ISC2 Certified Cloud Security Professional (CCSP) Practice Question

Your company uses a mix of managed laptops and unmanaged partner devices to access several sanctioned SaaS applications. Management wants to detect sensitive data already stored in the cloud, block the download of confidential files to unmanaged endpoints, and avoid installing new agents or VPNs on user devices. When selecting and deploying a cloud access security broker (CASB), which deployment combination best satisfies these requirements?

Rely solely on CASB log collection from SaaS audit APIs and security information and event management (SIEM) correlation.
Use a forward-proxy deployment so all traffic from both managed and unmanaged devices is routed through the CASB.
Implement only a reverse-proxy CASB to provide real-time controls without additional integrations.
Deploy the CASB in API mode for each SaaS service and add reverse-proxy inline enforcement for unmanaged devices.

Report Issue

Answer Description

An API-based (out-of-band) connection to each SaaS platform lets the CASB scan data already at rest in the cloud and apply DLP or encryption, satisfying the visibility requirement without installing anything on user devices. To enforce real-time controls-such as blocking downloads to unmanaged endpoints- a reverse-proxy (inline) mode is appropriate because it operates through application-specific redirects from the SaaS provider and therefore protects any browser without requiring local agents or full-tunnel VPNs. A forward-proxy relies on agents/PAC files on every device, so it does not meet the 'no-agent' constraint. Log collection alone gives only after-the-fact visibility and cannot block downloads. Deploying only a reverse-proxy would miss data already stored in the SaaS tenants. Therefore, combining API mode for data-at-rest inspection with reverse-proxy inline controls best meets all stated objectives.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.