Enforcing a SaaS Usage Policy With a Cloud Access Security Broker
Short answer
B A cloud access security broker enforces the policy by discovering which cloud applications are in use and blocking unsanctioned personal SaaS services.
Question
Key Takeaways
The requirement is policy enforcement over which SaaS applications may be used, and a CASB is built for exactly that job. Authentication services prove who a user is but never decide which cloud applications are acceptable, which is why identity options cannot satisfy the policy.
To enforce the rule that staff may only reach business-related cloud applications from the corporate network, the company needs a cloud access security broker, which sees which SaaS applications are in use and applies the policy that allows or blocks them. A CASB supplies both the visibility into unsanctioned cloud use and the enforcement point that stops personal applications.
Common mistake: Choosing single sign-on with an identity provider because it sounds like control over cloud access. SSO consolidates authentication, but a user who authenticates successfully can still open any personal SaaS application, so it cannot enforce a usage policy.
Expert Analysis
Why the Answer Is Correct
A cloud access security broker sits between users and cloud services and gives the organisation visibility into which SaaS applications are in use and by whom. With that visibility in place the CASB can enforce policy by permitting business-related applications and blocking unsanctioned personal ones, which is precisely what the audit finding calls for. Because the control operates on cloud application traffic rather than on the identity of the user, it directly addresses staff reaching personal SaaS applications from the corporate network.
Why the Other Options Are Wrong
Implementing single sign-on with an identity provider centralises authentication, yet a user who authenticates successfully still reaches whatever cloud application they choose, so no application allow list is enforced. Configuring cloud security groups controls network-level access inside a provider's environment, such as which resources accept traffic, and does nothing to police which SaaS services staff consume. Installing a virtual private cloud endpoint creates private connectivity between a virtual private cloud and a service, which is a network plumbing control that does not inspect or restrict SaaS application usage.
Community Comment Notes
Most voters and commenters converged on the CASB, with ha_ha explaining that it restricts access to authorised business applications and johnabayot adding that a CASB can block unsanctioned apps by integrating with endpoint protection. NetworkTester1235 captured the community heuristic in a short note that a CASB is the default answer for cloud application control questions. One commenter argued for the virtual private cloud endpoint on the grounds that a CASB does not control where users connect from, but the majority treated that as a misreading of what CASB policy enforcement covers.
Official Reference
These links open the official vendor documentation in a new tab.
Exam Strategy
When a question describes a policy about which cloud applications may be used, the answer is almost always the CASB, because it is the only control that combines SaaS visibility with enforcement. Identity controls answer a different question, namely who the user is rather than which applications are acceptable.
Frequently Asked Questions
Why does single sign-on not enforce the policy that only business cloud applications may be used?
What does a CASB actually do to stop staff using personal SaaS applications?
Community Votes
75% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 6 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 6
-
ha_ha 👍 6B. Leverage a cloud access security broker (CASB). A CASB can help monitor and enforce security policies for cloud applications, including restricting access to only authorized and business-related applications. It provides visibility into user activities and helps prevent unauthorized access to personal SaaS applications from the company network.
-
johnabayot 👍 4 Answered BB : Leverage a cloud access security broker. It can monitor and control the cloud apps that users access, and apply security policies to prevent unauthorize or risky activities. A CASB can also block unsactioned apps by integrating with Microsoft Defender for Endpoint.
-
[Removed] 👍 2 Answered DD. i don't want to confuse people so let me explain my thought process. a. emplementing a single sign on would not stop someone from connecting to a resource because they would just enter a password and user to login b. the question says cloud access security broker, with this one they're trying to confuse you CASB is could for managing cloud services however the question states that "users accessing PERSONAL SaaS applications. this means that the company cant apply permisions to the SaaS service because it's the users personal SaaS. right now I'm stuck in-between c and d.
-
salah112 👍 2 Answered BB. Leverage a cloud access security broker. To enforce the policy of restricting users to accessing only business-related cloud applications from within the company network, a Cloud Access Security Broker (CASB) should be leveraged. A CASB is a security solution that helps organizations monitor and control the use of cloud services, including Software as a Service (SaaS) applications.
-
LuckyAro 👍 2VDI (Virtual Desktop Interface) could solve this issue quite easily
Show 1 more comment
-
NetworkTester1235 👍 8When in doubt, it's CASB
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.