A cloud access security broker (CASB) administers the user access of a Software as a Service (SaaS) on behalf of the customer organization. When conducting an audit of the service, which of the…

Question

Options

• AThe CASB verifies the access request from a named customer contact before granting access
• BThe CASB logs the access request as a service record that is reviewed after granting access
• CThe CASB conducts periodic audits of access requests to ensure compliance with customer
• DThe CASB manages secure access to the federated directory service used by the SaaS

• A
  14% (6)
• B
  7% (3)
• C
  2% (1)
• D
  77% (34)

Explanation

Option D is correct because a CASB's primary security value lies in its authoritative control over the identity federation layer - the mechanism by which users are authenticated and authorized to access the SaaS. If the CASB does not securely manage the federated directory service (e.g., via SAML or LDAP), all other access controls rest on an insecure foundation, making it the most critical item for an auditor to verify.

Why the distractors fail:

• A describes a manual, procedural approval workflow - useful operationally, but not a foundational security control and doesn't scale.
• B describes a detective control (post-access logging) that occurs after access is granted, meaning it cannot prevent unauthorized access.
• C describes periodic audits, which are also retrospective and compensating in nature - they catch problems after they occur rather than securing access at the source.

Memory tip: Think of the federated directory as the master key vault. The auditor's first priority is confirming the CASB truly owns and secures the vault - because if that's compromised, every log, approval, and audit on top of it is meaningless.

No community discussion yet for this question.