Examkin

Question

Difficulty: MediumCloud Architecture and Deployment Models

A healthcare provider is adopting a multi-tenant Software as a Service (SaaS) application to manage patient records across several remote clinics. The security architect must ensure that sensitive patient data transmitted to and from the SaaS application is monitored for policy violations, encrypted in transit, and protected against unauthorized data exfiltration without modifying the underlying cloud provider infrastructure. Which of the following solutions should the security team implement to meet these governance and control requirements?

  1. Cloud Access Security Broker (CASB)Answer
  2. B
    Virtual Private Network (VPN) Concentrator
  3. C
    Hypervisor-level virtual firewall
  4. D
    Host-based Intrusion Prevention System (HIPS) on the cloud provider's hosting servers

Answer

Cloud Access Security Broker (CASB)
A Cloud Access Security Broker (CASB) is specifically designed to sit between users and cloud service providers to extend on-premises security controls into cloud environments. In a SaaS model, customers cannot manage underlying cloud servers, hypervisors, or infrastructure controls. A CASB enables organizations to implement single sign-on, access control, data loss prevention (DLP), and threat detection for SaaS usage across clinics.

Step-by-Step Solution

1
Analyze the cloud service deployment model and customer control capabilities.
Identified that the deployment is Software as a Service (SaaS), where the cloud provider manages physical hardware, hypervisors, network infrastructure, and application hosting.
Determining the service model establishes the boundaries of the shared responsibility model.
2
Evaluate the functional security requirements specified in the scenario.
The requirements demand inline inspection, data loss prevention (DLP), policy enforcement, and monitoring for cloud-bound web/SaaS traffic.
Selecting the control requires matching desired security capabilities with available customer-managed security points.
3
Identify the security architecture technology designed for SaaS governance.
A Cloud Access Security Broker (CASB) operates inline or via API to enforce enterprise security policies on SaaS applications.
CASBs provide visibility, data security, threat protection, and compliance enforcement across cloud environments without requiring access to the provider's underlying infrastructure.

Key Concept

Cloud Access Security Broker (CASB) integration in SaaS governance
Rate this question

Topics

Cloud Architecture and Deployment Models

More questions from this topic