A CASB provides the application proxy and web application firewall to a large retailer. All access to the retailer cloud application must originate from the CASB-designated IP addresses. The CASB…

Adding IP addresses to the authorized pool expands the set of allowed source IPs, which would increase access capacity rather than restrict or break existing customer connections.

If only European datacenters were offline, customers connecting through CASB nodes in other regions would still reach the application, making this an unlikely cause of a complete global outage affecting all customers.

A federation or SSO misconfiguration would prevent authenticated access for federated identity users but would not block connections at the proxy layer before authentication is even initiated, so it would not cause a total outage.

Because the CASB acts as an application proxy through which every customer connection must pass, an expired SSL/TLS certificate on that proxy causes the TLS handshake to fail before any application traffic is exchanged. Browsers and client applications enforce strict certificate validity checks and will display an error and block the connection, producing a sudden, total outage affecting all customers simultaneously regardless of their location.