Security+ 801 Countdown, T-20: SSE Replaces SASE as Secure Access Is Rebuilt

Secure access is the set of controls that stand between a person and the resource they need: the tunnel a remote worker’s traffic rides, the gateway that inspects an upload to a SaaS application, the broker that admits one identity to one private application, the separate path an administrator uses to reach a router whose production links are down, and the protocol that carries a file across an organizational boundary. Each channel has its own threat model: a VPN that places a laptop on the corporate network exposes everything that network routes to, and a file-transfer server on the internet is an application with its own vulnerabilities, however well its transport is encrypted.

In SY0-801, objective 3.2 expands its secure communication and access bullet: Security Service Edge (SSE) is new, and user management, user access with least privilege, end-to-end encrypted messaging, out-of-band management, and file transfer join VPN, remote access, and tunneling (CompTIA 2025). Questions in this area ask what protects the user session, the management plane, and data in motion, so each item below is treated as a mechanism: what it does, where it sits on the wire, and what it does and does not protect.

Security Service Edge

NIST SP 1800-35 (June 2025) describes Secure Access Service Edge (SASE) as “converged network and security as a service,” listing SD-WAN, secure web gateway (SWG), cloud access security broker (CASB), next-generation firewall, and zero trust network access (ZTNA) (NIST 2025). Security Service Edge (SSE) is that stack minus the networking: cloud-delivered services that inspect and authorize user traffic at a point of presence (PoP) near the user, wherever the user is. SD-WAN decides how sites reach each other and the cloud; SSE decides what a user may reach and inspects the traffic on the way, with no site required.

The services that make up SSE:

• SWG: URL category and malware filtering, with TLS inspection.
• CASB: SaaS visibility and control, by API for data at rest or inline for live sessions.
• ZTNA: per-application access to private apps through an outbound-only connector.
• Commonly DLP and firewall as a service on the same inline path.

Microsoft Learn calls SSE “a new network security category.” Its version pairs Entra Internet Access, an identity-based SWG, with Entra Private Access for ZTNA and Defender for Cloud Apps as the CASB, and lists “VPN replacement with an identity-centric ZTNA” as a feature (Microsoft 2026). In the NCCoE zero trust builds, two policy engines were SSE products (Lookout’s and Microsoft’s), neither with an SD-WAN half (NIST 2025). The architecture that policy enforces is covered at T-21.

VPN backhaul versus SSE

The clearest way to see what SSE changes is to trace one remote user’s traffic under each design.

Remote user needs: Microsoft 365, a public website, app at 198.51.100.15:8443

VPN, full tunnel
  laptop ==IPsec or TLS==> data-center concentrator
    -> proxy -> firewall -> DLP -> internet or SaaS   (hairpin)
    -> 198.51.100.0/24 and beyond                     (whatever routing and ACLs allow)

SSE
  laptop agent -> nearest SSE PoP
    SWG + inline CASB -> internet and SaaS            (TLS inspection, DLP at the PoP)
    ZTNA broker <== outbound-only connector in the data center
                    -> 198.51.100.15:8443 only        (no inbound firewall port)

Under the VPN, every packet from the laptop rides the tunnel to a concentrator in the data center, passes the proxy, firewall, and DLP stack there, and only then leaves for the internet or the SaaS provider; the reply doubles back the same way. That hairpin is why a concentrator saturates as traffic shifts to SaaS, and once the laptop is on the network, routing and ACLs decide what it can touch. Under SSE, the laptop agent sends traffic to the nearest PoP, where the SWG and inline CASB inspect it and apply DLP before it leaves for the internet. The private application is reached through a ZTNA broker at the PoP that talks to a connector inside the data center that only ever dials out, so no inbound firewall port is opened, and the user reaches 198.51.100.15:8443 and nothing else.

Tunnels, VPNs, and split tunnels

A tunnel is encapsulation, one protocol carried inside another, and encapsulation alone gives no confidentiality: GRE or VXLAN wraps packets without encrypting them. A VPN is a tunnel plus encryption and authentication (IPsec ESP, TLS or DTLS, WireGuard). A split tunnel sends only corporate prefixes to the concentrator, so internet traffic leaves locally; that relieves the concentrator but also removes inspection from the local breakout, and an SSE agent puts inspection back on it. The cryptographic protocols themselves are covered at T-34, and remote access as a threat vector is at T-31.

User management and least privilege

A secure channel is only as trustworthy as the accounts allowed through it. User management is the account life cycle behind the channel: joiner, mover, and leaver provisioning, SCIM sync from the identity provider into SSE or VPN policy, and revocation at termination. User access with least privilege means a ZTNA app segment per identity, not a VPN pool that routes to a whole /16; the difference is whether the policy decision happens per application or once at connection time. Identity management, including gMSAs and privilege creep, is covered at T-12.

Out-of-band management

Every network device and server has a management plane: the interfaces and services an administrator uses to configure and monitor it, as distinct from the production traffic it carries or serves. Out-of-band (OOB) management is administrative access to a device’s management plane over a path separate from production traffic. True OOB means BMC ports (Dell iDRAC, HPE iLO, IPMI) cabled to an isolated management network, or a serial console server with its own cellular uplink, so an admin can reach a router whose production links are down. iDRAC and iLO are the Dell and HPE names for a server’s baseboard management controller (BMC), and IPMI (Intelligent Platform Management Interface) is the protocol the CISA alert below describes.

A management VLAN or VRF is logical, in-band separation over the same hardware; it is weaker, because whatever takes down or compromises the production switches takes the management path with it. A jump server (bastion) is a hardened intermediary host that admins connect to first and hop from, often reached in-band. The sound design combines them: admins enter the OOB network only through a bastion or zero trust enforcement point with MFA, and every session is logged.

The management plane needs this care because its protocols assume a trusted network. CISA alert TA13-207A (July 26, 2013; revised October 7, 2016) notes that IPMI stores passwords in clear text, that cipher 0, often enabled by default, “allows authentication to be bypassed,” and that IPMI usually listens on UDP 623 (CISA 2013). Ten years later the exposure was still common enough for a federal directive: BOD 23-02 (June 13, 2023) names “out of band server management interfaces (such as iLo and iDRAC)” in scope and gives federal civilian agencies 14 days to remove an internet-exposed interface or put it behind a zero trust policy enforcement point, the “preferred action” (CISA 2023).

An audit of a management network looks like this (output illustrative, in the script’s documented format):

$ ssh -J admin@bastion.example.com admin@192.0.2.10

$ nmap -sU -p 623 --script ipmi-cipher-zero 192.0.2.21

PORT    STATE SERVICE
623/udp open  asf-rmcp
| ipmi-cipher-zero:
|   VULNERABLE:
|   IPMI 2.0 RAKP Cipher Zero Authentication Bypass
|     State: VULNERABLE
|     Risk factor: High

The first command uses SSH’s -J option to reach a host on the management network through the bastion. The second probes UDP 623 on a BMC with the ipmi-cipher-zero script; a VULNERABLE result means the authentication bypass CISA described is live on that interface, and the fix is to disable cipher 0 and make the interface reachable only from the management network.

File transfer

When I teach file transfer in ITN 260, the SFTP and FTPS swap is the error that persists longest. FTP is the original: RFC 959, a control connection on TCP 21, separate data connections, and credentials and data in cleartext. FTPS is FTP with TLS added to those connections. SFTP is not FTP at all; it is a file-transfer subsystem that runs inside an SSH connection. Managed file transfer (MFT) products wrap the workflow in a web application over HTTPS.

Protocol	Port	Defined by	Key fact
FTP	TCP 21	RFC 959	Credentials and data in cleartext
FTPS, explicit	TCP 21, then AUTH TLS	RFC 4217	PROT P encrypts data
FTPS, implicit	TCP 990, data 989	IANA registration	TLS from the first byte
SFTP	TCP 22	SSH subsystem	Not FTP; one port
HTTPS MFT	TCP 443	Vendor application	The web app is the target

RFC 4217 defines only explicit FTPS: the client sends AUTH TLS, the server answers 234, then PBSZ 0 and PROT P protect the data channel, while PROT C leaves it clear (Ford-Hutchinson 2005). It never mentions port 990; implicit FTPS, in which TLS starts from the first byte, is an IANA port registration (IANA n.d.). SFTP runs as a subsystem of SSH, whose server normally listens on 22 (Ylonen and Lonvick 2006); its IETF draft expired at revision 13 in 2006 and never became an RFC (Galbraith and Saarenmaa 2006). The operational difference shows up at the firewall: FTPS needs a passive data-port range, since a firewall cannot read encrypted PASV replies to learn which port to open, while SFTP uses one port. openssl s_client -starttls ftp -connect files.example.com:21 shows the explicit upgrade.

Secure transport does not secure the server. CVE-2023-34362 was a SQL injection zero-day in MOVEit Transfer, exploited from May 27, 2023 by CL0P, which planted the LEMURLOOT web shell as human2.aspx (CISA and FBI 2023). The transfers were encrypted; the application was the door. Patch, restrict, and monitor MFT servers as crown jewels.

End-to-end encrypted messaging

With end-to-end encryption (E2EE), only the endpoints hold message keys: the sending and receiving devices encrypt and decrypt, and every relay in between, including the messaging provider, carries ciphertext it cannot read. In Signal, X3DH or PQXDH key agreement sets up the session, and the Double Ratchet derives a new key for each message, giving forward secrecy (a key captured later does not expose earlier messages) and recovery after a key compromise (Signal n.d.). For groups, MLS (RFC 9420, July 2023) provides asynchronous group key establishment with forward secrecy and post-compromise security for groups of two to thousands (Barnes et al. 2023).

Transport encryption is different: TLS to a chat provider is hop by hop, so the provider decrypts and can scan, index, or hand over content. Provider-side encryption at rest stops disk theft, not the provider. The distinction is where the keys live.

E2EE also changes what an organization’s own controls can see. An SWG or inline CASB doing TLS inspection sees only ciphertext inside an E2EE app’s protocol, so network DLP cannot inspect message content. Retention, legal hold, and e-discovery must then come from managed endpoints, an archiving client, or a platform whose model fits the records obligation.

Diversity and failure modes

Two further items in objective 3.2 describe properties of the whole architecture rather than a single service. Diversity means different vendors or technologies at successive layers, e.g., an SSE gateway from one vendor and endpoint EDR from another, so one exploit, bad signature update, or outage cannot defeat every layer. Platform diversity as a resilience goal is covered at T-17.

A failure mode is what an inline control does when it stops working. Fail-open favors availability: an inline IPS in bypass, or a web filter that allows traffic when its cloud is unreachable. Fail-closed favors confidentiality and integrity: a firewall that drops everything, or an SSE agent that blocks internet access when it cannot reach its PoP. The choice is a business decision; placement is covered at T-8.

What you need to know for SY0-801

• SSE is SWG plus CASB plus ZTNA, often with DLP and firewall as a service; SASE is SSE plus SD-WAN, and SASE and SD-WAN are 701-era vocabulary that 801 no longer names.
• Remote users, SaaS, per-app access, inline DLP, and “without backhauling” point to SSE.
• SSE here means Security Service Edge only, not AWS S3 server-side encryption or Server-Sent Events.
• A VPN puts the device on the network; ZTNA brokers one named app through an outbound-only connector.
• A tunnel is encapsulation; a VPN is a tunnel plus encryption and authentication; a split tunnel sends only corporate prefixes through the concentrator.
• SFTP is an SSH subsystem on TCP 22 and is not FTP; FTPS is FTP plus TLS, explicit on 21 or implicit on 990.
• E2EE means neither the provider nor network DLP can read content; TLS to the provider means the provider can, and retention becomes a trade-off.
• True OOB management is a separate path that works when production is down; a management VLAN is in-band.
• Jump server is 701-era vocabulary; the design survives as the MFA-protected bastion through which admins enter the OOB network.
• CASB API mode and an IDS on a tap are sometimes called out-of-band; neither is OOB management.
• Fail-open favors availability; fail-closed favors confidentiality and integrity.

Check yourself

1. Remote staff use Microsoft 365 and two internal web apps. The VPN concentrator is saturated because all internet traffic hairpins through the data center, and security wants DLP on uploads to SaaS from home. Which solution best meets both needs?

• A. SD-WAN appliances at each home office.
• B. Security Service Edge with an SWG, inline CASB, and ZTNA.
• C. A split-tunnel VPN with no other changes.
• D. A jump server in the screened subnet.

Answer: B. SSE inspects internet and SaaS traffic at a nearby PoP and brokers the two private apps without backhauling. A split tunnel alone drops inspection of SaaS uploads.

2. Server admins must reach iDRAC interfaces even when the production network is down, and an audit found IPMI on UDP 623 reachable from user VLANs with cipher 0 enabled. Which design best addresses both findings?

• A. Move the BMCs to a management VLAN on the production switches.
• B. Cable the BMCs to a separate management network reached through an MFA bastion, and disable cipher 0.
• C. Publish the BMCs to the internet behind strong passwords.
• D. Place the BMCs behind a load balancer.

Answer: B. A physically separate management network is true out-of-band access and survives a production outage; disabling cipher 0 closes the authentication bypass CISA describes. A management VLAN shares the production hardware.

3. A firm must accept encrypted file drops from partners, and the firewall team will open exactly one inbound TCP port with no passive data range. Which protocol fits?

• A. FTP on TCP 21.
• B. Explicit FTPS using AUTH TLS on TCP 21.
• C. SFTP on TCP 22.
• D. Implicit FTPS on TCP 990.

Answer: C. SFTP runs inside one SSH connection on one port. Both FTPS modes open separate data connections, and plain FTP is cleartext.

This is T-20 of the Security+ 801 Countdown: one change from SY0-701 to SY0-801 every morning until the new exam launches on November 17, 2026. Tomorrow, T-19: Data Types, Classifications, and Deidentification. New here? Start with T-38: The Blueprint Was Reweighted and Trimmed to 27 Objectives.

References

Barnes, R., B. Beurdouche, R. Robert, J. Millican, E. Omara, and K. Cohn-Gordon. 2023. The Messaging Layer Security (MLS) Protocol. RFC 9420. Internet Engineering Task Force.

CISA (Cybersecurity and Infrastructure Security Agency). 2013. “Risks of Using the Intelligent Platform Management Interface (IPMI).” Alert TA13-207A. Revised October 7, 2016.

CISA (Cybersecurity and Infrastructure Security Agency). 2023. “BOD 23-02: Mitigating the Risk from Internet-Exposed Management Interfaces.” Binding Operational Directive 23-02.

CISA and FBI. 2023. “#StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability.” Cybersecurity Advisory AA23-158A.

CompTIA. 2023. CompTIA Security+ SY0-701 Certification Exam Objectives. Version 5.0.

CompTIA. 2025. CompTIA Security+ SY0-801 V8 Certification Exam Objectives. Document Version 2.0.

Ford-Hutchinson, P. 2005. Securing FTP with TLS. RFC 4217. Internet Engineering Task Force.

Galbraith, J., and O. Saarenmaa. 2006. “SSH File Transfer Protocol.” Internet-Draft draft-ietf-secsh-filexfer-13, expired. IETF Datatracker.

IANA (Internet Assigned Numbers Authority). n.d. “Service Name and Transport Protocol Port Number Registry.” Accessed October 12, 2026.

Microsoft. 2026. “What Is Global Secure Access?.” Microsoft Learn. Accessed October 12, 2026.

NIST (National Institute of Standards and Technology). 2025. Implementing a Zero Trust Architecture: High-Level Document. NIST SP 1800-35.

Signal. n.d. “Technical Documentation.” Accessed October 12, 2026.

Ylonen, T., and C. Lonvick. 2006. The Secure Shell (SSH) Transport Layer Protocol. RFC 4253. Internet Engineering Task Force.