mediumMultiple SelectObjective-mapped
350-701 Practice Question: A security team is evaluating cloud security…
A security team is evaluating cloud security solutions. Which TWO of the following are core capabilities of a Cloud Access Security Broker (CASB)?
⚠ Common exam trap
Cisco often tests the distinction between CASB capabilities (focused on cloud application security, DLP, and Shadow IT) and other security domains like cloud workload protection (CWPP) or cloud infrastructure security, leading candidates to confuse VM or container security features with CASB functions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Shadow IT discovery and visibility
Shadow IT discovery and visibility is a core CASB capability. CASBs discover unsanctioned cloud applications (Shadow IT) by analyzing network traffic logs, API integrations, or proxy data to identify cloud services used without IT approval, providing visibility into usage, risk posture, and user activity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Provisioning and de-provisioning of cloud resources
Why it's wrong here
This is typically done by CSP or identity systems, not CASB.
- ✗
Container image scanning
Why it's wrong here
This is part of cloud workload protection platforms.
- ✓
Shadow IT discovery and visibility
Why this is correct
CASBs provide discovery of unauthorized cloud applications.
- ✗
Intrusion prevention for virtual machines
Why it's wrong here
This is a firewall or workload security feature, not CASB.
- ✓
Data loss prevention (DLP) for cloud applications
Why this is correct
DLP is a primary function of CASBs.
Go deeper
Related to this question
About these practice questions
One of 978 original 350-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.