An investigation at a regional office identifies sensitive files leaving a sanctioned SaaS platform outside...

Option D covers cloud-resident content even when the original transaction did not traverse the inline proxy. Zscaler’s out-of-band CASB uses SaaS-provider API integrations to scan data at rest with DLP engines, identify sensitive content, inspect sharing exposure, and support remediation of risky external shares. Zscaler’s Data at Rest Scanning DLP configuration guide places this capability under Out-of-Band CASB. Its CASB overview explains that API-based scanning discovers sensitive SaaS content and that collaboration management can revoke risky sharing. Browser Isolation affects future interactive sessions but does not inventory existing SaaS data. Endpoint posture confirms device compliance rather than classifying tenant content or permissions. DNS analysis addresses command channels and suspicious resolution, not whether sanctioned SaaS files contain regulated data or are shared externally.