Enforcing a SaaS Usage Policy With a Cloud Access Security Broker
A company has had several malware incidents that have been traced back to users accessing personal SaaS applications on the internet from the company network. The company has a policy that states users can only access business-related cloud applications from within the company network. Which of the following technical solutions should be used to enforce the policy?
Community Votes
75% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The requirement is policy enforcement over which SaaS applications may be used, and a CASB is built for exactly that job. Authentication services prove who a user is but never decide which cloud applications are acceptable, which is why identity options cannot satisfy the policy.
To enforce the rule that staff may only reach business-related cloud applications from the corporate network, the company needs a cloud access security broker, which sees which SaaS applications are in use and applies the policy that allows or blocks them. A CASB supplies both the visibility into unsanctioned cloud use and the enforcement point that stops personal applications.
Choosing single sign-on with an identity provider because it sounds like control over cloud access. SSO consolidates authentication, but a user who authenticates successfully can still open any personal SaaS application, so it cannot enforce a usage policy.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
A cloud access security broker sits between users and cloud services and gives the organisation visibility into which SaaS applications are in use and by whom. With that visibility in place the CASB can enforce policy by permitting business-related applications and blocking unsanctioned personal ones, which is precisely what the audit finding calls for. Because the control operates on cloud application traffic rather than on the identity of the user, it directly addresses staff reaching personal SaaS applications from the corporate network.Why the Other Options Are Wrong
Implementing single sign-on with an identity provider centralises authentication, yet a user who authenticates successfully still reaches whatever cloud application they choose, so no application allow list is enforced. Configuring cloud security groups controls network-level access inside a provider's environment, such as which resources accept traffic, and does nothing to police which SaaS services staff consume. Installing a virtual private cloud endpoint creates private connectivity between a virtual private cloud and a service, which is a network plumbing control that does not inspect or restrict SaaS application usage.Community Comment Notes
Most voters and commenters converged on the CASB, with ha_ha explaining that it restricts access to authorised business applications and johnabayot adding that a CASB can block unsanctioned apps by integrating with endpoint protection. NetworkTester1235 captured the community heuristic in a short note that a CASB is the default answer for cloud application control questions. One commenter argued for the virtual private cloud endpoint on the grounds that a CASB does not control where users connect from, but the majority treated that as a misreading of what CASB policy enforcement covers.Official Reference
Exam Strategy
When a question describes a policy about which cloud applications may be used, the answer is almost always the CASB, because it is the only control that combines SaaS visibility with enforcement. Identity controls answer a different question, namely who the user is rather than which applications are acceptable.
Frequently Asked Questions
Why does single sign-on not enforce the policy that only business cloud applications may be used?
SSO consolidates how users authenticate, but once authenticated a user can still open any cloud application, so SSO provides no allow list of sanctioned SaaS services.
What does a CASB actually do to stop staff using personal SaaS applications?
It inspects cloud application traffic to discover which services are in use, then applies policy that permits sanctioned applications and blocks unsanctioned ones while reporting on both.