3.1 Define and Explain Secure Access Service Edge (SASE) and Differentiate from Secure Service Edge (SSE) CYBERSECURITY-PRACTITIONER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company already has a robust, high-performance MPLS network that it does not want to replace. However, it needs to provide secure access to SaaS applications for remote users and enforce data loss prevention (DLP) policies on internet traffic. The security team wants a cloud-delivered solution that minimizes changes to the existing network infrastructure. Which solution should the company choose?

   • AA traditional VPN concentrator with client software
   • BAn on-premises next-generation firewall at each branch
   • CA Secure Service Edge (SSE) solution
   • DA full Secure Access Service Edge (SASE) solution
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company is evaluating a cloud security platform. The platform offers a secure web gateway, cloud access security broker, and zero-trust network access, but it does not offer any SD-WAN capabilities. The company's existing WAN is a reliable MPLS network. What is the most accurate description of this platform?

   • AIt is a next-generation firewall.
   • BIt is an SSE solution.
   • CIt is a software-defined WAN.
   • DIt is a SASE solution.
   Reveal Solution Discussion Select an answer first
4. 13foundation · medium

   What does Secure Service Edge (SSE) primarily provide?

   • ANetworking capabilities such as SD-WAN
   • BIdentity and access management only
   • CCloud-delivered security services only
   • DOn-premises firewall and routing
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A managed security service provider (MSSP) is evaluating two vendor proposals for a client. Vendor 1 offers a cloud-based security stack (SWG, CASB, ZTNA) that integrates with the client's existing MPLS network. Vendor 2 offers a cloud-based platform that includes the same security stack plus SD-WAN capabilities, but requires replacing the client's MPLS routers. The client's budget is tight, and the network team is resistant to changing the WAN. The MSSP's primary goal is to improve security posture without disrupting the existing network. Which proposal should the MSSP recommend?

   • AVendor 2, because a full SASE solution is always a better long-term investment.
   • BVendor 1, because it provides the required security functions without requiring WAN changes, aligning with the client's constraints.
   • CNeither vendor, because cloud-delivered security cannot integrate with an MPLS network.
   • DVendor 2, because SASE is the only architecture that can provide SWG, CASB, and ZTNA.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A regional bank is replacing its legacy MPLS WAN with a cloud-delivered architecture. The CISO wants to enforce consistent security policies for all internet-bound traffic from branch offices, but the network team insists on keeping an on-premises SD-WAN controller for path selection and WAN optimization. The bank wants to adopt a single vendor for both security and networking. Which approach best meets the stated requirements?

   • AImplement an SSE solution from a single vendor and keep the existing MPLS network for all branch connectivity.
   • BUse a cloud access security broker (CASB) with a separate SD-WAN product from a different vendor to avoid vendor lock-in.
   • CAdopt a full SASE architecture from a single vendor that converges cloud-delivered SD-WAN and cloud-delivered security services.
   • DDeploy a SASE solution that includes cloud-delivered security and integrate it with the existing on-premises SD-WAN controller.
   Reveal Solution Discussion Select an answer first