A security team must scan files already stored in the company's sanctioned SaaS collaboration suite for sensitive data, and also block uploads in real time when users browse to unsanctioned file-sharing sites. Which CASB deployment meets both requirements?
Select an answer to reveal the explanation.
Short Explanation
A CASB has two hands: one reaches into sanctioned apps through their APIs to check what's already sitting there, and the other stands in the traffic path to stop things as they happen. You need both hands here. The trap is assuming one mode covers both data at rest and live traffic to apps you don't control.
Full Explanation
Cloud access security brokers operate in complementary modes. API mode connects directly to a sanctioned application through the provider's management interfaces, so the CASB can scan content already stored there, apply DLP policies, review sharing settings and remediate, all without sitting in the user's traffic path. Proxy or inline mode, forward or reverse, places the CASB in the path of user sessions so it can inspect and block actions in real time, including uploads to applications the organization has never integrated. API mode alone cannot help with unsanctioned services: the company has no API connection or administrative relationship with those providers, and API scanning is generally near-real-time after the event rather than inline prevention. Proxy mode alone sees only traffic that passes through it after deployment; files that were uploaded earlier, or that reach the suite from unmanaged paths, are invisible to it. Log-based discovery analyses firewall and proxy logs to find which services are in use, which is valuable for shadow IT visibility, but logs do not contain file contents and cannot block anything. Exam caveat: many CASB products support all three methods, so the exam tests which method fits which requirement rather than product choice. Operational check: confirm that the API connector covers the suite's full tenant, that managed devices route web traffic through the proxy, and that a test upload of tagged data to an unsanctioned site is blocked.