I85PREP
⌘ K
FCSS Public Cloud Security study materials
FCSS Public Cloud Security study resources

FCSS Public Cloud Security: Cloud-Native Protection and Posture Management (CNAPP)

FCSS Public Cloud Security · Work through your exam, one topic at a time.

All guide sections

Cloud-Native Protection and Posture Management (CNAPP)

Domain four tests CNAPP: cloud security posture management (CSPM), cloud workload protection (CWPP), cloud infrastructure entitlement management (CIEM), infrastructure-as-code scanning, vulnerability and image scanning, and attack-path prioritization. The exam expects you to know what each capability can and cannot do.

Core rules

  • CSPM evaluates configuration against benchmarks (CIS, PCI DSS, SOC 2, ISO 27001) and flags misconfigurations such as public buckets, open security groups, unencrypted volumes, and disabled logging. It is not inline traffic inspection.
  • CIEM analyzes effective permissions and unused access; least privilege requires knowing which identities can reach which resources and via what path.
  • CWPP covers servers, containers, Kubernetes, and images: vulnerability findings, malware/runtime detection, and sometimes blocking. Agentless scanning uses snapshots and APIs; agent-based gives runtime visibility.
  • Attack-path analysis correlates a public exposure, a permissive identity, and a vulnerable workload. The combination is more urgent than any single finding.
  • FortiCNAPP consumes cloud APIs and typically needs read-only roles with the right scope; least-privilege scanner roles are part of the design.

Worked example

An EC2 instance has a public IP, its security group allows 0.0.0.0/0 to port 22, its IAM role allows s3:*, and it runs a critical vulnerable package. A scanner lists four findings. The correct prioritization is the attack path: internet exposure plus admin-like S3 permission plus exploitable software. Remediate the security group first (remove public SSH), then scope the role, then patch. Closing only the CVE leaves the exposure and identity risk. The CNAPP should show the path, not just isolated severities.

Traps

  • Treating CSPM as a firewall or IPS.
  • Calling every vulnerability "critical" without exposure or reachability context.
  • Giving the scanner broad admin credentials and leaving them unrotated.
  • Assuming agentless scanning can block runtime behavior.
  • Ignoring IaC findings because the deployed environment looks clean.
  • Forgetting that Kubernetes posture includes RBAC, admission control, and network policy, not just image CVEs.