CAS-004 Security Architecture Practice Question
A security architect is designing a cloud security strategy for a company that uses multiple cloud providers. The architect needs a solution that provides visibility into cloud application usage, enforces security policies, and protects data. Which technology is most appropriate?
⚠ Common exam trap
CAS-005 often tests the overlap between CASB, CSPM, and CWPP; candidates must distinguish CASB's focus on application usage and data policy from CSPM's focus on configuration compliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Access Security Broker (CASB)
A Cloud Access Security Broker (CASB) sits between cloud consumers and cloud providers to provide visibility into cloud application usage, enforce security policies (e.g., DLP, access control), and protect data across multiple cloud services. It is specifically designed for multi-cloud visibility and policy enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Workload Protection Platform (CWPP)
Why it's wrong here
CWPP secures runtime workloads — containers, VMs, serverless — through vulnerability and threat detection, but gives no visibility into which cloud applications users access or policy over that usage. It is tempting because it covers multi-cloud estates. CWPP suits protecting compute instances, not governing application usage and data flows.
- ✓
Cloud Access Security Broker (CASB)
Why this is correct
A CASB sits between users and multiple cloud providers, delivering the required visibility into sanctioned and unsanctioned application usage, policy enforcement, and data protection such as DLP and encryption. This directly satisfies the multi-cloud visibility and policy constraint in the stem.
- ✗
Cloud Security Posture Management (CSPM)
Why it's wrong here
CSPM detects misconfigurations and compliance drift across cloud accounts; it does not broker user traffic to cloud applications or enforce data-protection policy inline. It is tempting because it spans multiple providers. CSPM suits hardening infrastructure configurations, whereas the stem requires controlling application usage and data in transit.
- ✗
Secure Access Service Edge (SASE)
Why it's wrong here
SASE converges networking and security at the edge, but its policy enforcement targets user and branch traffic, not the multi-cloud workload and configuration visibility the stem demands. It is tempting because SASE spans cloud-delivered security. SASE suits remote-workforce access to SaaS and internet destinations.
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.