Microsoft Cybersecurity Architect (SC-100)Design a Zero Trust strategy and architectureEasy
A global conglomerate is designing a Zero Trust architecture for its diverse business units, which operate across various cloud providers and on-premises infrastructure. The security team needs to ensure consistent security policy enforcement, threat protection, and visibility across all these environments for SaaS applications. Which of the following solutions is best suited to address these requirements?
- ACloud Access Security Broker (CASB)
- BAzure Active Directory B2B Collaboration
- CPrivileged Access Workstations (PAWs)
- DMicrosoft Defender for Cloud
Show answer & explanationAnswer & explanation
Correct answer: A. Cloud Access Security Broker (CASB)
A Cloud Access Security Broker (CASB) provides visibility, compliance, data security, and threat protection for cloud applications, making it ideal for enforcing consistent security policies across diverse cloud and SaaS environments in a Zero Trust model.
Why the other options are wrong
- B. Azure AD B2B is primarily for managing external user access to applications, not for comprehensive SaaS security policy enforcement across multiple clouds.
- C. PAWs are hardened endpoints for privileged users, not a solution for securing SaaS applications across a global, multi-cloud environment.
- D. Microsoft Defender for Cloud is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection (CWP) solution, primarily focused on IaaS/PaaS resources within Azure and multi-cloud, not specifically for SaaS application security enforcement.
Cloud Access Security Broker (CASB)
A CASB is a security policy enforcement point placed between cloud service consumers and cloud service providers to combine and interject enterprise security policies as cloud resources are accessed.
- Provides visibility into cloud application usage.
- Enforces security policies for SaaS applications.
- Offers data loss prevention (DLP) and threat protection for cloud services.
Memory trick: CASB is the 'Cloud Access Security Bouncer' for your SaaS apps.