4.2.4. Cloud Workload Protection
💡 First Principle: Cloud workload protection (CWP) goes beyond configuration checking (CSPM) to actively detect and help prevent real-time threats against running workloads — virtual machines, containers, databases, and storage — using capabilities like just-in-time VM access, agentless malware scanning, and endpoint detection and response.
Just-in-time (JIT) VM access reduces the attack surface of management ports (like RDP/SSH) by keeping them closed by default and opening them only temporarily when explicitly requested and approved — a workload-level cousin of PIM's just-in-time philosophy (Phase 3.4.3). Agentless malware scanning inspects VM disks for malicious files without installing anything on the machine, and the integration with Microsoft Defender for Endpoint adds endpoint detection and response (EDR) that alerts on suspicious activity on the running server. (An older feature, adaptive application controls, was retired in 2024 along with the Log Analytics agent — you may still see it in outdated study material.)
⚠️ Exam Trap: CSPM (4.2.2) finds misconfigurations before an attack happens; cloud workload protection defends against active threats to running resources. A question about detecting an in-progress attack is testing CWP, not CSPM.
Reflection Question: How does just-in-time VM access apply the same underlying principle as Privileged Identity Management (Phase 3.4.3), even though one protects a network port and the other protects an admin role?
