Cloud-Delivered Security Services
Domain 2: Cloud-Delivered Security Services
This domain tests the subscription services that add inspection beyond the firewall's local engines: WildFire, Threat Prevention, URL Filtering, DNS Security, SaaS Security, DLP, IoT Security, and AI Access Security. The exam focuses on what each service needs to work and where it sits in policy.
Core rules
- CDSS are licensed subscriptions. A valid license, an activated service, and a security profile attached to the allow rule are all required; none is automatic.
- WildFire sends supported files to a cloud sandbox, returns a verdict, and can generate signatures. Advanced WildFire adds evasive-analysis coverage. File blocking must forward the file types you want analyzed.
- DNS Security inspects DNS queries and can sinkhole malicious domains. It only sees DNS that traverses the firewall; DoH to an external resolver can bypass it.
- URL Filtering categorizes destinations and supports credential-phishing prevention. Full URL and path visibility for HTTPS needs decryption; without it, enforcement is largely domain/category based.
- SaaS Security (CASB) is API-based and requires onboarding the SaaS tenant; IoT Security discovers unmanaged devices and needs traffic visibility, often via SPAN or firewall integration.
Worked example
A customer has WildFire licensed but files are not analyzed. Check the allow rule: no WildFire analysis profile is attached, and the file-blocking profile is set to alert rather than forward. Reasoning: WildFire only receives files that policy explicitly submits. Fix: attach a WildFire profile and a file-blocking profile that forwards the target file types, confirm outbound access to the WildFire cloud, and verify the license is active.
Traps
A license alone does not inspect traffic. DNS Security does not decrypt HTTPS. URL Filtering without decryption cannot see full paths. SaaS Security is not inline blocking by default unless you configure API-based policy actions.