ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

A Cloud Access Security Broker (CASB) can operate as a reverse or forward proxy between users and cloud applications, giving the security team discovery of shadow IT, granular visibility into SaaS activity, and inline data-centric controls such as DLP policy enforcement. Because the control point sits in the network path or uses API integration, the solution can protect users whether they are on the corporate network or working remotely, without requiring software on each endpoint.

A network-based DLP appliance monitors data in motion but cannot identify or control unsanctioned SaaS applications and typically has limited visibility once users leave the corporate network. URL filtering on a next-generation firewall can block known domains but lacks content inspection to enforce PII policies and provides no discovery of unknown SaaS services. An inline IPS focuses on signature-based threat prevention, not SaaS discovery or DLP, and therefore does not meet the stated requirements.