A CASB provides the application proxy and web application firewall to a large retailer. All access to the retailer cloud application must originate from the CASB-designated IP addresses. The CASB…

Adding IP addresses to an authorized pool would typically expand access, not cause a complete outage for all customers.

If only European datacenters were down, access would likely be disrupted primarily for European customers or those routed through affected regions, not 'all customers' globally.

Federation and SSO misconfiguration primarily affect user authentication and authorization, but an expired SSL/TLS certificate would prevent the initial secure connection establishment, affecting access even before authentication.

If the CASB's public-facing SSL/TLS certificate expires, browsers attempting to connect through the CASB will encounter certificate validation errors, leading to security warnings or blocked connections. This would effectively prevent all customers from accessing the application globally, as the CASB acts as an intermediary proxy for all traffic.