API / Venafi Interview questions
What is the difference between a Certificate Manager SaaS zone and a TPP policy folder?
Zones and policy folders solve the same problem — grouping certificates under a shared policy — but they come from two different products with different structural models.
| SaaS zone | TPP policy folder |
| Flat-ish container tied to one CA/policy combination | Node in a nested, hierarchical folder tree |
| No parent/child inheritance chain | Sub-folders inherit and can override parent settings |
| Configured through the SaaS web UI or API | Configured through the TPP console or WebSDK API |
| Maps naturally to a team or application owning one CA relationship | Maps naturally to an org chart with many nested departments |
In practice, a zone is closer to a single labeled bucket, while a policy folder tree lets a large enterprise express something like "everything under Finance inherits stricter defaults than the company baseline, and Finance/Payments is stricter still" — a distinction that matters more as the number of teams and applications grows.
Which structure supports nested inheritance, where a sub-unit can override its parent's settings?
Which model maps more naturally to a large org chart with many nested departments?
More Related questions...
