Exam 156-561 Topic 2 Question 84 Discussion

CloudGuard Cloud Security Posture Management (CSPM) operational modes
When onboarding a cloud account (AWS, Azure, GCP, etc.) in CloudGuard Dome9 / CSPM, you must choose one of the following three modes:

























ModeDescriptionUse CaseRead OnlyCloudGuard only reads and monitors the account (misconfigurations, compliance, inventory, alerts). No changes are ever made.Most common for production accounts – visibility + compliance without riskRead/WriteCloudGuard can actively remediate certain findings (e.g., auto-fix public S3 buckets, revoke excessive IAM permissions, encrypt unmanaged disks, etc.).Accounts where you want automated or one-click remediation is desiredRegion LockLimits CloudGuard’s permissions and visibility to only specific regions you explicitly allow. Can be combined with Read Only or Read/Write.Required for regulated environments or when you do not want CloudGuard to see certain regions (e.g., China regions, GovCloud regions with classified data)
These are the exact three options you see during cloud account onboarding in the CloudGuard portal today (R81.20 and later / Infinity Portal).
Why the other options are incorrect

A and C include “Full Protection” → that is a CloudGuard Network mode, not a CSPM posture management mode.
D includes “Partial Protection” → no such mode exists in CSPM.