easyMultiple ChoiceObjective-mapped
350-701 Practice Question: Is configuring a cloud access security broker…
A security engineer is configuring a cloud access security broker (CASB) to protect a SaaS application used by employees. The primary concern is to prevent sensitive data from being uploaded to the application. Which deployment mode should the engineer choose?
⚠ Common exam trap
Cisco often tests the misconception that forward proxy mode is the best for all data protection scenarios, but the trap here is that API-based mode is specifically designed for deep integration with SaaS applications to prevent data uploads, while forward proxy mode is limited to inline traffic inspection and cannot block data already submitted via API calls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
API-based mode, which connects directly to the SaaS application's APIs to scan and block sensitive data.
API-based mode connects directly to the SaaS application's APIs, allowing the CASB to scan data at rest and in transit using the application's native APIs (e.g., REST or Graph APIs). This mode can block uploads by enforcing data loss prevention (DLP) policies directly within the SaaS application, without requiring traffic redirection or proxy configuration. It is the most effective deployment mode for preventing sensitive data from being uploaded, as it can inspect and block data at the point of storage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Forward proxy mode, which intercepts user traffic and inspects it before it reaches the SaaS application.
Why it's wrong here
Forward proxy is effective but requires client configuration and may not catch all API calls.
- ✓
API-based mode, which connects directly to the SaaS application's APIs to scan and block sensitive data.
Why this is correct
API mode allows data inspection at rest and can block uploads via API calls.
- ✗
Reverse proxy mode, which sits in front of the SaaS application and inspects incoming traffic.
Why it's wrong here
Reverse proxy is typically used to protect on-premises applications from external users.
- ✗
Web application firewall (WAF) mode, which filters HTTP traffic to the application.
Why it's wrong here
WAF protects against web exploits, not data loss prevention.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.