SSE Engineer flashcards
SSE Engineer · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- SSE definition
- Cloud-delivered security service edge bundles secure web gateway, cloud access security broker, and zero trust network access to protect users and SaaS access regardless of location.
- Secure web gateway
- An inline proxy that inspects web traffic using URL filtering, TLS decryption, file scanning, and application control to block malicious or unauthorized web destinations.
- ZTNA vs VPN
- ZTNA authorizes per application with continuous context checks and outbound-only connectors, while VPN grants broad network-level access and places the user on the network.
- Inline vs API CASB
- Inline CASB inspects traffic in the data path in real time; API CASB polls the SaaS provider out of band for at-rest data and shadow IT discovery.
- TLS decryption purpose
- Decryption terminates and re-establishes TLS so the security stack can see URL paths, file types, and content that would otherwise be hidden by encryption.
- Shadow IT discovery
- Traffic signatures and risk scoring identify unsanctioned SaaS applications; sanctioning an app moves it from alerting to controlled inline policy enforcement.
- SP3 architecture
- Single-pass parallel processing performs application identification, user identification, content inspection, and threat detection in one pass over the traffic stream.
- Prisma Access deployment types
- Mobile Users (GlobalProtect), Remote Networks (branch IPsec), Service Connections (data center IPsec), and Explicit Proxy cover the main onboarding models.
- Service connection role
- An IPsec tunnel from the customer data center to Prisma Access that carries traffic to private applications and to the internet through cloud security.
- Remote network role
- An IPsec tunnel from a branch site to the nearest Prisma Access compute location, steering branch internet traffic through cloud inspection.
- Compute location selection
- Mobile users are steered to the nearest compute location by GlobalProtect portal settings; remote networks are pinned to a chosen region.
- Split tunneling effect
- Excluded destinations bypass the GlobalProtect tunnel and therefore bypass cloud inspection, reducing load but weakening security coverage.
- Cloud Identity Engine
- A cloud service that aggregates identity sources and group mappings so Prisma Access policies can match users and groups without on-premises agents.
- GlobalProtect portal vs gateway
- The portal authenticates users and delivers configuration; the gateway terminates the tunnel and enforces the selected security policy.
- IKEv2 phase 1 requirements
- Both peers must agree on encryption, integrity, and DH proposals, plus matching pre-shared key or certificates and matching local and peer identities.
- IPsec ports to allow
- UDP 500 for IKE, UDP 4500 for NAT traversal, and ESP protocol 50 must be permitted on the path or the tunnel will not establish.
- BGP over service connection
- eBGP peering across the tunnel exchanges prefixes and provides automatic failover, unlike static routes that do not reroute on failure.
- Route symmetry rule
- Any prefix advertised into the cloud is routed back through the tunnel, so overlapping or default advertisements can break return-path symmetry.
- Tunnel redundancy design
- Two tunnels to different compute locations with dead peer detection and path monitoring give failover when one path or location degrades.
- Explicit proxy deployment
- Endpoints are configured with proxy settings or a PAC file to send web traffic to Prisma Access without a GlobalProtect tunnel.
- First-match policy evaluation
- Security rules are evaluated top-down and the first matching rule wins; unmatched traffic hits the implicit deny at the bottom of the rulebase.
- App-ID behavior
- Application identification classifies traffic by protocol and behavior regardless of port, so rules should match applications rather than any service.
- Security profile set
- Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, WildFire Analysis, File Blocking, and DNS Security attach to allow rules for threat prevention.
- Decryption policy order
- Decryption policy is evaluated before security policy, so no-decrypt rules must be placed carefully to avoid bypassing content inspection.
- WildFire verdict flow
- Unknown files are submitted for cloud analysis; the verdict returns as benign, malicious, or grayware and can trigger forwarding or blocking.
- DNS Security function
- It blocks malicious domains at resolution time using threat intelligence and predictive analysis, stopping command-and-control before a connection is made.
- Zone protection profile
- Ingress zone defenses against flood, reconnaissance, and packet-based attacks are applied before security policy evaluation on that zone.
- Connectivity troubleshooting order
- Check license and deployment status, then IKE and tunnel state, then routing, then security policy, and finally NAT and decryption.
- IKE phase 2 failure cause
- Phase 2 failures typically indicate a traffic-selector or proxy-ID mismatch, or a proposal mismatch, rather than an authentication problem.
- Log correlation by session
- Traffic, Threat, URL Filtering, WildFire, and Decryption logs share a session ID, allowing one flow to be traced across log types.
- GlobalProtect failure checks
- Verify portal and gateway reachability, certificate validity, identity provider authentication response, and device posture check results.
- Asymmetric routing causes
- Overlapping advertised prefixes, split tunneling that sends traffic direct, and multiple service connections with differing metrics cause return-path asymmetry.