WGU E025 CLOUD AND NETWORK SECURITY MODELS OA
ACTUAL EXAM 2026-2027 COMPLETE QUESTIONS AND
CORRECT DETAILED ANSWERS/ GUARANTEED PASS A+
BRAND NEW!!!!
Question 1
A security architect is designing a cloud deployment where only the company’s internal employees can
access a custom business application. No public access is allowed. Which cloud deployment model is
most appropriate?
A) Public cloud
B) Community cloud
C) Hybrid cloud
D) Private cloud
Rationale: A private cloud is dedicated to a single organization, ensuring that only internal employees
can access the application. Public cloud allows general access, community cloud is shared among
several organizations, and hybrid cloud mixes public and private.
Question 2
Which cloud service model provides the consumer with the capability to deploy onto the cloud
infrastructure consumer-created or acquired applications created using programming languages and
tools supported by the provider?
A) Infrastructure as a Service (IaaS)
B) Platform as a Service (PaaS)
C) Software as a Service (SaaS)
D) Function as a Service (FaaS)
Rationale: PaaS gives developers a platform to build and deploy applications without managing the
underlying infrastructure. IaaS provides raw compute/storage, SaaS delivers ready-to-use software, and
FaaS is event-driven compute.
,Question 3
Which security control is primarily used to protect data at rest in a cloud storage bucket?
A) TLS 1.3
B) Server-side encryption
C) Network ACLs
D) Web application firewall
Rationale: Server-side encryption encrypts data before it is written to disk, protecting data at rest. TLS
secures data in transit. Network ACLs control traffic, and a WAF protects web apps.
Question 4
An organization adopts a “shared responsibility model” with its cloud provider. Which of the following
is typically the provider’s responsibility in IaaS?
A) Patching guest operating systems
B) Physical security of data centers
C) Managing user access to virtual machines
D) Encrypting application data
Rationale: In IaaS, the provider secures the physical infrastructure, including data centers. The
customer is responsible for OS patching, access management, and data encryption.
Question 5
What is the primary purpose of a network security group (NSG) in a cloud virtual network?
A) Encrypting traffic between VMs
B) Filtering inbound and outbound traffic
C) Load balancing across servers
D) Automatically scaling resources
Rationale: An NSG acts as a stateful firewall, filtering traffic based on rules. It does not encrypt, load
balance, or auto-scale.
,Question 6
Which technology allows a cloud tenant to create logically isolated networks within a public cloud?
A) VLAN tagging
B) Virtual Private Cloud (VPC)
C) Direct Connect
D) Cloud VPN
Rationale: A VPC provides logically isolated network segments within a public cloud. VLAN tagging
is a traditional method but less common in public cloud abstractions. Direct Connect is private
connectivity, and VPN is encrypted tunneling.
Question 7
An administrator wants to ensure that a user cannot delete objects from a cloud storage bucket after 30
days. Which mechanism is best?
A) Bucket ACLs
B) Retention policy
C) Versioning
D) Signed URLs
Rationale: A retention policy enforces that objects cannot be deleted until a specified time. ACLs
control read/write but not time-based rules. Versioning retains old versions, signed URLs provide
temporary access.
Question 8
Which attack involves an attacker intercepting and possibly altering communication between two
parties without their knowledge?
A) DoS
B) Man-in-the-middle (MITM)
C) Replay attack
D) Phishing
Rationale: MITM attacks intercept communications. DoS overwhelms resources, replay attack resends
captured data, phishing steals credentials via deception.
, Question 9
What is the primary function of a web application firewall (WAF) in a cloud environment?
A) Filtering network packets by IP address
B) Inspecting HTTP/HTTPS traffic for exploits
C) Blocking all outbound traffic
D) Managing encryption keys
Rationale: A WAF focuses on application-layer (HTTP/HTTPS) attacks like SQL injection or XSS.
Network packet filtering is done by firewalls, key management by KMS.
Question 10
Which cloud security principle states that a user should have only the permissions necessary to perform
their job?
A) Separation of duties
B) Least privilege
C) Defense in depth
D) Need to know
Rationale: Least privilege limits permissions to the minimum required. Separation of duties splits
critical tasks, defense in depth uses multiple controls, need to know restricts data access.
Question 11
A company wants to connect its on-premises data center to a cloud VPC using a dedicated, private,
high-bandwidth connection. Which service should it use?
A) Site-to-site VPN
B) Cloud Direct Connect / ExpressRoute
C) Internet gateway
D) NAT gateway
Rationale: Direct Connect (AWS) or ExpressRoute (Azure) provides a dedicated private connection.
Site-to-site VPN uses the internet, internet/NAT gateways are for public access.
ACTUAL EXAM 2026-2027 COMPLETE QUESTIONS AND
CORRECT DETAILED ANSWERS/ GUARANTEED PASS A+
BRAND NEW!!!!
Question 1
A security architect is designing a cloud deployment where only the company’s internal employees can
access a custom business application. No public access is allowed. Which cloud deployment model is
most appropriate?
A) Public cloud
B) Community cloud
C) Hybrid cloud
D) Private cloud
Rationale: A private cloud is dedicated to a single organization, ensuring that only internal employees
can access the application. Public cloud allows general access, community cloud is shared among
several organizations, and hybrid cloud mixes public and private.
Question 2
Which cloud service model provides the consumer with the capability to deploy onto the cloud
infrastructure consumer-created or acquired applications created using programming languages and
tools supported by the provider?
A) Infrastructure as a Service (IaaS)
B) Platform as a Service (PaaS)
C) Software as a Service (SaaS)
D) Function as a Service (FaaS)
Rationale: PaaS gives developers a platform to build and deploy applications without managing the
underlying infrastructure. IaaS provides raw compute/storage, SaaS delivers ready-to-use software, and
FaaS is event-driven compute.
,Question 3
Which security control is primarily used to protect data at rest in a cloud storage bucket?
A) TLS 1.3
B) Server-side encryption
C) Network ACLs
D) Web application firewall
Rationale: Server-side encryption encrypts data before it is written to disk, protecting data at rest. TLS
secures data in transit. Network ACLs control traffic, and a WAF protects web apps.
Question 4
An organization adopts a “shared responsibility model” with its cloud provider. Which of the following
is typically the provider’s responsibility in IaaS?
A) Patching guest operating systems
B) Physical security of data centers
C) Managing user access to virtual machines
D) Encrypting application data
Rationale: In IaaS, the provider secures the physical infrastructure, including data centers. The
customer is responsible for OS patching, access management, and data encryption.
Question 5
What is the primary purpose of a network security group (NSG) in a cloud virtual network?
A) Encrypting traffic between VMs
B) Filtering inbound and outbound traffic
C) Load balancing across servers
D) Automatically scaling resources
Rationale: An NSG acts as a stateful firewall, filtering traffic based on rules. It does not encrypt, load
balance, or auto-scale.
,Question 6
Which technology allows a cloud tenant to create logically isolated networks within a public cloud?
A) VLAN tagging
B) Virtual Private Cloud (VPC)
C) Direct Connect
D) Cloud VPN
Rationale: A VPC provides logically isolated network segments within a public cloud. VLAN tagging
is a traditional method but less common in public cloud abstractions. Direct Connect is private
connectivity, and VPN is encrypted tunneling.
Question 7
An administrator wants to ensure that a user cannot delete objects from a cloud storage bucket after 30
days. Which mechanism is best?
A) Bucket ACLs
B) Retention policy
C) Versioning
D) Signed URLs
Rationale: A retention policy enforces that objects cannot be deleted until a specified time. ACLs
control read/write but not time-based rules. Versioning retains old versions, signed URLs provide
temporary access.
Question 8
Which attack involves an attacker intercepting and possibly altering communication between two
parties without their knowledge?
A) DoS
B) Man-in-the-middle (MITM)
C) Replay attack
D) Phishing
Rationale: MITM attacks intercept communications. DoS overwhelms resources, replay attack resends
captured data, phishing steals credentials via deception.
, Question 9
What is the primary function of a web application firewall (WAF) in a cloud environment?
A) Filtering network packets by IP address
B) Inspecting HTTP/HTTPS traffic for exploits
C) Blocking all outbound traffic
D) Managing encryption keys
Rationale: A WAF focuses on application-layer (HTTP/HTTPS) attacks like SQL injection or XSS.
Network packet filtering is done by firewalls, key management by KMS.
Question 10
Which cloud security principle states that a user should have only the permissions necessary to perform
their job?
A) Separation of duties
B) Least privilege
C) Defense in depth
D) Need to know
Rationale: Least privilege limits permissions to the minimum required. Separation of duties splits
critical tasks, defense in depth uses multiple controls, need to know restricts data access.
Question 11
A company wants to connect its on-premises data center to a cloud VPC using a dedicated, private,
high-bandwidth connection. Which service should it use?
A) Site-to-site VPN
B) Cloud Direct Connect / ExpressRoute
C) Internet gateway
D) NAT gateway
Rationale: Direct Connect (AWS) or ExpressRoute (Azure) provides a dedicated private connection.
Site-to-site VPN uses the internet, internet/NAT gateways are for public access.
