WGU D485 DGN2 TASK 1: Cloud Security Implementation Plan –
Complete -Question Test Bank
1. Which cloud service model places the maximum amount of
operational and security responsibility on the customer?
A) Software as a Service (SaaS)
B) Platform as a Service (PaaS)
C) Infrastructure as a Service (IaaS)
D) Database as a Service (DBaaS)
*C) Infrastructure as a Service (IaaS) *
Rationale: In an IaaS model, the provider secures only the physical
infrastructure, virtualization layer, and hardware. The customer is responsible
for the operating system, middleware, runtime, data, and applications. This
represents the highest level of customer responsibility under the shared
responsibility model .
2. Under the shared responsibility model, who is responsible for data
governance and classification in a public cloud environment?
A) The cloud service provider completely
B) The customer completely
C) The third-party auditor
D) Shared equally between provider and customer
*B) The customer completely *
Rationale: Regardless of the cloud deployment model (IaaS, PaaS, or SaaS),
data ownership, governance, and classification always remain the sole
,responsibility of the customer. The cloud provider cannot classify or govern
customer data .
3. Which deployment model provides exclusive cloud resources to a
single organization but is hosted and managed by a third-party
provider off-premises?
A) Public Cloud
B) Hosted Private Cloud
C) Hybrid Cloud
D) Community Cloud
*B) Hosted Private Cloud *
Rationale: A hosted private cloud offers dedicated physical or logical
infrastructure to one specific organization while being physically located and
maintained within a provider's data center. This provides the security of a
private cloud without the capital expense of on-premises infrastructure .
4. In a Platform as a Service (PaaS) model, which of the following is
typically managed by the cloud service provider?
A) Application code
B) Operating system patching
C) User access credentials
D) Data endpoints
*B) Operating system patching *
Rationale: PaaS abstracts the underlying operating system and infrastructure
away from the user. The cloud provider handles OS security updates,
,maintenance, and patching. The customer manages their applications and
data .
5. What is the primary benefit of deploying workloads in Azure
Government compared to standard Azure commercial regions?
A) Lower subscription and compute costs
B) Dedicated physical isolation and strict US citizen screening requirements
C) Faster deployment of cutting-edge preview features
D) Global geographic availability across all continents
*B) Dedicated physical isolation and strict US citizen screening
requirements *
Rationale: Azure Government is physically isolated from commercial Azure
networks and enforces strict background checks on personnel to meet
stringent federal security requirements. This is critical for organizations with
government contracts requiring FedRAMP and DoD compliance .
6. Which cloud security concept emphasizes that an organization
should not trust anything inside or outside its perimeters and must
verify every access request?
A) Defense in Depth
B) Zero Trust Architecture
C) Network Segmentation
D) Perimeter Defense
*B) Zero Trust Architecture *
, Rationale: Zero Trust Architecture operates on the core principle of "never
trust, always verify," requiring explicit validation for every access attempt
regardless of origin. This is a foundational concept for modern cloud security .
7. The recommended service model for SWBTL LLC is:
A) Azure Commercial IaaS
B) Azure Government IaaS
C) Azure Government PaaS
D) Azure Commercial SaaS
*B) Azure Government IaaS *
Rationale: The recommended service model is Azure Government IaaS due to
its FedRAMP authorization, DoD Impact Level 5 authorization, and ability to
support FISMA and PCI DSS compliance requirements. This provides the
necessary security controls for government contracts .
8. FedRAMP authorization for Azure Government indicates:
A) It is not secure enough for government use
B) It has been authorized for use by federal agencies
C) It is only for commercial use
D) It does not meet security requirements
*B) It has been authorized for use by federal agencies *
Rationale: FedRAMP (Federal Risk and Authorization Management Program)
authorization indicates that Azure Government has met the security
requirements for use by federal agencies. This is critical for organizations with
US government contracts .
Complete -Question Test Bank
1. Which cloud service model places the maximum amount of
operational and security responsibility on the customer?
A) Software as a Service (SaaS)
B) Platform as a Service (PaaS)
C) Infrastructure as a Service (IaaS)
D) Database as a Service (DBaaS)
*C) Infrastructure as a Service (IaaS) *
Rationale: In an IaaS model, the provider secures only the physical
infrastructure, virtualization layer, and hardware. The customer is responsible
for the operating system, middleware, runtime, data, and applications. This
represents the highest level of customer responsibility under the shared
responsibility model .
2. Under the shared responsibility model, who is responsible for data
governance and classification in a public cloud environment?
A) The cloud service provider completely
B) The customer completely
C) The third-party auditor
D) Shared equally between provider and customer
*B) The customer completely *
Rationale: Regardless of the cloud deployment model (IaaS, PaaS, or SaaS),
data ownership, governance, and classification always remain the sole
,responsibility of the customer. The cloud provider cannot classify or govern
customer data .
3. Which deployment model provides exclusive cloud resources to a
single organization but is hosted and managed by a third-party
provider off-premises?
A) Public Cloud
B) Hosted Private Cloud
C) Hybrid Cloud
D) Community Cloud
*B) Hosted Private Cloud *
Rationale: A hosted private cloud offers dedicated physical or logical
infrastructure to one specific organization while being physically located and
maintained within a provider's data center. This provides the security of a
private cloud without the capital expense of on-premises infrastructure .
4. In a Platform as a Service (PaaS) model, which of the following is
typically managed by the cloud service provider?
A) Application code
B) Operating system patching
C) User access credentials
D) Data endpoints
*B) Operating system patching *
Rationale: PaaS abstracts the underlying operating system and infrastructure
away from the user. The cloud provider handles OS security updates,
,maintenance, and patching. The customer manages their applications and
data .
5. What is the primary benefit of deploying workloads in Azure
Government compared to standard Azure commercial regions?
A) Lower subscription and compute costs
B) Dedicated physical isolation and strict US citizen screening requirements
C) Faster deployment of cutting-edge preview features
D) Global geographic availability across all continents
*B) Dedicated physical isolation and strict US citizen screening
requirements *
Rationale: Azure Government is physically isolated from commercial Azure
networks and enforces strict background checks on personnel to meet
stringent federal security requirements. This is critical for organizations with
government contracts requiring FedRAMP and DoD compliance .
6. Which cloud security concept emphasizes that an organization
should not trust anything inside or outside its perimeters and must
verify every access request?
A) Defense in Depth
B) Zero Trust Architecture
C) Network Segmentation
D) Perimeter Defense
*B) Zero Trust Architecture *
, Rationale: Zero Trust Architecture operates on the core principle of "never
trust, always verify," requiring explicit validation for every access attempt
regardless of origin. This is a foundational concept for modern cloud security .
7. The recommended service model for SWBTL LLC is:
A) Azure Commercial IaaS
B) Azure Government IaaS
C) Azure Government PaaS
D) Azure Commercial SaaS
*B) Azure Government IaaS *
Rationale: The recommended service model is Azure Government IaaS due to
its FedRAMP authorization, DoD Impact Level 5 authorization, and ability to
support FISMA and PCI DSS compliance requirements. This provides the
necessary security controls for government contracts .
8. FedRAMP authorization for Azure Government indicates:
A) It is not secure enough for government use
B) It has been authorized for use by federal agencies
C) It is only for commercial use
D) It does not meet security requirements
*B) It has been authorized for use by federal agencies *
Rationale: FedRAMP (Federal Risk and Authorization Management Program)
authorization indicates that Azure Government has met the security
requirements for use by federal agencies. This is critical for organizations with
US government contracts .
