Click each card to expand. Five areas cover the full Domain 2 objective set.
1. Zero Trust Architecture & SASE
▾
Zero Trust Core Principles
- Verify explicitly — authenticate and authorize every request using all available data points (identity, location, device health, service).
- Use least privilege — limit user access with just-in-time and just-enough-access (JIT/JEA) policies.
- Assume breach — minimize blast radius, segment access, and verify end-to-end encryption.
- Identity is the new perimeter — every access request is authenticated regardless of network location.
- ZTNA — application-level access replacing VPN tunnels; users access specific apps, not the network.
- Deperimeterization — eliminating the trusted internal network assumption.
SASE Architecture
- SASE converges SD-WAN (network) with CASB, SWG, ZTNA, FWaaS (security) into a cloud-delivered service.
- SD-WAN — software-defined WAN, the network underlay in SASE architectures.
- SASE is about convergence — combining networking and security into one cloud-native platform.
💡
Study tip: SASE = SD-WAN + cloud-native security stack. The exam tests understanding that SASE is about convergence, not just a product name.
2. Cloud Security Architecture
▾
Shared Responsibility & Cloud Tools
- Shared responsibility model — provider secures "of the cloud," customer secures "in the cloud." Varies by IaaS/PaaS/SaaS.
- CASB — visibility and control over SaaS apps (shadow IT discovery, DLP, policy enforcement).
- CWPP — runtime security for VMs, containers, serverless workloads.
- CSPM — detects misconfigurations (open S3 buckets, overly permissive IAM).
- CNAPP = CASB + CWPP + CSPM converged into a single platform.
- Serverless security — function-level IAM, dependency scanning, event injection prevention.
💡
Study tip: Know the three acronyms — CASB (SaaS visibility), CWPP (workload runtime), CSPM (config drift). CNAPP combines all three.
3. Network Segmentation & Microsegmentation
▾
- Traditional segmentation — VLANs, DMZs, firewalls controlling north-south (perimeter) traffic.
- Microsegmentation — software-defined east-west controls between workloads within the same segment.
- East-west traffic — lateral (workload-to-workload); north-south traffic — perimeter (in/out).
- Lateral movement prevention — microsegmentation contains attackers even after initial entry.
💡
Study tip: Traditional segmentation handles north-south (perimeter). Microsegmentation handles east-west (lateral movement). Know which addresses which threat.
4. PKI & Enterprise Access Controls
▾
Access Control Models
- MAC — labels/clearances assigned by policy. Used in classified environments. Most restrictive.
- DAC — owner controls access. Standard Unix/Windows file permissions. Least restrictive.
- RBAC — permissions tied to roles. Scalable for large organizations. Most common.
- ABAC — policies evaluate multiple attributes (role + device health + time + location). Most granular.
💡
Study tip: MAC = policy/label (most restrictive), DAC = owner-driven (least restrictive), RBAC = role-driven (most common), ABAC = attribute-policy (most granular).
5. PAM & Identity Federation
▾
Privileged Access Management
- PAM — controls, monitors, and audits privileged access. JIT provisioning; JEA (just-enough-access). Privileged session recording.
Federation Standards
- SAML 2.0 — XML-based federated SSO. IdP authenticates, passes assertion to SP.
- OAuth 2.0 — authorization delegation framework; grants apps permission without sharing credentials.
- OIDC — authentication layer on top of OAuth 2.0, adds ID tokens for user identity.
💡
Study tip: SAML = enterprise SSO (authentication). OAuth = authorization delegation. OIDC = authentication on top of OAuth.
