WGU D320 OBJECTIVE ASSESSMENT FINAL NEWEST
2026/ 2027 ACTUAL EXAM TEST BANK| D320
MANAGING CLOUD SECURITY OA FINAL REVIEW
WITH 300 REAL EXAM QUESTIONS AND CORRECT
DETAILED ANSWERS (VERIFIED ANSWERS)
ALREADY GRADED A+ (MOST RECENT!!)
Which technology is most effective in preventing unauthorized access to
sensitive data by ensuring it is unreadable without proper decryption
keys?
A. Data Masking
B. Tokenization
C. Encryption
D. Obfuscation - Correct Answer - C. Encryption
Encryption transforms readable data into an unreadable format using
cryptographic algorithms, making it inaccessible to unauthorized users.
Tokenization and data masking are also methods of protecting data, but
they do not provide the same level of security as encryption.
Obfuscation is the process of making data more difficult to understand
but is not intended to prevent access.
Which of the following activities is essential during the Secure
Operations phase of the Software Development Lifecycle (SDLC)?
A. Static Analysis
B. Code Review
C. Dynamic Analysis
D. Acceptance Testing - Correct Answer - C. Dynamic Analysis
pg. 1
,Dynamic Analysis is crucial during the secure operations phase because
it involves testing the software in a runtime environment, identifying
security vulnerabilities that might only become apparent during
execution. Static Analysis and Code Review are performed earlier in the
SDLC, and Acceptance Testing is typically done after secure operations
to verify the system meets the requirements.
Which U.S. law focuses specifically on the protection of personal health
information?
A. Sarbanes-Oxley Act (SOX)
B. Health Insurance Portability and Accountability Act (HIPAA)
C. Gramm-Leach-Bliley Act (GLBA)
D. Federal Information Security Management Act (FISMA) - Correct
Answer - B. Health Insurance Portability and Accountability Act
(HIPAA)
HIPAA sets standards for the protection of personal health information.
SOX is related to corporate financial practices, GLBA focuses on
financial privacy, and FISMA applies to federal information security
management.
Which cloud service model requires the customer to manage the security
of the operating system, applications, and data?
A. Software as a Service (SaaS)
B. Platform as a Service (PaaS)
C. Infrastructure as a Service (IaaS)
D. Containers as a Service (CaaS) - Correct Answer - C. Infrastructure
as a Service (IaaS)
In IaaS, the provider manages the underlying infrastructure, while the
customer is responsible for managing the security of the operating
pg. 2
,system, applications, and data. In SaaS, the provider manages
everything, including security. PaaS offers more management of
security, but the customer still handles application security.
What is the primary goal of implementing a Disaster Recovery Plan
(DRP) in cloud operations?
A. Ensure high availability of cloud services
B. Recover operations after a catastrophic event
C. Perform routine backups of data
D. Prevent unauthorized access to cloud resources - Correct Answer - B.
Recover operations after a catastrophic event
The main goal of a Disaster Recovery Plan is to recover business
operations as quickly as possible after a catastrophic event. High
availability is a separate concern, focusing on maintaining operations,
while backups are part of DRP but not the primary goal. Preventing
unauthorized access is a security concern, not specifically related to
DRP.
Which risk management process involves determining the impact of
potential threats on business operations?
A. Risk Assessment
B. Business Impact Analysis (BIA)
C. Threat Modeling
D. Risk Avoidance - Correct Answer - B. Business Impact Analysis
(BIA)
BIA identifies the effects of potential threats on business operations and
helps prioritize recovery efforts. Risk Assessment identifies risks, Threat
Modeling focuses on identifying and mitigating threats, and Risk
Avoidance involves eliminating risks.
pg. 3
, Which international standard provides guidelines for the management of
personal data in cloud computing environments?
A. ISO/IEC 27018
B. ISO/IEC 27001
C. PCI DSS
D. HIPAA - Correct Answer - A. ISO/IEC 27018
ISO/IEC 27018 provides guidelines specifically for the protection of
personal data in cloud computing environments. ISO/IEC 27001 is a
general information security standard, PCI DSS is for payment card
data, and HIPAA is specific to health information.
With an API, various features and optimizations are highly desirable to
scalability, reliability, and security. What does the REST API support
that the SOAP API does NOT support?
A. Acceleration
B. Caching
C. Redundancy
D. Encryption - Correct Answer - B. Caching
The Simple Object Access Protocol (SOAP) does not support caching,
whereas the Representational State Transfer (REST) API does. The other
options are all capabilities that are either not supported by SOAP or not
supported by any API and must be provided by external features.
What is the purpose of a Web Application Firewall (WAF) in securing
cloud services?
A. Encrypting data in transit
B. Protecting applications from common web attacks
pg. 4
2026/ 2027 ACTUAL EXAM TEST BANK| D320
MANAGING CLOUD SECURITY OA FINAL REVIEW
WITH 300 REAL EXAM QUESTIONS AND CORRECT
DETAILED ANSWERS (VERIFIED ANSWERS)
ALREADY GRADED A+ (MOST RECENT!!)
Which technology is most effective in preventing unauthorized access to
sensitive data by ensuring it is unreadable without proper decryption
keys?
A. Data Masking
B. Tokenization
C. Encryption
D. Obfuscation - Correct Answer - C. Encryption
Encryption transforms readable data into an unreadable format using
cryptographic algorithms, making it inaccessible to unauthorized users.
Tokenization and data masking are also methods of protecting data, but
they do not provide the same level of security as encryption.
Obfuscation is the process of making data more difficult to understand
but is not intended to prevent access.
Which of the following activities is essential during the Secure
Operations phase of the Software Development Lifecycle (SDLC)?
A. Static Analysis
B. Code Review
C. Dynamic Analysis
D. Acceptance Testing - Correct Answer - C. Dynamic Analysis
pg. 1
,Dynamic Analysis is crucial during the secure operations phase because
it involves testing the software in a runtime environment, identifying
security vulnerabilities that might only become apparent during
execution. Static Analysis and Code Review are performed earlier in the
SDLC, and Acceptance Testing is typically done after secure operations
to verify the system meets the requirements.
Which U.S. law focuses specifically on the protection of personal health
information?
A. Sarbanes-Oxley Act (SOX)
B. Health Insurance Portability and Accountability Act (HIPAA)
C. Gramm-Leach-Bliley Act (GLBA)
D. Federal Information Security Management Act (FISMA) - Correct
Answer - B. Health Insurance Portability and Accountability Act
(HIPAA)
HIPAA sets standards for the protection of personal health information.
SOX is related to corporate financial practices, GLBA focuses on
financial privacy, and FISMA applies to federal information security
management.
Which cloud service model requires the customer to manage the security
of the operating system, applications, and data?
A. Software as a Service (SaaS)
B. Platform as a Service (PaaS)
C. Infrastructure as a Service (IaaS)
D. Containers as a Service (CaaS) - Correct Answer - C. Infrastructure
as a Service (IaaS)
In IaaS, the provider manages the underlying infrastructure, while the
customer is responsible for managing the security of the operating
pg. 2
,system, applications, and data. In SaaS, the provider manages
everything, including security. PaaS offers more management of
security, but the customer still handles application security.
What is the primary goal of implementing a Disaster Recovery Plan
(DRP) in cloud operations?
A. Ensure high availability of cloud services
B. Recover operations after a catastrophic event
C. Perform routine backups of data
D. Prevent unauthorized access to cloud resources - Correct Answer - B.
Recover operations after a catastrophic event
The main goal of a Disaster Recovery Plan is to recover business
operations as quickly as possible after a catastrophic event. High
availability is a separate concern, focusing on maintaining operations,
while backups are part of DRP but not the primary goal. Preventing
unauthorized access is a security concern, not specifically related to
DRP.
Which risk management process involves determining the impact of
potential threats on business operations?
A. Risk Assessment
B. Business Impact Analysis (BIA)
C. Threat Modeling
D. Risk Avoidance - Correct Answer - B. Business Impact Analysis
(BIA)
BIA identifies the effects of potential threats on business operations and
helps prioritize recovery efforts. Risk Assessment identifies risks, Threat
Modeling focuses on identifying and mitigating threats, and Risk
Avoidance involves eliminating risks.
pg. 3
, Which international standard provides guidelines for the management of
personal data in cloud computing environments?
A. ISO/IEC 27018
B. ISO/IEC 27001
C. PCI DSS
D. HIPAA - Correct Answer - A. ISO/IEC 27018
ISO/IEC 27018 provides guidelines specifically for the protection of
personal data in cloud computing environments. ISO/IEC 27001 is a
general information security standard, PCI DSS is for payment card
data, and HIPAA is specific to health information.
With an API, various features and optimizations are highly desirable to
scalability, reliability, and security. What does the REST API support
that the SOAP API does NOT support?
A. Acceleration
B. Caching
C. Redundancy
D. Encryption - Correct Answer - B. Caching
The Simple Object Access Protocol (SOAP) does not support caching,
whereas the Representational State Transfer (REST) API does. The other
options are all capabilities that are either not supported by SOAP or not
supported by any API and must be provided by external features.
What is the purpose of a Web Application Firewall (WAF) in securing
cloud services?
A. Encrypting data in transit
B. Protecting applications from common web attacks
pg. 4
