CAS-004 Security Architecture Practice Question
An organization uses a multi-cloud strategy with workloads on AWS, Azure, and GCP. They need a single tool to monitor and enforce security configurations across all cloud environments. Which cloud security solution is best suited for this requirement?
⚠ Common exam trap
CAS-005 often tests the CSPM vs. CWPP vs. CASB distinction — candidates pick CWPP or CASB because they 'secure the cloud,' but only CSPM continuously monitors and enforces configuration posture across multiple clouds.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Security Posture Management (CSPM)
CSPM is correct because it continuously monitors cloud configurations against security benchmarks (CIS, NIST, PCI) and detects misconfigurations across AWS, Azure, and GCP from a single pane of glass. It is purpose-built for multi-cloud posture management — identifying publicly exposed buckets, overly permissive IAM roles, and unencrypted storage. This directly matches the requirement to monitor and enforce security configurations across all three clouds.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Secure Access Service Edge (SASE)
Why it's wrong here
SASE converges networking and security at the edge — secure web gateways, ZTNA and SD-WAN — for user and branch traffic, not cloud workload posture. It cannot query AWS, Azure or GCP configuration APIs to detect misconfigured storage or IAM. CSPM tooling performs that multi-cloud assessment.
- ✗
Cloud Access Security Broker (CASB)
Why it's wrong here
A CASB mediates access to sanctioned SaaS and cloud services, enforcing data-loss and shadow-IT policy on user sessions. It does not continuously assess configuration baselines inside AWS, Azure and GCP workloads. CSPM is the discipline that scans those environments for misconfigurations.
- ✗
Cloud Workload Protection Platform (CWPP)
Why it's wrong here
A CWPP secures workloads — containers, VMs, serverless — on individual hosts, not cloud-wide configuration posture across providers. It is tempting because CWPPs do span multiple clouds, and would be correct for runtime protection and vulnerability scanning of those workloads.
- ✓
Cloud Security Posture Management (CSPM)
Why this is correct
CSPM continuously assesses configurations against benchmarks and compliance frameworks across AWS, Azure and GCP through native APIs, satisfying the single-tool, multi-cloud monitoring and enforcement constraint. It detects misconfigurations such as public storage buckets and overly permissive IAM policies, unlike single-cloud native tooling.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.