WGU D320 Objective Assessment Practice Questions 350
Comprehensive Cloud Security Management and Compliance
Certification Prep
This 350-question practice exam serves as a highly targeted, technically rigorous
study resource explicitly engineered to mirror the cognitive depth, structural
formatting, and core competencies evaluated in the WGU D320 (Managing Cloud
Security) Objective Assessment. Each entry features a scenario-based question
with four realistic choices, a checked (✓) correct answer enclosed in visual
brackets, and a boxed technical rationale block that explains why the correct
option is secure and why the alternatives fail.
1. Which essential cloud computing characteristic allows consumers to unilaterally
provision computing capabilities, such as server time and network storage, as needed
automatically without requiring human interaction with the service provider?
A. Rapid elasticity
B. Broad network access
[C. ✓ On-demand self-service]
D. Resource pooling
Rationale: On-demand self-service allows users to provision resources automatically
without human intervention from the service provider, which is a key defining
characteristic of cloud computing.
2. A cloud consumer uses an environment where the cloud provider manages the
underlying hardware, operating systems, and database engines, while the consumer
only manages the application configuration and deployed code. Which cloud service
model does this represent?
A. Infrastructure as a Service (IaaS)
[B. ✓ Platform as a Service (PaaS)]
C. Software as a Service (SaaS)
D. Function as a Service (FaaS)
Rationale: In PaaS, the provider maintains the physical hardware, operating systems,
and middleware, leaving the customer responsible only for application code and
configurations.
3. An organization has strict regulatory requirements dictating that its data and underlying
computing physical hardware cannot be co-located or shared with any other tenants.
Which cloud deployment model must the organization implement?
A. Public Cloud
[B. ✓ Private Cloud]
C. Community Cloud
, D. Hybrid Cloud
Rationale: A private cloud is dedicated exclusively to a single organization, ensuring
that hardware resources are not shared with external tenants, mitigating multi-tenancy
risks.
4. Under the cloud Shared Responsibility Model, which party is ultimately responsible for
the physical security of the data center hosting an Infrastructure as a Service (IaaS)
deployment?
[A. ✓ Cloud Service Provider (CSP)]
B. Cloud Consumer
C. Third-party Auditor
D. Hardware Manufacturer
Rationale: In all cloud models (IaaS, PaaS, SaaS), physical infrastructure and physical
data center security are always the sole responsibility of the Cloud Service Provider.
5. When a cloud customer uploads Personally Identifiable Information (PII) to a public
cloud SaaS platform, who retains ultimate legal and regulatory accountability for data
privacy breaches?
A. The Cloud Service Provider
[B. ✓ Cloud Service Customer]
C. The software developers
D. The hardware infrastructure engineers
Rationale: While the provider implements security controls, the cloud customer is the
data owner and remains ultimately responsible and accountable for the privacy and
protection of its data.
6. Which cloud storage architecture exposes storage to instances in the form of raw,
unformatted blocks that can be mounted as local drives, commonly used for databases?
A. Object Storage
[B. ✓ Block Storage]
C. File Storage
D. Ephemeral Storage
Rationale: Block storage provides raw storage volumes that function like virtual hard
drives attached to virtual instances, which is ideal for structured database applications.
7. During which phase of the cloud data lifecycle are data classification tags, labels, and
mappings initially applied to a data set?
[A. ✓ Create]
B. Store
C. Share
D. Archive
Rationale: Classification and labeling should happen immediately upon the creation or
ingestion of data (the Create phase) to ensure appropriate security controls are applied
from the start.
8. A data security engineer needs to destroy sensitive data stored on solid-state drives
(SSDs) in a cloud environment where physical access is impossible. Which method
should they use?
A. Degaussing
B. Overwriting
[C. ✓ Crypto-shredding]
, D. Physical shredding
Rationale: Crypto-shredding involves deleting or overwriting the encryption keys
protecting the data, rendering the encrypted data on the underlying medium completely
unrecoverable.
9. Which practice describes obscuring original raw data fields so that only a partial
segment is visible for production or operational support tasks (e.g., displaying only the
last four digits of a credit card)?
A. Tokenization
B. Homomorphic Encryption
[C. ✓ Data Masking]
D. Hashing
Rationale: Data masking purposefully alters or obscures specific portions of sensitive
data fields to protect confidentiality while maintaining usability for specific tasks.
10. An enterprise wants to replace credit card numbers in its application database with non-
sensitive, randomly generated reference values that map back to the real numbers
inside a highly secured database. What is this process called?
[A. ✓ Tokenization]
B. Symmetric Encryption
C. Data Anonymization
D. Digital Signatures
Rationale: Tokenization substitutes sensitive data elements with non-sensitive tokens
that have no intrinsic value, using a separate lookup database to maintain the mapping.
11. Which data-at-rest encryption technique occurs at the hypervisor level and secures
entire virtual machine disk images without requiring configuration inside the guest
operating system?
A. Application-level encryption
B. Database-level encryption
[C. ✓ Storage-volume encryption]
D. Transparent Data Encryption (TDE)
Rationale: Storage-volume or instance-level disk encryption secures the virtual
machine's storage volume as a whole, isolated from internal configuration settings.
12. An organization implements an Information Rights Management (IRM) system to
prevent corporate documents from being printed or forwarded. Which specific IRM
challenge addresses the concern that a user might replicate the content using a
smartphone camera?
A. Replication restrictions
B. Regulatory compliance
[C. ✓ Out-of-band capture]
D. Dynamic policy enforcement
Rationale: Out-of-band capture occurs when technical controls (like DRM/IRM) are
bypassed using external, physical capture devices like cameras or audio recorders.
13. What type of technical solution allows an organization to monitor cloud application
usage, enforce corporate security policies, and identify shadow IT across multiple cloud
providers from a single control point?
A. Web Application Firewall (WAF)
B. Intrusion Detection System (IDS)
, [C. ✓ Cloud Access Security Broker (CASB)]
D. Virtual Private Network (VPN)
Rationale: A CASB is a software tool or service positioned between an organization's
on-premises infrastructure and cloud provider environments to enforce security and
compliance policies.
14. Which system is designed to collect, aggregate, and normalize log data from multiple
disparate cloud infrastructure components to enable real-time security monitoring and
automated log analysis?
A. Simple Network Management Protocol (SNMP)
[B. ✓ Security Information and Event Management (SIEM)]
C. Business Process Management (BPM)
D. Domain Name System Security Extensions (DNSSEC)
Rationale: SIEM platforms ingest, analyze, correlate, and retain event log data from
across an enterprise infrastructure to identify and respond to security anomalies.
15. To minimize false positives and alleviate human analyst fatigue, which policy or
technique should an organization implement within its cloud SIEM toolset?
A. Manual line-by-line validation
[B. ✓ Correlation rules and automated baseline analysis]
C. Disabling all info-level notifications
D. Logging all raw network packet headers directly to text files
Rationale: Configuring smart correlation rules and establishing behavioral baselines
allows the SIEM to filter out background noise and focus human attention on high-risk
events.
16. Which process is used to evaluate and identify the potential financial, operational, and
physical consequences that an unexpected system disruption could cause to an
organization’s business functions?
A. Risk Management Framework (RMF)
[B. ✓ Business Impact Analysis (BIA)]
C. Vulnerability Assessment
D. Quantitative Risk Mitigation
Rationale: A BIA is a foundational business continuity process that identifies critical
business functions, resource requirements, and the specific impact of downtime.
17. An organization determines that its Maximum Tolerable Downtime (MTD) for a core
portal is 24 hours. They set up an architecture ensuring data can be restored up to a
state captured 4 hours prior to a failure. What is this 4-hour metric called?
A. Recovery Time Objective (RTO)
[B. ✓ Recovery Point Objective (RPO)]
C. Mean Time to Repair (MTTR)
D. Work Recovery Time (WRT)
Rationale: RPO defines the maximum acceptable age of data that can be restored from
backup storage following an outage without causing severe business harm.
18. What cloud resiliency strategy involves running parallel identical application instances
across multiple separate, isolated geographic locations provided by a single cloud
provider?
A. Multi-cloud deployment
[B. ✓ Multi-Region deployment]
Comprehensive Cloud Security Management and Compliance
Certification Prep
This 350-question practice exam serves as a highly targeted, technically rigorous
study resource explicitly engineered to mirror the cognitive depth, structural
formatting, and core competencies evaluated in the WGU D320 (Managing Cloud
Security) Objective Assessment. Each entry features a scenario-based question
with four realistic choices, a checked (✓) correct answer enclosed in visual
brackets, and a boxed technical rationale block that explains why the correct
option is secure and why the alternatives fail.
1. Which essential cloud computing characteristic allows consumers to unilaterally
provision computing capabilities, such as server time and network storage, as needed
automatically without requiring human interaction with the service provider?
A. Rapid elasticity
B. Broad network access
[C. ✓ On-demand self-service]
D. Resource pooling
Rationale: On-demand self-service allows users to provision resources automatically
without human intervention from the service provider, which is a key defining
characteristic of cloud computing.
2. A cloud consumer uses an environment where the cloud provider manages the
underlying hardware, operating systems, and database engines, while the consumer
only manages the application configuration and deployed code. Which cloud service
model does this represent?
A. Infrastructure as a Service (IaaS)
[B. ✓ Platform as a Service (PaaS)]
C. Software as a Service (SaaS)
D. Function as a Service (FaaS)
Rationale: In PaaS, the provider maintains the physical hardware, operating systems,
and middleware, leaving the customer responsible only for application code and
configurations.
3. An organization has strict regulatory requirements dictating that its data and underlying
computing physical hardware cannot be co-located or shared with any other tenants.
Which cloud deployment model must the organization implement?
A. Public Cloud
[B. ✓ Private Cloud]
C. Community Cloud
, D. Hybrid Cloud
Rationale: A private cloud is dedicated exclusively to a single organization, ensuring
that hardware resources are not shared with external tenants, mitigating multi-tenancy
risks.
4. Under the cloud Shared Responsibility Model, which party is ultimately responsible for
the physical security of the data center hosting an Infrastructure as a Service (IaaS)
deployment?
[A. ✓ Cloud Service Provider (CSP)]
B. Cloud Consumer
C. Third-party Auditor
D. Hardware Manufacturer
Rationale: In all cloud models (IaaS, PaaS, SaaS), physical infrastructure and physical
data center security are always the sole responsibility of the Cloud Service Provider.
5. When a cloud customer uploads Personally Identifiable Information (PII) to a public
cloud SaaS platform, who retains ultimate legal and regulatory accountability for data
privacy breaches?
A. The Cloud Service Provider
[B. ✓ Cloud Service Customer]
C. The software developers
D. The hardware infrastructure engineers
Rationale: While the provider implements security controls, the cloud customer is the
data owner and remains ultimately responsible and accountable for the privacy and
protection of its data.
6. Which cloud storage architecture exposes storage to instances in the form of raw,
unformatted blocks that can be mounted as local drives, commonly used for databases?
A. Object Storage
[B. ✓ Block Storage]
C. File Storage
D. Ephemeral Storage
Rationale: Block storage provides raw storage volumes that function like virtual hard
drives attached to virtual instances, which is ideal for structured database applications.
7. During which phase of the cloud data lifecycle are data classification tags, labels, and
mappings initially applied to a data set?
[A. ✓ Create]
B. Store
C. Share
D. Archive
Rationale: Classification and labeling should happen immediately upon the creation or
ingestion of data (the Create phase) to ensure appropriate security controls are applied
from the start.
8. A data security engineer needs to destroy sensitive data stored on solid-state drives
(SSDs) in a cloud environment where physical access is impossible. Which method
should they use?
A. Degaussing
B. Overwriting
[C. ✓ Crypto-shredding]
, D. Physical shredding
Rationale: Crypto-shredding involves deleting or overwriting the encryption keys
protecting the data, rendering the encrypted data on the underlying medium completely
unrecoverable.
9. Which practice describes obscuring original raw data fields so that only a partial
segment is visible for production or operational support tasks (e.g., displaying only the
last four digits of a credit card)?
A. Tokenization
B. Homomorphic Encryption
[C. ✓ Data Masking]
D. Hashing
Rationale: Data masking purposefully alters or obscures specific portions of sensitive
data fields to protect confidentiality while maintaining usability for specific tasks.
10. An enterprise wants to replace credit card numbers in its application database with non-
sensitive, randomly generated reference values that map back to the real numbers
inside a highly secured database. What is this process called?
[A. ✓ Tokenization]
B. Symmetric Encryption
C. Data Anonymization
D. Digital Signatures
Rationale: Tokenization substitutes sensitive data elements with non-sensitive tokens
that have no intrinsic value, using a separate lookup database to maintain the mapping.
11. Which data-at-rest encryption technique occurs at the hypervisor level and secures
entire virtual machine disk images without requiring configuration inside the guest
operating system?
A. Application-level encryption
B. Database-level encryption
[C. ✓ Storage-volume encryption]
D. Transparent Data Encryption (TDE)
Rationale: Storage-volume or instance-level disk encryption secures the virtual
machine's storage volume as a whole, isolated from internal configuration settings.
12. An organization implements an Information Rights Management (IRM) system to
prevent corporate documents from being printed or forwarded. Which specific IRM
challenge addresses the concern that a user might replicate the content using a
smartphone camera?
A. Replication restrictions
B. Regulatory compliance
[C. ✓ Out-of-band capture]
D. Dynamic policy enforcement
Rationale: Out-of-band capture occurs when technical controls (like DRM/IRM) are
bypassed using external, physical capture devices like cameras or audio recorders.
13. What type of technical solution allows an organization to monitor cloud application
usage, enforce corporate security policies, and identify shadow IT across multiple cloud
providers from a single control point?
A. Web Application Firewall (WAF)
B. Intrusion Detection System (IDS)
, [C. ✓ Cloud Access Security Broker (CASB)]
D. Virtual Private Network (VPN)
Rationale: A CASB is a software tool or service positioned between an organization's
on-premises infrastructure and cloud provider environments to enforce security and
compliance policies.
14. Which system is designed to collect, aggregate, and normalize log data from multiple
disparate cloud infrastructure components to enable real-time security monitoring and
automated log analysis?
A. Simple Network Management Protocol (SNMP)
[B. ✓ Security Information and Event Management (SIEM)]
C. Business Process Management (BPM)
D. Domain Name System Security Extensions (DNSSEC)
Rationale: SIEM platforms ingest, analyze, correlate, and retain event log data from
across an enterprise infrastructure to identify and respond to security anomalies.
15. To minimize false positives and alleviate human analyst fatigue, which policy or
technique should an organization implement within its cloud SIEM toolset?
A. Manual line-by-line validation
[B. ✓ Correlation rules and automated baseline analysis]
C. Disabling all info-level notifications
D. Logging all raw network packet headers directly to text files
Rationale: Configuring smart correlation rules and establishing behavioral baselines
allows the SIEM to filter out background noise and focus human attention on high-risk
events.
16. Which process is used to evaluate and identify the potential financial, operational, and
physical consequences that an unexpected system disruption could cause to an
organization’s business functions?
A. Risk Management Framework (RMF)
[B. ✓ Business Impact Analysis (BIA)]
C. Vulnerability Assessment
D. Quantitative Risk Mitigation
Rationale: A BIA is a foundational business continuity process that identifies critical
business functions, resource requirements, and the specific impact of downtime.
17. An organization determines that its Maximum Tolerable Downtime (MTD) for a core
portal is 24 hours. They set up an architecture ensuring data can be restored up to a
state captured 4 hours prior to a failure. What is this 4-hour metric called?
A. Recovery Time Objective (RTO)
[B. ✓ Recovery Point Objective (RPO)]
C. Mean Time to Repair (MTTR)
D. Work Recovery Time (WRT)
Rationale: RPO defines the maximum acceptable age of data that can be restored from
backup storage following an outage without causing severe business harm.
18. What cloud resiliency strategy involves running parallel identical application instances
across multiple separate, isolated geographic locations provided by a single cloud
provider?
A. Multi-cloud deployment
[B. ✓ Multi-Region deployment]
