An organization wants a cloud-delivered secure web gateway, CASB, zero trust network access and firewall as a service for its users, but it has just renewed its WAN contracts and will not change its branch networking. Which architecture term best describes what it is adopting?
Select an answer to reveal the explanation.
Short Explanation
Think of SASE as a meal deal — the burger and the fries. SSE is just the burger: the cloud security services without the WAN side. Since this company is keeping its WAN untouched, you're buying SSE; the trap is calling it full SASE.
Full Explanation
Security Service Edge is the security portion of the Secure Access Service Edge framework, delivered from the cloud. It typically includes a secure web gateway, cloud access security broker, zero trust network access and often firewall as a service and DLP, enforcing consistent policy for users wherever they connect. SSE does not include the WAN networking component, so an organization can adopt it while keeping its existing branch transport unchanged and sending traffic to the service through tunnels or endpoint clients. That matches this scenario exactly. Secure Access Service Edge converges WAN networking, typically SD-WAN, with those same security services; describing this project as SASE ignores the stated decision not to change branch networking. A single gateway appliance at headquarters is the traditional backhaul model, the opposite of a cloud-delivered edge, and does not provide the listed services as cloud services. Extended detection and response is a detection and response platform that correlates telemetry from multiple sources; it is not an access security architecture. Exam caveat: the blueprint spells the term Security Service Edge in objective 4.1 while naming the domain Secure Service Edge, and Cisco Secure Access is Cisco's SSE offering. Operational check: map each required capability to the SSE service that provides it and confirm branch traffic can reach the service over the existing WAN without redesign.