What does CASB stand for?
CASB stands for Cloud Access Security Broker. A cloud access security broker sits between users and cloud services to see which apps are used and to enforce policy, such as data loss prevention and access control, on that traffic.
A CASB sits between an organization's users and the cloud services they use and applies the organization's policies there. It shows which cloud applications are in use, including ones nobody approved, controls who can do what in them, inspects the data going in and out, and detects risky behaviour. It works inline as a proxy, through the cloud providers' APIs, or both.
CASB in practice: an example
Discovery shows forty staff uploading documents to a personal file-sharing service. The security team blocks uploads to that service, allows the approved one, and adds a rule that stops files labelled Confidential from being shared with external addresses in the approved one.
What CASB is confused with
CASB vs SASE: what is the difference?
A CASB is one security function. SASE is an architecture that delivers several of them, CASB included, together with networking from the cloud. What SASE stands for
CASB vs DLP: what is the difference?
DLP is often a feature inside a CASB, applied to cloud applications. What DLP stands for
Which exams cover CASB?
CASB is on the official CompTIA acronym list for one of the four exams covered here.
- CySA+ CS0-004: on the acronym list, not tied to one objective.
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. Management asks which unapproved cloud applications employees are using. Which capability answers that?
- CASB discovery of cloud usage
- A hardware security module
- RAID 5
- Port mirroring on one switch
Show the answer
A. CASB discovery of cloud usage. Finding unsanctioned cloud use, often called shadow IT, is a core CASB function.
2. A company wants to block downloads from its cloud storage to unmanaged personal devices while allowing them on company laptops. What enforces this?
- A CASB access policy
- A longer DHCP lease
- A UPS
- A cable tester
Show the answer
A. A CASB access policy. A CASB can apply conditions such as device state to actions inside a cloud application.
Sources: NIST glossary: cloud access security broker; Microsoft Learn: What is Microsoft Defender for Cloud Apps?. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.