Answer:
When a Visual-force page should not enforce permissions or field-level security.
Step-by-step explanation:
Custom controllers contain or implement the data manipulation and logic used by the Visual-force page. They are the apex controller logic used when a Visual-force page should not enforce permissions or field-level security. It does not leverage the standard controller functionality.
The controller extension is used to extend the functionality of both the custom and the standard controller. Both custom controller and controller extension runs in system mode, the custom or standard controller uses the permission and edit other functionalities of the user mode when it is extended by the controller extension.