Which capability is provided by a CASB?

• A. Shadow IT detection
• B. Endpoint protection
• C. Firewall hardening
• D. Mailbox filtering

Answer: (A)

A CASB is all about visibility and governance for cloud services. It sits between users and cloud apps to see what SaaS tools are in use, who is using them, what data is moving, and how risky those activities are. That visibility makes it possible to detect shadow IT—employees using unsanctioned or unmanaged cloud apps that bypass traditional security controls. Once these apps are identified, the organization can apply policies, block risky services, enforce access controls, and implement data loss prevention or compliance measures to reduce risk.

Endpoints, on the other hand, are typically secured by endpoint protection platforms, which guard the device itself rather than cloud service usage. Firewall hardening is about tightening network perimeter configurations rather than monitoring cloud app adoption. Mailbox filtering focuses on securing email traffic, usually via email gateways, not cloud service discovery and governance.