SkillTestPro | CCNP Security 300-740 SSCA Practice Test 22

CCNP Security 300-740 SSCA Practice Test 22 (Hard) - Configuring Cloud Access Security Broker (CASB)

CISCO CCNP Security Exam Logo

1 / 10

Which security control sits between an organization's users and cloud service providers to enforce visibility, compliance, data security, and threat protection policies for SaaS and cloud application usage?

An SNMP trap receiver, which collects device alerts rather than enforcing cloud application policy

An ARP cache, which maps IP to MAC addresses rather than enforcing cloud application policy

An NTP server, which synchronizes clocks rather than enforcing cloud application policy

A Cloud Access Security Broker (CASB)

A BGP route reflector, which propagates routing information rather than enforcing cloud application policy

A DHCP relay agent, which forwards address assignment requests rather than enforcing cloud application policy

2 / 10

Which CASB deployment mode inspects and enforces policy on traffic in real time as users interact with cloud applications, capable of blocking risky actions as they occur?

Inline (proxy-based) CASB deployment, whether forward proxy or reverse proxy

A deployment mode that exclusively inspects physical network cabling with no relationship to cloud application traffic

A deployment mode that only functions during a scheduled monthly maintenance window

API-based CASB deployment alone, which typically scans data already at rest rather than intercepting traffic in real time

Log-review-only deployment, which analyzes historical logs after the fact rather than enforcing policy in real time

A deployment mode that only generates a weekly summary report with no real-time enforcement capability

3 / 10

Which CASB capability helps an organization discover which cloud applications employees are actually using, including unsanctioned shadow IT applications not officially approved by the organization?

A feature that relies exclusively on the cloud application vendor's own self-reported customer list

A feature that analyzes the color scheme of each cloud application's login page

A feature that requires each employee to manually submit a signed paper form listing every cloud application they use, though this is not generally recommended

Cloud discovery / shadow IT discovery, typically analyzing network traffic logs or firewall/proxy logs to identify cloud application usage patterns

A feature that physically inspects every employee's personal mobile phone for installed applications

A feature that only detects cloud applications explicitly pre-approved by the IT department, ignoring all others

4 / 10

Which CASB API-based capability would help an organization detect and remediate a sensitive file that has already been shared publicly within a sanctioned cloud storage application, after the fact?

Physically unplugging the cloud storage application's data center servers to stop the sharing

API-based scanning of data at rest within the sanctioned application, identifying policy violations (such as overly permissive sharing settings) and triggering automated remediation actions

Relying exclusively on the file's original uploader to notice and manually fix the sharing setting with no automated detection, though this is not generally recommended, in most deployment scenarios

Deleting the entire cloud storage application account for every employee in the organization

Disabling internet access for the entire organization to prevent any further file sharing

Printing a physical notice and posting it in the office break room about the sharing violation

5 / 10

Which CASB policy enforcement action would be appropriate for a sanctioned cloud storage application when a user attempts to upload a file containing detected sensitive data to a folder shared externally?

Automatically disabling the sanctioned cloud storage application for the entire organization

Automatically granting the user additional administrative privileges in response to the detection

Blocking or quarantining the upload and prompting the user to adjust the sharing settings or confirm the action is authorized under policy

Allowing the upload to proceed immediately with no policy check or notification of any kind

Automatically deleting the user's entire cloud storage account without any review process

Automatically forwarding the file to an unrelated external distribution list to document the violation, which does not align with best practices

6 / 10

Which risk would most likely result from an organization having no cloud discovery capability and being unaware of significant shadow IT cloud application usage among employees?

Employees using shadow IT applications would automatically lose all other network access as an automatic consequence

Shadow IT applications would automatically register themselves with the IT department once a certain usage threshold is reached

Shadow IT usage would automatically be blocked by the organization's existing sanctioned applications with no additional tooling needed, in accordance with common design practices

All shadow IT applications are always inherently as secure as any officially sanctioned application by design

The organization's DNS infrastructure would automatically fail as a direct result of unmonitored shadow IT usage

Sensitive data could be flowing to unsanctioned, unvetted cloud applications with unknown security postures, entirely outside the organization's visibility and policy enforcement

7 / 10

Which combination of CASB capabilities would provide comprehensive cloud application governance for a large organization using multiple sanctioned SaaS platforms alongside significant shadow IT usage?

Applying CASB policy only to a single sanctioned application while ignoring all other sanctioned and shadow applications

Cloud discovery to identify sanctioned and shadow application usage, inline enforcement for real-time policy control, API-based scanning for data-at-rest violations in sanctioned apps, and threat protection against compromised cloud accounts

Inline enforcement alone with no discovery capability to identify what shadow IT applications actually exist

API-based scanning alone with no real-time inline enforcement for actions as they occur

Cloud discovery alone with no inline enforcement, API-based scanning, or threat protection capability at all, in accordance with common design practices, which is not the standard approach, which is inconsistent with expected behavior, under typical configuration conditions

Disabling threat protection entirely to reduce the volume of security alerts generated by the CASB

8 / 10

Which factor would most influence how an organization prioritizes which shadow IT applications discovered by its CASB should be formally sanctioned, blocked, or investigated further?

The color scheme configured for the discovered application's login page

The average outdoor temperature at the organization's headquarters

The volume of usage, the sensitivity of data being shared with that application, and the application's own security posture and compliance certifications

The specific brand of coffee served in the security operations center

The number of parking spaces available at the organization's headquarters, in a properly maintained environment, which is not the standard approach, though this is not generally recommended

The font used in the organization's internal newsletter

9 / 10

Which statement accurately describes how CASB complements SWG and DLP within a broader secure cloud access strategy rather than duplicating their function?

SWG alone already provides full cloud application discovery and data-at-rest scanning, making CASB entirely redundant, which does not align with best practices, in most deployment scenarios, which is inconsistent with expected behavior, which is inconsistent with expected behavior

CASB provides cloud-application-specific visibility, discovery, and granular in-app policy control (including data-at-rest scanning within sanctioned apps) that general-purpose SWG and channel-based DLP typically do not provide on their own

An organization must choose exactly one of CASB, SWG, or DLP and can never deploy all three together

CASB, SWG, and DLP are simply three different names for the exact same identical control with no distinction

CASB is only relevant to guest network traffic and has no relevance to sanctioned employee cloud application usage

DLP alone already provides full cloud application discovery and in-app policy control, making CASB entirely redundant

10 / 10

Which combination of practices would provide a mature, well-governed CASB deployment for a large organization with a growing portfolio of sanctioned and shadow cloud applications?

Blocking every discovered shadow IT application immediately with no investigation into its actual business use or risk level

Continuous cloud discovery to track new application adoption, risk-based sanctioning decisions informed by data sensitivity and application security posture, layered inline and API-based enforcement, and periodic review of policy effectiveness against actual usage patterns

Sanctioning every discovered application automatically with no risk-based review of any kind

Never reviewing CASB policy effectiveness after initial configuration, regardless of how cloud usage patterns evolve

Performing cloud discovery once at initial CASB deployment and never repeating it as new applications are adopted, in accordance with common design practices, which is not the standard approach, based on standard platform behavior, based on standard platform behavior, which is rarely the correct choice

Relying exclusively on inline enforcement with no API-based scanning of data already at rest in sanctioned applications

Your score is

The average score is 0%