A company runs workloads in dozens of accounts across two public cloud providers. Audits keep finding storage buckets made public and security group rules opened to the internet, usually weeks after the change. Which solution would continuously detect these configuration problems across all accounts against defined policies?
Select an answer to reveal the explanation.
Short Explanation
Think of CSPM as a building inspector who walks every floor of every cloud account, all day long, checking settings against the code book. Public buckets and wide-open security groups are configuration problems, not malware or web attacks. Don't let the word 'cloud' push you toward a WAF or antivirus.
Full Explanation
Cloud security posture management (CSPM) connects to cloud provider control planes through their APIs, inventories resources across accounts and providers, and continuously compares their configuration to policy baselines such as "storage must not be publicly readable" or "management ports must not be open to any address." Because it reads configuration rather than probing hosts, it sees storage permissions, identity policies, and network rules that host scans cannot, and it can alert within minutes of a risky change instead of at the next audit. A web application firewall inspects HTTP requests to an application; it does nothing about a bucket's access policy or a security group rule. Antivirus agents on virtual machines look for malicious code on those instances and have no view of account-level settings. An authenticated network scan against private addresses evaluates operating system and software vulnerabilities on reachable hosts, but a public storage bucket is not a host on that network and a security group rule is not something the scan reads. Exam caveat: CSPM detects and reports; remediation may be manual or automated depending on policy. Operational check: confirm every account is onboarded, then open a test bucket as public in a sandbox account and verify the alert fires.