Cloud Infrastructure and Application Security
This domain tests the build-to-run path: hardened images, infrastructure as code, workload configuration, and pipeline integrity.
Shift left, then keep watching
Preventive controls act before deployment: approved base images, IaC scanning with policy-as-code for public buckets, open security groups, and unencrypted volumes, least-privilege pipeline identities, and signed artefacts. Detective controls act after: CSPM compares deployed state against benchmarks such as the CIS Foundations Benchmarks, CWPP protects running workloads, and vulnerability scanners plus SBOMs track component risk. Containers add Kubernetes-specific controls - pod security standards, admission controllers that reject privileged pods and hostPath mounts, network policies for east-west traffic, and RBAC bound to service accounts. Serverless shifts risk to event permissions, dependency vulnerabilities, and over-broad function roles.
Worked example
A deployment manifest runs as root, mounts the host filesystem, and uses the latest tag. Reasoning: root plus hostPath permits container escape and node compromise, and latest defeats reproducibility and vulnerability tracking. Remediation is a non-root user, read-only root filesystem, dropped capabilities, a digest-pinned image, and an admission policy that rejects the pattern cluster-wide - systemic rather than a one-off patch.
Traps
Treating CSPM output as a vulnerability list rather than misconfiguration. Scanning images once at build instead of continuously. Assuming an internal network segment protects east-west traffic. Ignoring IaC because the console is locked down - most drift enters through pipelines. Equating possession of an SBOM with remediation.