CCSP Cloud Application Security Practice Question
An organization is migrating a legacy application to the cloud and plans to use a cloud access security broker (CASB). Which of the following is the PRIMARY function of a CASB in securing cloud applications?
⚠ Common exam trap
ISC2 often tests the distinction between a CASB's primary role (policy enforcement and access control) and secondary capabilities (like encryption or DLP), leading candidates to mistake a supporting feature for the core function.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enforcing security policies across cloud applications and controlling access
The primary function of a CASB is to enforce security policies and control access across cloud applications, acting as an intermediary between users and cloud providers. It provides visibility into cloud usage, applies data loss prevention (DLP) rules, and enforces authentication and authorization policies, which directly addresses the need to secure a legacy application migrated to the cloud.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Performing vulnerability scans on cloud infrastructure
Why it's wrong here
Vulnerability scanning is separate from CASB functions.
- ✗
Encrypting data at rest in cloud storage
Why it's wrong here
Data-at-rest encryption is managed by cloud providers or customers, not CASB.
- ✗
Protecting against distributed denial-of-service (DDoS) attacks
Why it's wrong here
DDoS protection is usually provided by DDoS mitigation services, not CASB.
- ✓
Enforcing security policies across cloud applications and controlling access
Why this is correct
CASBs provide visibility, policy enforcement, and threat protection for cloud apps.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.