CAS-004 Security Architecture Practice Question
Which technology is used to discover and control cloud applications, enforce security policies, and provide visibility into cloud usage?
⚠ Common exam trap
CAS-005 often tests the CASB vs. CSPM vs. CWPP distinction — candidates pick CSPM for 'cloud visibility' or CWPP for 'cloud control' when the question specifically mentions application discovery and usage governance, which is CASB's role.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Access Security Broker (CASB)
A Cloud Access Security Broker (CASB) is specifically designed to discover cloud applications in use (shadow IT), enforce security policies, and provide visibility and governance over cloud service usage. It sits between users and cloud providers, applying policy via inline proxies or API integrations. This matches the question's three requirements — discovery, policy enforcement, and visibility — which are CASB's core functions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Workload Protection Platform (CWPP)
Why it's wrong here
CWPP secures running workloads — servers, containers and functions — by scanning for vulnerabilities and detecting runtime threats; it does not catalogue SaaS applications or govern their usage. It is tempting because workload protection also delivers cloud visibility, but that visibility covers compute instances, not sanctioned and unsanctioned app discovery, which is CASB's function.
- ✓
Cloud Access Security Broker (CASB)
Why this is correct
A CASB sits between users and cloud services, discovering shadow IT, enforcing policy and logging usage for visibility. It provides the control and monitoring layer the stem describes, unlike SWG or DLP, which address different traffic types.
- ✗
Cloud Security Posture Management (CSPM)
Why it's wrong here
CSPM scans cloud infrastructure for misconfigurations and compliance drift, but it neither discovers SaaS applications nor governs their usage. The stem's requirements — shadow-IT discovery, per-app policy enforcement and usage visibility — belong to CASB. CSPM would be the right pick for hardening IaaS configurations, such as flagging publicly exposed storage buckets.
- ✗
Secure Access Service Edge (SASE)
Why it's wrong here
SASE converges networking and security services such as SWG and ZTNA at the edge; it does not catalogue sanctioned and unsanctioned cloud apps with usage analytics. Cloud Access Security Broker performs that discovery and control, making SASE the wrong layer here.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.