CAS-004 Security Architecture Practice Question
An organization is implementing a Secure Access Service Edge (SASE) architecture to support remote workers. Which key capability does SASE provide that traditional VPNs lack?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identity-based access with zero trust principles
SASE convergences network and security functions and includes identity-based access, allowing granular policy enforcement based on user identity, device posture, and context. Traditional VPNs typically provide network-layer access without identity-driven security policies. SD-WAN is a component of SASE, not a unique capability. Web filtering is available separately. DLP is also available separately.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Software-defined WAN (SD-WAN) functionality
Why it's wrong here
SD-WAN is often a component of SASE but is not a security capability; traditional VPNs can also incorporate SD-WAN.
- ✗
Network-layer encryption using IPsec
Why it's wrong here
Traditional VPNs also provide network-layer encryption; this is not unique to SASE.
- ✓
Identity-based access with zero trust principles
Why this is correct
SASE enforces access policies based on identity and context, aligning with zero trust, unlike traditional VPNs that grant broad network access.
- ✗
Web content filtering and DLP
Why it's wrong here
Web filtering and DLP can be added to traditional VPNs as separate solutions; SASE typically includes them, but they are not unique.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.