SSCP Systems and Application Security Practice Question
A cloud security team is implementing a Cloud Security Posture Management (CSPM) tool. What is the primary purpose of a CSPM solution?
⚠ Common exam trap
SSCP often tests the boundary between CSPM, CWPP, and CIEM — candidates confuse posture management (configuration) with workload protection (runtime) or identity management (permissions).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Detect and remediate cloud misconfigurations
CSPM tools continuously monitor cloud environments against security benchmarks (CIS, PCI-DSS, ISO 27001) and compliance frameworks, detecting misconfigurations such as public S3 buckets, overly permissive security groups, or disabled logging, then providing remediation guidance. The primary purpose is posture management — identifying and fixing configuration drift and policy violations before they are exploited.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Manage user identities and access
Why it's wrong here
Identity and access management governs authentication and authorisation through directory services and policies, which CSPM does not perform. CSPM continuously assesses cloud configurations against benchmarks; IAM would be correct when the requirement is controlling who can access which cloud resources.
- ✗
Protect workloads from runtime threats
Why it's wrong here
Runtime threat protection belongs to CWPP or EDR tooling, which inspects running processes and workloads; CSPM instead continuously assesses cloud configuration against benchmarks and compliance baselines. It is tempting because posture findings often feed runtime tools, but detecting misconfigured storage or open security groups is CSPM's actual purpose.
- ✗
Encrypt data at rest
Why it's wrong here
Encryption at rest protects stored data confidentiality and is handled by key management and storage services, not posture assessment. CSPM instead continuously detects misconfigurations and compliance drift; encryption would be the correct control when the requirement is protecting data confidentiality on disk.
- ✓
Detect and remediate cloud misconfigurations
Why this is correct
CSPM continuously assesses cloud environments against security baselines and compliance frameworks, identifying misconfigurations such as public buckets or overly permissive roles, then alerting or auto-remediating. This detection and remediation of misconfigurations is its primary purpose, distinct from workload protection or identity governance.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.