Managing Cloud Security D320 OA Newest Prep
Test Bank 1 with 350 Questions and Correct
Answers/ WGU D320 Managing Cloud Security/
D320 OA and PA Prep Test Bank 1 (2026-2027)
Which one of the following is not a law that would concern cloud security
professionals?
A. GLBA
B. HIPAA
C. PCI DSS
D. SOX
C
A manager is made aware of a customer complaint about how an application
developed by the company collects personal and environmental information from
the devices it is installed on.
Which document should the manager refer to in order to determine if the company
has properly disclosed information about what data it collects from this
application's users?
A) Retention policy
B) Breach notification
C) Privacy notice
D) Denial of service
C
An organization needs to store passwords in a database securely. The data should
not be available to system administrators.
Which technique should the organization use?
1
,A) Encryption
B) Hashing
C) Encoding
D) Masking
B
A company is looking to ensure that the names of individuals in its data in the
cloud are not revealed in the event of a data breach, as the data is sensitive and
classified.
Which data masking technique should the company use to prevent attackers from
identifying individuals in the event of a data breach?
A) Crypto-shredding
B) Degaussing
C) Anonymization
D) Randomization
C
What standard governs SOC audits that occur within the United States?
A. SSAE 16
B. SSAE 18
C. ISAE 3402
D. ISAE 3602
B
You are considering working with a cloud provider and would like to review the
results of an audit that contains detailed information on security controls. The
provider requires that you sign an NDA before reviewing the material. What
category of report are you likely reviewing?
A. SOC 1
B. SOC 2
C. SOC 3
D. SOC 4
2
,B
Jen identified a missing patch on a Windows server that might allow an attacker to
gain remote control of the system. After consulting with her manager, she applied
the patch. From a risk management perspective, what has she done?
A. Removed the threat
B. Reduced the threat
C. Removed the vulnerability
D. Reduced the vulnerability
C
You notice a high number of SQL injection attacks against a web application run
by your organization, so you install a web application firewall to block many of
these attacks before they reach the server. How have you altered the severity of this
risk?
A. Reduced the magnitude
B. Eliminated the vulnerability
C. Reduced the probability
D. Eliminated the threat
C
Aziz is responsible for the administration of an e-commerce website that generates
$100,000 per day in revenue for his firm. The website uses a database that contains
sensitive information about the firm's customers.
Aziz is assessing the risk of a denial-of-service attack against the database where
the attacker would destroy the data contained within the database. He expects that
it would cost approximately $500,000 to reconstruct the database from existing
records. After consulting threat intelligence, he believes that there is a 5 percent
chance of a successful attack in any given year.
What is the asset value (AV)?
A. $5,000
B. $100,000
3
, C. $500,000
D. $600,000
C
Aziz is responsible for the administration of an e-commerce website that generates
$100,000 per day in revenue for his firm. The website uses a database that contains
sensitive information about the firm's customers.
Aziz is assessing the risk of a denial-of-service attack against the database where
the attacker would destroy the data contained within the database. He expects that
it would cost approximately $500,000 to reconstruct the database from existing
records. After consulting threat intelligence, he believes that there is a 5 percent
chance of a successful attack in any given year.
What is the exposure factor (EF)?
A. 5 percent
B. 20 percent
C. 50 percent
D. 100 percent
D
Aziz is responsible for the administration of an e-commerce website that generates
$100,000 per day in revenue for his firm. The website uses a database that contains
sensitive information about the firm's customers.
Aziz is assessing the risk of a denial-of-service attack against the database where
the attacker would destroy the data contained within the database. He expects that
it would cost approximately $500,000 to reconstruct the database from existing
records. After consulting threat intelligence, he believes that there is a 5 percent
chance of a successful attack in any given year.
What is the single loss expectancy (SLE)?
A. $5,000
B. $100,000
4
Test Bank 1 with 350 Questions and Correct
Answers/ WGU D320 Managing Cloud Security/
D320 OA and PA Prep Test Bank 1 (2026-2027)
Which one of the following is not a law that would concern cloud security
professionals?
A. GLBA
B. HIPAA
C. PCI DSS
D. SOX
C
A manager is made aware of a customer complaint about how an application
developed by the company collects personal and environmental information from
the devices it is installed on.
Which document should the manager refer to in order to determine if the company
has properly disclosed information about what data it collects from this
application's users?
A) Retention policy
B) Breach notification
C) Privacy notice
D) Denial of service
C
An organization needs to store passwords in a database securely. The data should
not be available to system administrators.
Which technique should the organization use?
1
,A) Encryption
B) Hashing
C) Encoding
D) Masking
B
A company is looking to ensure that the names of individuals in its data in the
cloud are not revealed in the event of a data breach, as the data is sensitive and
classified.
Which data masking technique should the company use to prevent attackers from
identifying individuals in the event of a data breach?
A) Crypto-shredding
B) Degaussing
C) Anonymization
D) Randomization
C
What standard governs SOC audits that occur within the United States?
A. SSAE 16
B. SSAE 18
C. ISAE 3402
D. ISAE 3602
B
You are considering working with a cloud provider and would like to review the
results of an audit that contains detailed information on security controls. The
provider requires that you sign an NDA before reviewing the material. What
category of report are you likely reviewing?
A. SOC 1
B. SOC 2
C. SOC 3
D. SOC 4
2
,B
Jen identified a missing patch on a Windows server that might allow an attacker to
gain remote control of the system. After consulting with her manager, she applied
the patch. From a risk management perspective, what has she done?
A. Removed the threat
B. Reduced the threat
C. Removed the vulnerability
D. Reduced the vulnerability
C
You notice a high number of SQL injection attacks against a web application run
by your organization, so you install a web application firewall to block many of
these attacks before they reach the server. How have you altered the severity of this
risk?
A. Reduced the magnitude
B. Eliminated the vulnerability
C. Reduced the probability
D. Eliminated the threat
C
Aziz is responsible for the administration of an e-commerce website that generates
$100,000 per day in revenue for his firm. The website uses a database that contains
sensitive information about the firm's customers.
Aziz is assessing the risk of a denial-of-service attack against the database where
the attacker would destroy the data contained within the database. He expects that
it would cost approximately $500,000 to reconstruct the database from existing
records. After consulting threat intelligence, he believes that there is a 5 percent
chance of a successful attack in any given year.
What is the asset value (AV)?
A. $5,000
B. $100,000
3
, C. $500,000
D. $600,000
C
Aziz is responsible for the administration of an e-commerce website that generates
$100,000 per day in revenue for his firm. The website uses a database that contains
sensitive information about the firm's customers.
Aziz is assessing the risk of a denial-of-service attack against the database where
the attacker would destroy the data contained within the database. He expects that
it would cost approximately $500,000 to reconstruct the database from existing
records. After consulting threat intelligence, he believes that there is a 5 percent
chance of a successful attack in any given year.
What is the exposure factor (EF)?
A. 5 percent
B. 20 percent
C. 50 percent
D. 100 percent
D
Aziz is responsible for the administration of an e-commerce website that generates
$100,000 per day in revenue for his firm. The website uses a database that contains
sensitive information about the firm's customers.
Aziz is assessing the risk of a denial-of-service attack against the database where
the attacker would destroy the data contained within the database. He expects that
it would cost approximately $500,000 to reconstruct the database from existing
records. After consulting threat intelligence, he believes that there is a 5 percent
chance of a successful attack in any given year.
What is the single loss expectancy (SLE)?
A. $5,000
B. $100,000
4
