitter, and loss thresholds rather than static priority.
- Direct internet breakout
- Branch SaaS and internet traffic exits locally through Prisma Access instead of backhauling to a data center, reducing latency and WAN load.
- Application definition
- A Prisma SD-WAN object that classifies traffic by IP, port, domain, or SaaS signature; classification determines which path-selection policy applies to the flow.
- Branch HA pair
- Two ION devices at a site sharing a virtual IP so that WAN-side link or device failure fails over transparently to downstream switches and users.
- QoS shaping on ION
- Per-application bandwidth allocation and shaping on the ION; when links are oversubscribed, policy priority determines which applications keep bandwidth.
- Prisma Browser
- A Chromium-based enterprise browser that enforces zero-trust access and data controls at the browser layer, independent of the endpoint operating system.
- Browser isolation
- Rendering untrusted or unknown websites in a remote container so malicious content executes away from the endpoint and cannot reach local resources.
- Browser data controls
- Per-app policies enforced by Prisma Browser that restrict copy/paste, block uploads or downloads, prevent screenshots, and apply visible watermarks.
- Clientless ZTNA access
- Prisma Browser reaches private web apps without a GlobalProtect client, letting unmanaged or BYOD devices access internal apps under policy.
- Browser session identity
- Prisma Browser ties each session to the user's IdP identity, so access policy can match user group, device posture, and destination application.
- Browser logging pipeline
- Prisma Browser events are sent to the same Prisma Access and Cortex logging pipeline as firewall and ZTNA events, making them queryable together.
- API-mode CASB
- SaaS Security mode that uses OAuth scopes granted by the tenant admin to scan data at rest for exposed files and sensitive content, without inline blocking.
- Inline CASB
- SaaS inspection through a forward proxy or Prisma Access secure web gateway that can block uploads and enforce tenant controls in real time.
- SSPM
- SaaS security posture management checks app configurations against benchmarks such as MFA enforcement, admin role sprawl, and public-sharing defaults.
- Shadow IT discovery
- Identifying unsanctioned SaaS from traffic signatures, scoring each app by risk, and then sanctioning or blocking it through tenant policy.
- SaaS DLP remediation
- API-based SaaS Security can quarantine or remove public shares of files matching DLP patterns, but only after the scan rather than in flight.
- Tenant restriction control
- A SaaS Security inline policy that blocks uploads to personal or unsanctioned instances of an app while allowing the corporate tenant.
- Data pattern
- A DLP detection object, either predefined (credit card, SSN) or custom regex and keywords; predefined patterns may include validation such as the Luhn check.
- Data profile
- A DLP object combining one or more data patterns with a confidence or weight threshold; a match fires only when the combined score meets the threshold.
- DLP rule action
- The response attached to a DLP rule: allow, alert, block, or quarantine; the rule is bound to a security policy rule for firewall, SaaS, or browser traffic.
- Inline versus API DLP
- Inline DLP inspects traffic in flight on web, SaaS uploads, and email; API DLP scans data at rest in SaaS apps after the fact.
- File-based DLP inspection
- DLP content inspection of file types such as PDF and Office documents; encrypted or password-protected archives may not be inspectable and need explicit handling.
- DLP incident logging
- Matches are logged to Cortex Data Lake and Strata Cloud Manager and can be forwarded to a SIEM, with severity and notification configured per rule.
- Browser-layer DLP
- Prisma Browser enforces DLP on copy/paste, upload, and download inside the browser session, complementing API-based remediation in SaaS Security.
- DLP profile reuse
- The same data profile can be referenced by firewall, SaaS Security, and Prisma Browser rules, keeping detection consistent across inline and API channels.