WGU COURSE CONTENT / CLOUD SECURITY
WGU D320 80 QUESTION VERSION (JYO2) LATEST (CREATED JANUARY
2026/27. D320 - MANAGING CLOUD SECURITY (WGU) ALREADY PASSED!!
2026/2027 Official Exam
A+
Complete Blueprint Coverage
A+ 5 100%
QUESTIONS VERIFIED EXAM DOMAINS COVERED RATIONALES INCLUDED
CATEGORIES
Cloud Concepts, Architecture and Shared Responsibility
Cloud Data Security and Encryption
Identity, Access and Network Security
Platform, Application and Container Security
Operations, Compliance, Incident Response and Governance
STUVIAACTUALEXAM
,SECTION 1: CLOUD CONCEPTS, ARCHITECTURE AND SHARED RESPONSIBILITY
Q1
A financial services firm is migrating its core transaction processing system to a public cloud IaaS environment. The CISO asks which
security controls remain the customer’s primary responsibility under the shared responsibility model. The correct answer is:
A. Physical security of the data center and hypervisor patching.
B. Guest operating system hardening, identity and access management, and application-level security.
C. Network backbone encryption between cloud regions only.
D. Compliance certifications for the underlying cloud infrastructure.
Correct Answer: B
Rationale:
In IaaS the cloud provider secures the physical facilities, host hardware, and hypervisor. The customer retains responsibility for the guest OS, IAM,
data, and applications running on the instances.
Q2
An organization evaluates four cloud deployment models for a regulated workload that must remain under exclusive organizational
control while still leveraging cloud elasticity. The model that best satisfies this requirement is:
A. Public cloud multi-tenant SaaS.
B. Private cloud hosted in a dedicated environment controlled by the organization or a trusted third party.
C. Community cloud shared with unrelated industry competitors.
D. Hybrid cloud with unrestricted data flow to any public region.
Correct Answer: B
Rationale:
A private cloud keeps infrastructure and data under the organization’s exclusive control, meeting regulatory isolation needs while still providing
elastic capacity.
Q3
A development team wants to deploy a custom web application without managing servers, operating systems, or runtime patching.
The cloud service model that transfers the greatest amount of infrastructure responsibility to the provider is:
A. Infrastructure as a Service (IaaS).
B. Platform as a Service (PaaS).
C. Software as a Service (SaaS).
D. Bare-metal as a Service.
Correct Answer: C
Rationale:
SaaS places the highest level of responsibility on the provider, including application code, runtime, middleware, OS, and infrastructure. The customer
mainly manages user access and data.
Q4
During an architecture review the security architect notes that a proposed multi-region active-active design will replicate customer PII
across three geographic regions. The primary cloud security concern this design raises is:
A. Increased latency for read operations.
B. Expanded data residency and cross-border transfer compliance obligations.
C. Higher cost of inter-region bandwidth only.
D. Inability to use auto-scaling groups.
Correct Answer: B
Rationale:
Replicating regulated personal data across regions can trigger data-residency, sovereignty, and cross-border transfer requirements under
frameworks such as GDPR or local privacy laws.
, WGU D320 MANAGING CLOUD SECURITY — 2026/2027
Q5
A company adopts a cloud-native microservices architecture running on managed Kubernetes. Which statement correctly describes
the shared responsibility boundary for the Kubernetes control plane when using a provider-managed service?
A. The customer must patch and upgrade the control-plane nodes monthly.
B. The provider manages the control plane availability and patching; the customer secures workloads, network policies, and RBAC
inside the cluster.
C. The customer is responsible for the etcd encryption keys only.
D. Both parties share equal responsibility for every control-plane component.
Correct Answer: B
Rationale:
In managed Kubernetes offerings the provider operates the control plane. The customer retains responsibility for cluster-level security configuration,
workload identity, and network segmentation.
Q6
An enterprise is designing a landing zone that must support both production regulated workloads and experimental developer
sandboxes. The architectural pattern that best isolates risk while allowing shared networking services is:
A. A single flat VPC with security groups only.
B. Separate accounts or subscriptions with organizational policy guardrails and shared services via transit networking.
C. One large account containing all resources with tag-based access.
D. Public internet exposure for all sandbox environments.
Correct Answer: B
Rationale:
Account/subscription isolation combined with centralized policy and transit networking provides strong blast-radius containment while still enabling
shared services.
Q7
A cloud architect must select a deployment model for a collaborative research platform used by several universities that share
common compliance requirements. The most suitable model is:
A. Public cloud open to any internet user.
B. Community cloud serving the participating institutions under shared governance.
C. Private cloud owned by a single university.
D. Hybrid cloud with unrestricted public endpoints.
Correct Answer: B
Rationale:
A community cloud is designed for a defined group of organizations with shared concerns, providing isolation from the general public while
distributing cost and governance.
Q8
When comparing the residual risk of an on-premises data center versus a major public cloud provider, the security team concludes
that the cloud provider’s physical and environmental controls are stronger. This conclusion is best supported by:
A. Marketing claims on the provider’s website.
B. Independent third-party audit reports such as SOC 2 Type II and ISO 27001 certificates covering the physical facilities.
C. The number of availability zones advertised.
D. Customer-managed encryption keys alone.
Correct Answer: B
Rationale:
Independent assurance reports provide evidence-based validation of physical and environmental controls that individual customers cannot easily
audit themselves.
WGU D320 80 QUESTION VERSION (JYO2) LATEST (CREATED JANUARY
2026/27. D320 - MANAGING CLOUD SECURITY (WGU) ALREADY PASSED!!
2026/2027 Official Exam
A+
Complete Blueprint Coverage
A+ 5 100%
QUESTIONS VERIFIED EXAM DOMAINS COVERED RATIONALES INCLUDED
CATEGORIES
Cloud Concepts, Architecture and Shared Responsibility
Cloud Data Security and Encryption
Identity, Access and Network Security
Platform, Application and Container Security
Operations, Compliance, Incident Response and Governance
STUVIAACTUALEXAM
,SECTION 1: CLOUD CONCEPTS, ARCHITECTURE AND SHARED RESPONSIBILITY
Q1
A financial services firm is migrating its core transaction processing system to a public cloud IaaS environment. The CISO asks which
security controls remain the customer’s primary responsibility under the shared responsibility model. The correct answer is:
A. Physical security of the data center and hypervisor patching.
B. Guest operating system hardening, identity and access management, and application-level security.
C. Network backbone encryption between cloud regions only.
D. Compliance certifications for the underlying cloud infrastructure.
Correct Answer: B
Rationale:
In IaaS the cloud provider secures the physical facilities, host hardware, and hypervisor. The customer retains responsibility for the guest OS, IAM,
data, and applications running on the instances.
Q2
An organization evaluates four cloud deployment models for a regulated workload that must remain under exclusive organizational
control while still leveraging cloud elasticity. The model that best satisfies this requirement is:
A. Public cloud multi-tenant SaaS.
B. Private cloud hosted in a dedicated environment controlled by the organization or a trusted third party.
C. Community cloud shared with unrelated industry competitors.
D. Hybrid cloud with unrestricted data flow to any public region.
Correct Answer: B
Rationale:
A private cloud keeps infrastructure and data under the organization’s exclusive control, meeting regulatory isolation needs while still providing
elastic capacity.
Q3
A development team wants to deploy a custom web application without managing servers, operating systems, or runtime patching.
The cloud service model that transfers the greatest amount of infrastructure responsibility to the provider is:
A. Infrastructure as a Service (IaaS).
B. Platform as a Service (PaaS).
C. Software as a Service (SaaS).
D. Bare-metal as a Service.
Correct Answer: C
Rationale:
SaaS places the highest level of responsibility on the provider, including application code, runtime, middleware, OS, and infrastructure. The customer
mainly manages user access and data.
Q4
During an architecture review the security architect notes that a proposed multi-region active-active design will replicate customer PII
across three geographic regions. The primary cloud security concern this design raises is:
A. Increased latency for read operations.
B. Expanded data residency and cross-border transfer compliance obligations.
C. Higher cost of inter-region bandwidth only.
D. Inability to use auto-scaling groups.
Correct Answer: B
Rationale:
Replicating regulated personal data across regions can trigger data-residency, sovereignty, and cross-border transfer requirements under
frameworks such as GDPR or local privacy laws.
, WGU D320 MANAGING CLOUD SECURITY — 2026/2027
Q5
A company adopts a cloud-native microservices architecture running on managed Kubernetes. Which statement correctly describes
the shared responsibility boundary for the Kubernetes control plane when using a provider-managed service?
A. The customer must patch and upgrade the control-plane nodes monthly.
B. The provider manages the control plane availability and patching; the customer secures workloads, network policies, and RBAC
inside the cluster.
C. The customer is responsible for the etcd encryption keys only.
D. Both parties share equal responsibility for every control-plane component.
Correct Answer: B
Rationale:
In managed Kubernetes offerings the provider operates the control plane. The customer retains responsibility for cluster-level security configuration,
workload identity, and network segmentation.
Q6
An enterprise is designing a landing zone that must support both production regulated workloads and experimental developer
sandboxes. The architectural pattern that best isolates risk while allowing shared networking services is:
A. A single flat VPC with security groups only.
B. Separate accounts or subscriptions with organizational policy guardrails and shared services via transit networking.
C. One large account containing all resources with tag-based access.
D. Public internet exposure for all sandbox environments.
Correct Answer: B
Rationale:
Account/subscription isolation combined with centralized policy and transit networking provides strong blast-radius containment while still enabling
shared services.
Q7
A cloud architect must select a deployment model for a collaborative research platform used by several universities that share
common compliance requirements. The most suitable model is:
A. Public cloud open to any internet user.
B. Community cloud serving the participating institutions under shared governance.
C. Private cloud owned by a single university.
D. Hybrid cloud with unrestricted public endpoints.
Correct Answer: B
Rationale:
A community cloud is designed for a defined group of organizations with shared concerns, providing isolation from the general public while
distributing cost and governance.
Q8
When comparing the residual risk of an on-premises data center versus a major public cloud provider, the security team concludes
that the cloud provider’s physical and environmental controls are stronger. This conclusion is best supported by:
A. Marketing claims on the provider’s website.
B. Independent third-party audit reports such as SOC 2 Type II and ISO 27001 certificates covering the physical facilities.
C. The number of availability zones advertised.
D. Customer-managed encryption keys alone.
Correct Answer: B
Rationale:
Independent assurance reports provide evidence-based validation of physical and environmental controls that individual customers cannot easily
audit themselves.
