L15. Defender for Cloud: CSPM and CWP Fundamentals

Defender for Cloud shows a configuration recommendation and a security alert for the same resource. Are they the same problem? One can describe exposure, while the other reports suspected threat activity. We'll distinguish posture management from workload protection, then decide what evidence each finding requires.

Cloud security posture management examines configuration and risk. Workload protection provides threat-protection capabilities for supported resources and enabled plans. The two can support each other, but one does not replace the other. Coverage depends on the environment, onboarding, configuration, and capabilities you have enabled. A visible subscription is not proof that every resource is protected.

In our fictional case, a server has a configuration weakness and an alert. Confirm the resource identity and its enabled protection coverage. Review the recommendation's rationale separately from the alert evidence. The weakness may help explain exposure, but it does not prove it caused the alert. Establish that connection before presenting it as an attack path that occurred.

Consider the resource's sensitivity, accessibility, dependencies, and evidence of active threat behavior. A high-impact alert may require immediate investigation while a recommendation enters a planned remediation process. Do not reduce prioritization to a single dashboard color. Record why the chosen action fits this resource and what result would show that the risk changed.

After an approved configuration change, allow for assessment behavior and verify the relevant state. Separately verify any incident-response action. A recommendation becoming healthy does not prove an attacker was removed, and closing an alert does not prove the underlying exposure was fixed. Track the two outcomes with the appropriate evidence.

A security recommendation is resolved, but the associated alert has not been investigated. Can the team treat both as complete? Pause and identify what remains unanswered.

No. The configuration outcome and the threat investigation have different evidence requirements. Verify the fix, investigate the alert, and record the conclusions separately. For practice, choose a fictional resource and write one posture question and one threat-response question. This distinction prevents improvements in configuration from being mistaken for proof of incident recovery.