Cloud Security: Posture, Workload Protection, and SaaS Visibility
What this domain tests
Cloud Security tests how Fortinet products secure public cloud and SaaS: cloud connectors, posture management, workload protection, identity and data risk, inline enforcement, and shared responsibility. Questions often ask whether a control is API-based, agent-based, or inline, and which product addresses SaaS versus cloud workloads.
Core rules and concepts
- FortiCNAPP cloud-native protection covers posture, workload, identity, data, and infrastructure-as-code risk; FortiCNP is the cloud-native protection component. FortiCASB focuses on SaaS visibility and control, not cloud workload runtime.
- Cloud onboarding commonly uses a read-only IAM role or service principal with an external ID. The connector inventories accounts, regions, and resources, then evaluates policies.
- API-based scanning is agentless and broad but cannot block every packet in real time. Agent-based workload protection adds runtime prevention and telemetry. Inline enforcement uses FortiGate VM, FortiWeb, or a native firewall insertion point.
- Shared responsibility means the provider secures the cloud foundation while the customer secures identity, configuration, data, and workloads. A provider control does not satisfy a customer misconfiguration finding.
- CSPM finds misconfigured storage, networks, and identities; CWPP protects workloads; CIEM analyzes permissions; DSPM finds sensitive data. IaC scanning catches issues before deployment.
Worked example
An AWS account is onboarded to a cloud-native protection platform. Reasoning: create an IAM role with a read-only policy and an external ID, deploy the provided template, and register the connector. The platform inventories the account and reports a public S3 bucket. The finding is posture, not runtime traffic, so remediation is to remove public access and update the IaC template. If the requirement is to block outbound traffic from a VPC, use an inline FortiGate VM rather than the read-only connector. If the requirement is to find sensitive files in the bucket, use DSPM or data-classification capability. The mark comes from matching the control type to the risk.
Traps that cost marks
- Confusing CASB SaaS controls with CNAPP cloud-workload and posture controls.
- Assuming an API connector can block all traffic inline.
- Treating provider-managed controls as covering customer misconfigurations.
- Forgetting that identity permissions and data exposure are separate findings from network exposure.