Which statement best describes the role of CSPM, CWPP, and provider-native security features in a cloud security strategy?

• A. Provider-native features alone are sufficient; CSPM and CWPP are unnecessary.
• B. CSPM identifies misconfigurations and CWPP protects workloads; provider-native features add limited controls.
• C. CWPP protects workloads and runtime
• D. CSPM identifies misconfigurations across cloud resources; CWPP protects workloads and runtime.

Answer: (D)

CSPM and CWPP address different but complementary aspects of cloud security. CSPM is about the overall security posture: it continuously scans for misconfigurations and policy violations across cloud resources, accounts, and services, helping you fix gaps before they’re exploited. This broad visibility is what reduces the attack surface—think of IAM permissions, storage exposure, network rules, and other configuration risks across the entire environment.

CWPP focuses on the protection of the actual workloads and their runtime context. It defends running apps, containers, and serverless components, providing runtime threat detection, vulnerability management, and enforcement of security controls during execution. This guards workloads against active attacks and exploits even if misconfigurations exist elsewhere in the stack.

Provider-native security features from the cloud provider give you baseline controls like IAM, network security groups, encryption options, and service-specific protections. They’re essential, but they’re not always sufficient on their own to achieve comprehensive, cross-cloud posture visibility or robust runtime protection across all workloads.

So the best description is that CSPM identifies misconfigurations across cloud resources, while CWPP protects workloads and runtime, with provider-native features serving as baseline controls rather than a complete security solution.