Which of the following describes a primary purpose of a CASB?

• A. To provide hardware-level firewall security.
• B. To manage user devices.
• C. To give visibility and control over cloud apps, including DLP, threat protection, and access controls.
• D. To replace identity providers.

Answer: (C)

A CASB exists to provide visibility into cloud service usage and to enforce security controls across cloud apps. It sits between users and cloud services, helping you see which cloud apps are in use (including shadow IT), assess risk, and apply policies that protect data and manage access. This includes data loss prevention to guard sensitive information in the cloud, threat protection to detect and block threats, and access controls to determine who can access which apps under what conditions. These capabilities collectively give organizations control over cloud usage and data security across SaaS, PaaS, and IaaS environments.

Hardware-level firewall security, while important, operates at the network perimeter and is not the primary function of a CASB. Managing user devices falls under device management or endpoint security, not CASB. Replacing identity providers isn’t correct because CASBs work with identity providers to enforce authentication and authorization; they don’t replace IAM components.