Cloud Posture Security: RQL policies, compliance and risk ordering
Domain 4 is cloud posture security: config policies evaluated over cloud APIs, compliance frameworks, and the prioritisation layer that turns thousands of findings into a work queue. The exam tests RQL reading, policy modes and remediation boundaries more than individual checks.
Policy mechanics
Config policies evaluate inventory collected through read-only cloud APIs and are written in RQL against a resource type and API call. Each policy carries a severity, a compliance mapping and a mode: audit (visible only) or remediate. Auto-remediation needs write permissions and exists for a subset of policies, so read-only onboarding blocks it by design.
Compliance and prioritisation
Policies map to standards such as CIS Benchmarks for AWS, Azure and GCP, PCI DSS, HIPAA, SOC 2, NIST and ISO 27001. Compliance score is per standard and per account, not one global number, and it measures policy coverage rather than real risk. Attack path analysis links a public bucket, an over-privileged role and a reachable vulnerable instance into one chain; that chain should drive ticket order ahead of isolated medium findings. CIEM adds unused and excessive permissions, and DSPM adds data classification so a public bucket holding customer PII outranks an empty one.
Worked example
An S3 bucket allows public ACLs and stores PII. Detect: a config policy fires against the bucket ACL API and DSPM confirms classified data. Triage: the attack path view shows the bucket reachable from an instance carrying an administrative role, raising priority. Respond: an alert rule routes High findings in that account group to the cloud team's Slack channel and ServiceNow; remediation is a Terraform change rather than console auto-fix, because the bucket is IaC-managed.
Traps
Auto-remediating IaC-managed resources - the next pipeline run reverts the fix. Reading compliance score as security posture rather than policy coverage. Writing a config query with event syntax. Expecting read-only credentials to remediate. Forgetting that alert rules are scoped by account group and severity, so newly onboarded accounts fall outside existing routing.