ISC2 Certified Cloud Security Professional (CCSP) Practice Question

A reverse-proxy (also called an out-of-band or SAML inline proxy) CASB inserts itself in the SAML authentication flow. The identity provider rewrites the application URLs so that traffic from any device first passes through the CASB service in the cloud. For managed devices, the CASB can allow access and apply inline controls such as DLP inspection or encryption. For unmanaged devices, the CASB can block logins or enforce restrictive policies-all without requiring the user to be on a corporate network or install an agent/VPN.

A forward-proxy CASB needs agent, PAC, or VPN redirection, which the scenario forbids. An API-only CASB works out-of-band on data already stored in the SaaS and cannot provide real-time upload blocking. Log or SIEM‐based monitoring is purely detective and offers no inline enforcement. Therefore, the reverse-proxy architecture is the only option that meets both enforcement and deployment constraints.