Page 1 of 107
WGU E025: Cloud and Network Security Models | Objective
Assessment (OA) EXAM QUESTIONS AND CORRECT VERIFIED
SOLUTIONS LATEST UPDATE THIS YEAR – JUST RELEASED
WGU E025: Cloud and Network Security Models | Objective Assessment (OA) Exam
10-Line Exam Coverage in Points Form
1. Core Frameworks - NIST Cloud Computing Standards (SP 800-145) define essential
characteristics: on-demand self-service, broad network access, resource pooling, rapid
elasticity, and measured service .
2. Service Models - Three primary models: IaaS (Infrastructure as a Service), PaaS (Platform
as a Service), and SaaS (Software as a Service), each with distinct consumer control
levels .
3. Deployment Models - Four deployment types: Public, Private, Community, and Hybrid
clouds, each serving different organizational needs .
4. Shared Responsibility - Security responsibilities divided between cloud provider and
customer; division varies by service model (IaaS, PaaS, SaaS) .
5. Zero Trust Architecture - Core principle: "never trust, always verify" with continuous
authentication, micro-segmentation, and least privilege access .
6. Network Security Controls - Next-Generation Firewalls (NGFW), Intrusion Prevention
Systems (IPS), VPNs, and Cloud Access Security Brokers (CASB) .
7. Identity Management - Multi-Factor Authentication (MFA), Single Sign-On (SSO),
privileged access management, and IAM policies .
8. Data Protection - Encryption (AES-256, TLS), tokenization, key management (KMS/HSM),
and Data Loss Prevention (DLP) strategies .
9. Compliance Frameworks - NIST SP 800-53/207, ISO 27001, PCI DSS, HIPAA, and
regulatory requirements for cloud security .
10. Security Operations - SIEM integration, incident response, threat detection, forensic
preservation, and Defense-in-Depth strategy .
250 MCQs with Rationales
, Page 2 of 107
1. An enterprise is migrating its legacy financial database to a public cloud environment. The
organization requires complete visibility and administrative management over the operating
system kernel and underlying network routing tables. Which cloud service model must the
administrator select?
A) Software as a Service (SaaS)
B) Platform as a Service (PaaS)
C) Infrastructure as a Service (IaaS)
D) Function as a Service (FaaS)
Answer: C
Rationale: Infrastructure as a Service provides the consumer with provisioning processing,
storage, and networks where the consumer can deploy and run arbitrary software, including
operating systems. The consumer has control over operating systems, storage, and limited
control of select networking components, while SaaS and PaaS abstract the operating system
layer away from the consumer .
2. A software development team wants to deploy a new microservices-based web application
without managing host servers, container runtimes, or operating system patches. They need
the environment to automatically scale to zero when there is no traffic. Which service model
best fits this scenario?
A) Infrastructure as a Service (IaaS)
B) Platform as a Service (PaaS)
C) Desktop as a Service (DaaS)
D) Storage as a Service (STaaS)
, Page 3 of 107
Answer: B
Rationale: Platform as a Service or serverless architectures deliver computing platforms,
runtimes, and execution tools without the overhead of managing underlying hardware,
operating systems, or scaling configurations, allowing developers to focus entirely on application
deployment and data .
3. Under the Shared Responsibility Model for a public Infrastructure as a Service (IaaS)
deployment, which security control is the sole responsibility of the cloud service provider
(CSP)?
A) Configuration of virtual machine firewalls
B) Physical security of the hypervisor host nodes
C) Patch management of the guest operating system
D) Data classification and access control policies
Answer: B
Rationale: In an IaaS model, the cloud service provider is exclusively responsible for the physical
security of data centers, facilities, environmental controls, and the physical host
hardware/hypervisor layer. The customer retains full responsibility for configuring guest
operating systems, virtual network controls, applications, and corporate data protection .
4. A cloud consumer deploys an application using a Platform as a Service (PaaS) framework.
Who is responsible for patching the underlying operating system hosting the runtime
environment, and who is responsible for configuring the application's internal data access
permissions?
, Page 4 of 107
A) CSP is responsible for both
B) Cloud consumer is responsible for both
C) Cloud consumer patches the OS; CSP configures data permissions
D) CSP patches the OS; Cloud consumer configures data permissions
Answer: D
Rationale: In a PaaS model, the cloud service provider manages and patches the underlying
infrastructure, operating system, and middleware runtimes. The cloud consumer remains
responsible for the security of their own application code, data configurations, and user access
permissions .
5. An organization establishes an internal infrastructure pool within its own data center,
utilizing automated orchestration software to provide self-service provisioning to various
internal business units. No external entities have access to these resources. Which cloud
deployment model does this describe?
A) Public Cloud
B) Community Cloud
C) Private Cloud
D) Hybrid Cloud
Answer: C
Rationale: A private cloud infrastructure is provisioned for exclusive use by a single organization
comprising multiple consumers (e.g., business units). It may be owned, managed, and operated
WGU E025: Cloud and Network Security Models | Objective
Assessment (OA) EXAM QUESTIONS AND CORRECT VERIFIED
SOLUTIONS LATEST UPDATE THIS YEAR – JUST RELEASED
WGU E025: Cloud and Network Security Models | Objective Assessment (OA) Exam
10-Line Exam Coverage in Points Form
1. Core Frameworks - NIST Cloud Computing Standards (SP 800-145) define essential
characteristics: on-demand self-service, broad network access, resource pooling, rapid
elasticity, and measured service .
2. Service Models - Three primary models: IaaS (Infrastructure as a Service), PaaS (Platform
as a Service), and SaaS (Software as a Service), each with distinct consumer control
levels .
3. Deployment Models - Four deployment types: Public, Private, Community, and Hybrid
clouds, each serving different organizational needs .
4. Shared Responsibility - Security responsibilities divided between cloud provider and
customer; division varies by service model (IaaS, PaaS, SaaS) .
5. Zero Trust Architecture - Core principle: "never trust, always verify" with continuous
authentication, micro-segmentation, and least privilege access .
6. Network Security Controls - Next-Generation Firewalls (NGFW), Intrusion Prevention
Systems (IPS), VPNs, and Cloud Access Security Brokers (CASB) .
7. Identity Management - Multi-Factor Authentication (MFA), Single Sign-On (SSO),
privileged access management, and IAM policies .
8. Data Protection - Encryption (AES-256, TLS), tokenization, key management (KMS/HSM),
and Data Loss Prevention (DLP) strategies .
9. Compliance Frameworks - NIST SP 800-53/207, ISO 27001, PCI DSS, HIPAA, and
regulatory requirements for cloud security .
10. Security Operations - SIEM integration, incident response, threat detection, forensic
preservation, and Defense-in-Depth strategy .
250 MCQs with Rationales
, Page 2 of 107
1. An enterprise is migrating its legacy financial database to a public cloud environment. The
organization requires complete visibility and administrative management over the operating
system kernel and underlying network routing tables. Which cloud service model must the
administrator select?
A) Software as a Service (SaaS)
B) Platform as a Service (PaaS)
C) Infrastructure as a Service (IaaS)
D) Function as a Service (FaaS)
Answer: C
Rationale: Infrastructure as a Service provides the consumer with provisioning processing,
storage, and networks where the consumer can deploy and run arbitrary software, including
operating systems. The consumer has control over operating systems, storage, and limited
control of select networking components, while SaaS and PaaS abstract the operating system
layer away from the consumer .
2. A software development team wants to deploy a new microservices-based web application
without managing host servers, container runtimes, or operating system patches. They need
the environment to automatically scale to zero when there is no traffic. Which service model
best fits this scenario?
A) Infrastructure as a Service (IaaS)
B) Platform as a Service (PaaS)
C) Desktop as a Service (DaaS)
D) Storage as a Service (STaaS)
, Page 3 of 107
Answer: B
Rationale: Platform as a Service or serverless architectures deliver computing platforms,
runtimes, and execution tools without the overhead of managing underlying hardware,
operating systems, or scaling configurations, allowing developers to focus entirely on application
deployment and data .
3. Under the Shared Responsibility Model for a public Infrastructure as a Service (IaaS)
deployment, which security control is the sole responsibility of the cloud service provider
(CSP)?
A) Configuration of virtual machine firewalls
B) Physical security of the hypervisor host nodes
C) Patch management of the guest operating system
D) Data classification and access control policies
Answer: B
Rationale: In an IaaS model, the cloud service provider is exclusively responsible for the physical
security of data centers, facilities, environmental controls, and the physical host
hardware/hypervisor layer. The customer retains full responsibility for configuring guest
operating systems, virtual network controls, applications, and corporate data protection .
4. A cloud consumer deploys an application using a Platform as a Service (PaaS) framework.
Who is responsible for patching the underlying operating system hosting the runtime
environment, and who is responsible for configuring the application's internal data access
permissions?
, Page 4 of 107
A) CSP is responsible for both
B) Cloud consumer is responsible for both
C) Cloud consumer patches the OS; CSP configures data permissions
D) CSP patches the OS; Cloud consumer configures data permissions
Answer: D
Rationale: In a PaaS model, the cloud service provider manages and patches the underlying
infrastructure, operating system, and middleware runtimes. The cloud consumer remains
responsible for the security of their own application code, data configurations, and user access
permissions .
5. An organization establishes an internal infrastructure pool within its own data center,
utilizing automated orchestration software to provide self-service provisioning to various
internal business units. No external entities have access to these resources. Which cloud
deployment model does this describe?
A) Public Cloud
B) Community Cloud
C) Private Cloud
D) Hybrid Cloud
Answer: C
Rationale: A private cloud infrastructure is provisioned for exclusive use by a single organization
comprising multiple consumers (e.g., business units). It may be owned, managed, and operated
