PSE SASE study plan

Explain how the Prisma Access ZTNA architecture separates the management plane, data plane, and identity plane, and how each plane affects traffic flow

Trace how a user request is evaluated by an identity provider, a policy enforcement point, and an app connector before it reaches a private application

Compare ZTNA and traditional VPN access models in terms of least privilege, lateral movement risk, and user experience

Configure a basic security policy rule that maps a user group to a private application and explain how the rule is evaluated

Design a segmentation scheme that isolates sensitive application groups from general workforce apps

Diagnose common connectivity failures such as connector health issues, DNS resolution errors, and policy mismatches

Describe how device posture checks and continuous trust evaluation change access decisions over time

Write a troubleshooting checklist that orders checks from identity to connector

Explain how SD-WAN separates the control plane from the data plane and why that matters for path selection

Compare policy types such as traffic distribution, path quality, and application-based routing

Describe how tunnels, probes, and SLA thresholds drive automatic failover between links

Identify which traffic should be steered to a secure access path versus sent directly to the internet

Design an integrated topology where SD-WAN branches reach private apps through the ZTNA layer

Explain how traffic is steered from a branch to a security service without breaking local internet breakout

Compare a centralized and a distributed breakout design on latency, cost, and operational complexity

Describe how to validate that failover between links does not bypass security inspection

Explain how a browser-based security service enforces policy on user traffic without endpoint agents

Describe the role of identity, tenant, and policy configuration in controlling web and SaaS access

Configure URL filtering and threat-prevention rules and predict which rule wins when two rules overlap

Distinguish what browser-layer controls can and cannot see compared with network-layer controls

Classify SaaS applications by risk using factors such as authentication, data residency, and API availability

Explain how inline and API-based SaaS security controls differ in coverage and latency

Design a policy that blocks unsanctioned apps while allowing sanctioned ones with conditional controls

Describe how tenant restrictions and data-sharing controls reduce data exposure in sanctioned apps

Explain the difference between data at rest, data in motion, and data in use, and which DLP enforcement point handles each

Build data patterns and classification rules that detect sensitive data while keeping false positives low

Design a DLP policy that applies different actions for internal, external, and unsanctioned destinations

Describe how incident triage and user coaching fit into a DLP program

Synthesize the five domains into a single scenario where a remote user, a branch office, and a SaaS app are each secured

Resolve scenario questions under time pressure and review every missed item to identify the underlying concept

Revisit the weakest two domains using the deliverables produced in earlier weeks

Confirm readiness by scoring consistently above target on timed practice sets