WGU D320 MANAGING CLOUD SECURITY
QUESTIONS AND ANSWERS VERIFIED
SOLUTIONS
◉ Firewall. Answer: Filters traffic based on ACL rules. Stateful tracks
connection state; stateless matches packet headers only. NGFW adds
application awareness and IPS capability.
◉ WAF (Web Application Firewall). Answer: Protects web
applications by filtering HTTP/HTTPS traffic. Blocks OWASP Top
10 attacks (SQLi, XSS, etc.). Sits in front of web servers.
◉ IDS (Intrusion Detection System). Answer: Detects and ALERTS
on malicious traffic. Passive — does not block. Can be network-based
(NIDS) or host-based (HIDS).
◉ IPS (Intrusion Prevention System). Answer: Detects and STOPS
malicious traffic. Inline and active. Upgrade from IDS in terms of
response capability.
◉ DMZ (Demilitarized Zone). Answer: Network segment between
the internet and internal network. Hosts public-facing services (web,
email) while protecting internal resources.
,◉ Microsegmentation. Answer: Divides the network into small
isolated zones. Limits lateral movement after a breach. Core
component of Zero Trust architectures.
◉ Bastion Host. Answer: Hardened server that is the sole controlled
entry point from a lower-security zone into a higher-security zone.
◉ VPN (Virtual Private Network). Answer: Encrypts traffic over
public networks. IPSec VPN preferred for cloud uploads. Site-to-site
vs. remote access variants.
◉ Zero Trust. Answer: Never trust, always verify. No implicit trust
based on network location. Every request is authenticated and
authorized regardless of source.
◉ NIC (Network Interface Card) Teaming. Answer: Combining
multiple physical NICs into one logical interface. Provides
redundancy (failover) and increased bandwidth (load balancing).
◉ VLAN (Virtual Local Area Network). Answer: Logically segments
a physical network into separate broadcast domains without additional
hardware. Isolates sensitive systems on shared infrastructure.
◉ NACL (Network Access Control List). Answer: Stateless firewall
at the subnet level. Evaluates each packet independently against
numbered allow/deny rules. In AWS, protects entire subnets.
, ◉ NSG (Network Security Group). Answer: Stateful firewall at the
resource/instance level. Tracks connection state — return traffic
automatically permitted. Common in Azure.
◉ Hub and Spoke Network. Answer: Central hub (transit VPC or
service provider) connects to multiple spoke networks. Traffic flows
through hub for centralized security inspection.
◉ Defense in Depth. Answer: Multiple layers of security controls so
if one fails, others still protect. No single point of failure in security
posture.
◉ Air Gap. Answer: Complete physical/logical isolation from other
networks. Highest security for classified or critical systems.
◉ Egress Monitoring. Answer: Monitors outbound traffic for data
exfiltration, C2 (Command and Control) beaconing, and policy
violations.
◉ Authentication vs Authorization. Answer: Authentication = proving
who you are. Authorization = what you are allowed to do. These are
separate and sequential steps.
◉ MFA (Multi-Factor Authentication). Answer: Requires two or more
factors: something you know (password), something you have
(token), something you are (biometric).
QUESTIONS AND ANSWERS VERIFIED
SOLUTIONS
◉ Firewall. Answer: Filters traffic based on ACL rules. Stateful tracks
connection state; stateless matches packet headers only. NGFW adds
application awareness and IPS capability.
◉ WAF (Web Application Firewall). Answer: Protects web
applications by filtering HTTP/HTTPS traffic. Blocks OWASP Top
10 attacks (SQLi, XSS, etc.). Sits in front of web servers.
◉ IDS (Intrusion Detection System). Answer: Detects and ALERTS
on malicious traffic. Passive — does not block. Can be network-based
(NIDS) or host-based (HIDS).
◉ IPS (Intrusion Prevention System). Answer: Detects and STOPS
malicious traffic. Inline and active. Upgrade from IDS in terms of
response capability.
◉ DMZ (Demilitarized Zone). Answer: Network segment between
the internet and internal network. Hosts public-facing services (web,
email) while protecting internal resources.
,◉ Microsegmentation. Answer: Divides the network into small
isolated zones. Limits lateral movement after a breach. Core
component of Zero Trust architectures.
◉ Bastion Host. Answer: Hardened server that is the sole controlled
entry point from a lower-security zone into a higher-security zone.
◉ VPN (Virtual Private Network). Answer: Encrypts traffic over
public networks. IPSec VPN preferred for cloud uploads. Site-to-site
vs. remote access variants.
◉ Zero Trust. Answer: Never trust, always verify. No implicit trust
based on network location. Every request is authenticated and
authorized regardless of source.
◉ NIC (Network Interface Card) Teaming. Answer: Combining
multiple physical NICs into one logical interface. Provides
redundancy (failover) and increased bandwidth (load balancing).
◉ VLAN (Virtual Local Area Network). Answer: Logically segments
a physical network into separate broadcast domains without additional
hardware. Isolates sensitive systems on shared infrastructure.
◉ NACL (Network Access Control List). Answer: Stateless firewall
at the subnet level. Evaluates each packet independently against
numbered allow/deny rules. In AWS, protects entire subnets.
, ◉ NSG (Network Security Group). Answer: Stateful firewall at the
resource/instance level. Tracks connection state — return traffic
automatically permitted. Common in Azure.
◉ Hub and Spoke Network. Answer: Central hub (transit VPC or
service provider) connects to multiple spoke networks. Traffic flows
through hub for centralized security inspection.
◉ Defense in Depth. Answer: Multiple layers of security controls so
if one fails, others still protect. No single point of failure in security
posture.
◉ Air Gap. Answer: Complete physical/logical isolation from other
networks. Highest security for classified or critical systems.
◉ Egress Monitoring. Answer: Monitors outbound traffic for data
exfiltration, C2 (Command and Control) beaconing, and policy
violations.
◉ Authentication vs Authorization. Answer: Authentication = proving
who you are. Authorization = what you are allowed to do. These are
separate and sequential steps.
◉ MFA (Multi-Factor Authentication). Answer: Requires two or more
factors: something you know (password), something you have
(token), something you are (biometric).
