CAS-004 Security Architecture Practice Question
A security architect is designing a cloud security strategy for a healthcare organization that uses a hybrid cloud environment with AWS and Azure. The organization must comply with HIPAA and needs to protect sensitive patient data. Which THREE cloud security controls should be prioritized? (Choose THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Workload Protection Platform (CWPP)
Cloud Access Security Broker (CASB) provides visibility and data protection across cloud services, CSPM identifies misconfigurations that could lead to breaches, and Cloud Workload Protection Platform (CWPP) secures workloads in public clouds. IAM and VPC are important but are more basic controls; they are not the primary focus for this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Virtual Private Cloud (VPC)
Why it's wrong here
VPC provides network isolation but is a basic building block, not a specialized security control for data protection.
- ✓
Cloud Workload Protection Platform (CWPP)
Why this is correct
CWPP secures workloads running in hybrid cloud, including vulnerability management and runtime protection.
- ✓
Cloud Access Security Broker (CASB)
Why this is correct
CASB enforces data protection policies and monitors user activity, essential for HIPAA compliance.
- ✗
Identity and Access Management (IAM)
Why it's wrong here
IAM is fundamental but not as specialized for healthcare data protection as CASB, CSPM, and CWPP.
- ✓
Cloud Security Posture Management (CSPM)
Why this is correct
CSPM detects and remediates misconfigurations that could expose PHI, a key compliance requirement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.