Forcepoint Cloud App Security: Inline vs API Enforcement
Forcepoint Cloud App Security is the CASB layer of Forcepoint ONE: it discovers which SaaS applications users actually touch, scores each app's risk, and applies access, data, and threat controls - inline as traffic flows and out-of-band through API connectors. The exam tests the difference between those two enforcement paths and the granular controls that make cloud use acceptable.
Core rules
- Shadow IT discovery identifies sanctioned and unsanctioned apps from proxy/web logs and inline traffic; each app maps to the cloud app catalog with a vendor-computed risk score built from security, compliance, legal, and business attributes.
- Inline (forward proxy) controls act in real time on the request: allow, block, coach, alert, or apply DLP to uploads and downloads. Reverse proxy routes the user session through Forcepoint, which is what enables per-session controls on unmanaged devices.
- API connectors reach into a sanctioned app out-of-band to scan stored data, classify it, and remediate retrospectively - near-real-time, not instantaneous.
- Granular controls: per-app actions, activity-level policy (upload, download, share, delete), in-app DLP, encryption, watermarking, read-only mode, and blocking copy/print/download on unmanaged devices.
- Tenant restrictions permit the corporate instance while blocking personal instances of the same app.
- OAuth/app governance flags third-party apps requesting risky scopes and supports token revocation.
Worked example
Staff open corporate Microsoft 365 from personal laptops, and Confidential files must not be downloaded there. Reasoning: inline proxy alone cannot see content inside an already-established SaaS session, so route the app through the reverse proxy with IdP authentication; the policy condition is device unmanaged AND file label Confidential; the action blocks download, allows viewing, and watermarks the session. Pair it with an API connector policy to find Confidential files already over-shared in SharePoint, and a tenant restriction so a personal OneDrive account cannot be used to move the same file out.
Traps
- Expecting API-based policy to block an action at the moment it happens.
- Blocking the entire app when tenant restriction was the narrower, correct control.
- Relying on inline discovery alone when off-network, non-proxied traffic never reaches the proxy.
- Assuming the catalog risk score reflects your data - it rates the app, not your exposure.
- Forgetting that read-only and download-block controls depend on the reverse proxy session, so unproxied mobile apps are unaffected.