I85PREP
⌘ K
Check Point CCCS study materials
Check Point CCCS study resources

Check Point CCCS: CloudGuard Posture Management and Compliance

Check Point CCCS · Work through your exam, one topic at a time.

All guide sections

CloudGuard Posture Management and Compliance

Domain 4 covers continuous configuration assessment: onboarding accounts, reading compliance results, applying exclusions correctly, and enabling remediation safely.

Onboarding and access

CloudGuard Posture Management reads cloud APIs. Onboarding creates a read-only trust relationship - a cross-account IAM role with an external ID in AWS, an app registration and service principal in Azure, a service account in GCP. Protection Mode is the separate decision to grant write access so that remediation actions can actually execute; without it, findings stay recommendations.

Rule sets and frameworks

  • Built-in frameworks include CIS Benchmarks for AWS, Azure and GCP, plus PCI DSS, HIPAA, SOC 2, NIST and ISO 27001 mappings.
  • A rule expresses a test plus, optionally, an automated remediation; rules are bundled into rule sets that you attach to accounts.
  • Exclusions suppress a finding for a defined scope (account, region, tag) while keeping the underlying check and its history intact - an auditable exception, not a fix.
  • Continuous assessment re-evaluates on configuration change; on-demand runs are for point-in-time evidence.

Worked example

An engineer makes an S3 bucket public. The CIS rule set attached to the account evaluates the bucket policy and flags the resource with its account, region and entity detail. If Protection Mode and a remediation action are configured, the platform can restore block-public-access settings automatically. If the bucket must stay public for a documented reason, the correct answer is an exclusion scoped narrowly - by bucket tag - with the exception recorded, not a broad account-level exclusion. Disabling the whole rule set would also hide every other bucket's findings.

Traps that cost marks

  • Granting write access on day one; onboard read-only, observe, then enable remediation.
  • Using exclusions to make a dashboard green. Exclusions change reporting, not configuration.
  • Confusing a high compliance score with security. Score reflects evaluated rules, not unmodelled risks.
  • Expecting Posture Management to inspect packets or block traffic; that is CloudGuard Network Security.
  • Forgetting that a newly created account or region is unprotected until it is added to the scope.