The lock-lab subscription currently has only the free posture experience. Which distinction is accurate?
Select an answer to reveal the explanation.
Short Explanation
Free Foundational CSPM already gives you recommendations, Secure Score, and the Microsoft Cloud Security Benchmark. Paying for Defender CSPM buys the fancy map—attack paths and the cloud security graph—not a rename of the same switch.
Full Explanation
On a lock-lab subscription limited to the free posture experience, Foundational CSPM already provides recommendations, Secure Score, and the Microsoft Cloud Security Benchmark (MCSB). Defender CSPM is the paid expansion that adds advanced capabilities such as attack-path analysis and the cloud security graph. That distinction matters when explaining what the free tier already covers versus what paid CSPM unlocks.
Claiming Foundational CSPM and Defender CSPM are identical except for the invoice label erases real feature differences and misguides budgeting. Saying Defender for Servers must be enabled before Secure Score can appear is false: Secure Score is a CSPM posture construct and does not require the Servers workload plan to exist. Claiming Foundational CSPM only monitors on-premises Arc machines while Azure VMs require Defender CSPM reverses reality—Foundational CSPM assesses Azure posture without that restriction.
Exam caveat: enabling Defender CSPM does not automatically enable every Defender for Cloud workload plan (Servers, SQL, Containers, and so on); those remain separate enablement decisions.
Operational check: in Environment settings for the lock-lab subscription, confirm which CSPM experience is active, verify Secure Score and MCSB recommendations are present on Foundational CSPM, and document which attack-path or graph features appear only after Defender CSPM is enabled.