C838 - Managing Cloud Security Final OA | CCSP-aligned | 2026/2027 Edition Page 1
C838 – MANAGING CLOUD SECURITY FINAL OA!
QUESTIONS WITH COMPLETE SOLUTIONS | 2026 /
2027 EDITION
Aligned with WGU C838 Managing Cloud Security (CCSP) Curriculum • CCSP Common Body of Knowledge
(CBK) • Cloud Security Alliance (CSA) Security Guidance
Total Questions: 125 • Format: Multiple Choice (A–D, ONE correct) • Cognitive Mix: 20% Recall / 50% Application / 30% Analysis •
Includes 15 scenario-based, 15 shared-responsibility, and 10 encryption/KMS/tokenization items
This examination assesses mastery of WGU C838 Managing Cloud Security, aligned to the CCSP Common Body of Knowledge
(CBK) and Cloud Security Alliance (CSA) Security Guidance. It contains 125 multiple-choice questions distributed across eight
domains: Cloud Architecture & Governance (Q1–Q20), Data Security & Encryption (Q21–Q40), Platform & Infrastructure
(Q41–Q55), Application Security (Q56–Q70), Security Operations (Q71–Q85), Identity & Access Management (Q86–Q100), Risk &
Compliance (Q101–Q115), and BC/DR & Incident Response (Q116–Q125). Each question includes four options (A–D), the marked
correct answer with [CORRECT], and a 2–4 sentence rationale grounded in the shared responsibility model, CCSP CBK, and CSA
guidance. Cognitive distribution: 20% recall, 50% application, 30% analysis (including 15 scenario-based items).
Section 1: Cloud Architecture, Design, & Governance
Q1 – Q20 • 20 questions
Q1: A financial services firm is migrating regulated workloads to a cloud provider that provisions a dedicated,
single-tenant environment on shared physical infrastructure. Which deployment model best characterizes this
arrangement?
A. Private cloud using dedicated single-tenant hardware on shared infrastructure [CORRECT]
B. Public cloud with isolated VPC peering
C. Private cloud with virtualized isolation only
D. Community cloud serving multiple regulated tenants
Correct Answer: A
Rationale: A private cloud with dedicated single-tenant hardware on shared infrastructure reflects the WGU C838 definition of a
private deployment model where the underlying physical resources are isolated for one organization, even if the broader facility is
shared. Option A describes a public cloud with logical isolation, which does not satisfy single-tenant requirements. Option B lacks
dedicated hardware. Option C would imply multiple organizations sharing the cloud, not the single-tenant firm described.
Q2: Under the shared responsibility model, which of the following is ALWAYS the responsibility of the cloud
customer regardless of service model (IaaS, PaaS, or SaaS)?
A. Data classification and identity governance over users [CORRECT]
B. Patching the hypervisor and host OS
C. Physical security of the data center and network switches
D. Maintaining the runtime, middleware, and platform stack
Correct Answer: A
Rationale: The CCSP CBK and WGU C838 both emphasize that data and identity are the customer’s responsibility across all service
models. Even in SaaS, the customer owns account governance, data classification, and access decisions. Hypervisor patching (A),
physical security (C), and the platform stack (D) shift to the provider as you move from IaaS toward SaaS.
Western Governors University | College of IT | CCSP CBK + CSA Security Guidance v5
,C838 - Managing Cloud Security Final OA | CCSP-aligned | 2026/2027 Edition Page 2
Q3: A SaaS customer wants to enforce deletion of their data so that even the provider cannot recover it. The
provider offers encryption-at-rest with customer-managed keys. Which technique delivers verifiable
cryptographic destruction?
A. Crypto-shredding by destroying the customer-managed encryption key [CORRECT]
B. Logical deletion via a soft-delete flag in the application database
C. Overwriting the disk sectors with random data three times
D. Relying on the provider’s default 30-day recycle bin purge
Correct Answer: A
Rationale: Crypto-shredding renders encrypted data unrecoverable by destroying the wrapping key, which is the CSA-recommended
approach for verifiable data disposal in cloud environments. Soft-delete (B) leaves recoverable data, disk overwriting (C) is infeasible
because the customer never has direct media access in SaaS, and the recycle bin (D) is a process control, not a cryptographic guarantee.
Q4: Which NIST-defined essential cloud characteristic MOST directly enables measured service and supports
usage-based billing?
A. On-demand self-service B. Broad network access
C. Resource pooling [CORRECT] D. Rapid elasticity
Correct Answer: C
Rationale: Resource pooling underlies multi-tenant metering because the provider abstracts and measures resource consumption across
tenants, which is then translated into billable usage. Self-service (A), broad network access (B), and elasticity (D) are also essential
characteristics, but metering depends on pooling and abstraction. NIST SP 800-145 and WGU C838 list resource pooling as the basis
for usage accounting.
Q5: An organization adopts a hybrid cloud architecture where sensitive customer PII stays on-premises while
analytics workloads burst into a public cloud. Which design principle is being applied?
A. Data gravity separation [CORRECT] B. Vendor lock-in avoidance
C. Cloud repatriation D. Multi-cloud federation
Correct Answer: A
Rationale: Placing data according to its sensitivity and processing proximity reflects data gravity separation, where heavy/sensitive data
remains near its controls while compute bursts out. Vendor lock-in avoidance (A) involves abstraction layers; repatriation (C) is the
reverse migration back on-premises; multi-cloud (D) implies multiple public providers, not hybrid.
Q6: A CCSP candidate is asked to map responsibilities for OS hardening in an IaaS deployment. Who holds
primary accountability for OS-level patching and configuration baselines?
A. Cloud customer, because they control the B. Cloud provider, because they own the
guest OS [CORRECT] hypervisor
C. Shared equally with no clear owner D. Third-party managed security provider
(MSSP) by default
Correct Answer: A
Rationale: In IaaS, the provider secures the infrastructure (hypervisor, network, storage), while the customer owns and patches the guest
OS per the shared responsibility model. Option A confuses hypervisor responsibility with OS responsibility. C violates accountability
clarity, and D is incorrect because an MSSP is an optional delegation, not the default owner.
Western Governors University | College of IT | CCSP CBK + CSA Security Guidance v5
,C838 - Managing Cloud Security Final OA | CCSP-aligned | 2026/2027 Edition Page 3
Q7: Which cloud reference architecture, formally adopted by ISO/IEC, defines the roles, activities, and
functional components of cloud computing including cloud service customer, provider, and partner?
A. ISO/IEC 27017 B. ISO/IEC 17789 (cloud computing
reference architecture) [CORRECT]
C. NIST SP 500-299 D. CSA Enterprise Architecture
Correct Answer: B
Rationale: ISO/IEC 17789 specifies the cloud computing reference architecture defining the cloud service customer, provider, and
partner roles plus cross-cutting activities. ISO 27017 (A) covers cloud security controls, NIST 500-299 (C) is the NIST cloud security
reference, and CSA EA (D) is an industry framework, not the formal ISO reference.
Q8: In a SaaS email service, which responsibility properly remains with the cloud customer?
A. Maintaining the mail transport agents (MTAs)
B. Patching the underlying database engine
C. Configuring mailbox-level access and data loss prevention policies [CORRECT]
D. Securing the hypervisor and SAN
Correct Answer: C
Rationale: In SaaS, the customer retains control over tenant configuration, user access, mailbox permissions, and DLP policy at the
application layer. MTAs (A), the database engine (B), and hypervisor/SAN (D) are provider responsibilities. This is a classic
shared-responsibility scenario emphasized in WGU C838.
Q9: A retail company uses one public cloud for production web tier and a second public cloud for DR
replication. What architectural pattern is this, and what is its primary security benefit?
A. Hybrid cloud; lower latency B. Community cloud; shared compliance
posture
C. Private cloud; greater physical isolation D. Multi-cloud; reduces single-provider
concentration risk [CORRECT]
Correct Answer: D
Rationale: Using two public cloud providers is a multi-cloud pattern that mitigates provider-specific outages or compromise, addressing
concentration/vendor lock-in risk. Hybrid (A) mixes on-premises with cloud; community (C) serves a shared industry vertical; private
(D) implies single-tenant ownership.
Q10: A startup runs a multi-tenant SaaS application on a PaaS platform. The startup inherits which security
control set from the PaaS provider?
A. Application source code review B. End-user identity provisioning
C. Customer data classification D. Runtime, middleware, OS, and hypervisor
patching [CORRECT]
Correct Answer: D
Rationale: On PaaS, the provider manages runtime, middleware, OS, and hypervisor; the customer (the SaaS startup) is still responsible
for its own application code, customer data, and identity. Option A and D remain customer duties, and end-user identity provisioning
(C) is the customer’s application-layer responsibility. The CCSP CBK places OS/runtime under the PaaS provider.
Western Governors University | College of IT | CCSP CBK + CSA Security Guidance v5
, C838 - Managing Cloud Security Final OA | CCSP-aligned | 2026/2027 Edition Page 4
Q11: Which statement BEST describes the difference between broad network access and on-demand self-service
in NIST’s cloud characteristics?
A. Broad network access means access over the network using standard mechanisms; self-service means
consumers can provision capabilities without provider interaction [CORRECT]
B. Broad network access means consumer provisioning; self-service means Internet access
C. They are the same characteristic described differently
D. Broad network access applies only to private clouds; self-service applies only to public clouds
Correct Answer: A
Rationale: NIST SP 800-145 distinguishes broad network access (access via standard network mechanisms from heterogeneous clients)
from on-demand self-service (consumers provision capabilities unilaterally without human interaction with the provider). They are
distinct characteristics and apply across deployment models.
Q12: A regulated bank evaluates a community cloud shared with peer institutions and a common auditor. Which
governance artifact MOST effectively aligns cloud operations with shared compliance obligations?
A. A shared SOC 2 Type I report only
B. A bilateral NDA between any two members
C. A multi-party cloud customer agreement with joint audit rights and shared control inheritance
documentation [CORRECT]
D. A vendor risk questionnaire distributed annually
Correct Answer: C
Rationale: Community clouds require a multi-party customer agreement that codifies joint audit rights, shared control inheritance, and
dispute resolution among peers, reflecting the WGU C838 governance emphasis. A Type I report alone (A) is point-in-time and does not
address joint governance; an NDA (C) is insufficient for operational controls; an annual questionnaire (D) is too shallow for shared
operations.
Q13: In the shared responsibility model for IaaS, who is accountable for managing network ACLs and security
groups on virtual network interfaces?
A. Cloud provider only
B. Cloud customer only
C. Third-party firewall vendor exclusively
D. Customer configures; provider enforces the underlying network virtualization [CORRECT]
Correct Answer: D
Rationale: The customer configures security groups and ACLs at the tenant level, while the provider enforces them through the
underlying virtualized network fabric. Option B ignores provider enforcement; A wrongly removes customer responsibility; D is not the
default model. WGU C838 frames this as a shared operational control.
Q14: A healthcare organization wants to migrate an EHR system to the cloud but must satisfy HIPAA. They
choose a BAA-covered SaaS EHR provider. Which residual responsibility is the customer’s?
A. Encryption of database at rest
B. Maintenance of the EHR application code
C. Operating system hardening of the EHR servers
D. Configuration of role-based access to PHI and audit log review [CORRECT]
Correct Answer: D
Rationale: Even with a BAA-covered SaaS, the covered entity remains responsible for user access control to PHI, audit log review, and
workforce sanctions per HIPAA Security Rule. Encryption (A), app code (B), and OS hardening (D) are provider responsibilities in
SaaS. The CCSP CBK emphasizes that BAA coverage does not transfer identity and access governance.
Western Governors University | College of IT | CCSP CBK + CSA Security Guidance v5
C838 – MANAGING CLOUD SECURITY FINAL OA!
QUESTIONS WITH COMPLETE SOLUTIONS | 2026 /
2027 EDITION
Aligned with WGU C838 Managing Cloud Security (CCSP) Curriculum • CCSP Common Body of Knowledge
(CBK) • Cloud Security Alliance (CSA) Security Guidance
Total Questions: 125 • Format: Multiple Choice (A–D, ONE correct) • Cognitive Mix: 20% Recall / 50% Application / 30% Analysis •
Includes 15 scenario-based, 15 shared-responsibility, and 10 encryption/KMS/tokenization items
This examination assesses mastery of WGU C838 Managing Cloud Security, aligned to the CCSP Common Body of Knowledge
(CBK) and Cloud Security Alliance (CSA) Security Guidance. It contains 125 multiple-choice questions distributed across eight
domains: Cloud Architecture & Governance (Q1–Q20), Data Security & Encryption (Q21–Q40), Platform & Infrastructure
(Q41–Q55), Application Security (Q56–Q70), Security Operations (Q71–Q85), Identity & Access Management (Q86–Q100), Risk &
Compliance (Q101–Q115), and BC/DR & Incident Response (Q116–Q125). Each question includes four options (A–D), the marked
correct answer with [CORRECT], and a 2–4 sentence rationale grounded in the shared responsibility model, CCSP CBK, and CSA
guidance. Cognitive distribution: 20% recall, 50% application, 30% analysis (including 15 scenario-based items).
Section 1: Cloud Architecture, Design, & Governance
Q1 – Q20 • 20 questions
Q1: A financial services firm is migrating regulated workloads to a cloud provider that provisions a dedicated,
single-tenant environment on shared physical infrastructure. Which deployment model best characterizes this
arrangement?
A. Private cloud using dedicated single-tenant hardware on shared infrastructure [CORRECT]
B. Public cloud with isolated VPC peering
C. Private cloud with virtualized isolation only
D. Community cloud serving multiple regulated tenants
Correct Answer: A
Rationale: A private cloud with dedicated single-tenant hardware on shared infrastructure reflects the WGU C838 definition of a
private deployment model where the underlying physical resources are isolated for one organization, even if the broader facility is
shared. Option A describes a public cloud with logical isolation, which does not satisfy single-tenant requirements. Option B lacks
dedicated hardware. Option C would imply multiple organizations sharing the cloud, not the single-tenant firm described.
Q2: Under the shared responsibility model, which of the following is ALWAYS the responsibility of the cloud
customer regardless of service model (IaaS, PaaS, or SaaS)?
A. Data classification and identity governance over users [CORRECT]
B. Patching the hypervisor and host OS
C. Physical security of the data center and network switches
D. Maintaining the runtime, middleware, and platform stack
Correct Answer: A
Rationale: The CCSP CBK and WGU C838 both emphasize that data and identity are the customer’s responsibility across all service
models. Even in SaaS, the customer owns account governance, data classification, and access decisions. Hypervisor patching (A),
physical security (C), and the platform stack (D) shift to the provider as you move from IaaS toward SaaS.
Western Governors University | College of IT | CCSP CBK + CSA Security Guidance v5
,C838 - Managing Cloud Security Final OA | CCSP-aligned | 2026/2027 Edition Page 2
Q3: A SaaS customer wants to enforce deletion of their data so that even the provider cannot recover it. The
provider offers encryption-at-rest with customer-managed keys. Which technique delivers verifiable
cryptographic destruction?
A. Crypto-shredding by destroying the customer-managed encryption key [CORRECT]
B. Logical deletion via a soft-delete flag in the application database
C. Overwriting the disk sectors with random data three times
D. Relying on the provider’s default 30-day recycle bin purge
Correct Answer: A
Rationale: Crypto-shredding renders encrypted data unrecoverable by destroying the wrapping key, which is the CSA-recommended
approach for verifiable data disposal in cloud environments. Soft-delete (B) leaves recoverable data, disk overwriting (C) is infeasible
because the customer never has direct media access in SaaS, and the recycle bin (D) is a process control, not a cryptographic guarantee.
Q4: Which NIST-defined essential cloud characteristic MOST directly enables measured service and supports
usage-based billing?
A. On-demand self-service B. Broad network access
C. Resource pooling [CORRECT] D. Rapid elasticity
Correct Answer: C
Rationale: Resource pooling underlies multi-tenant metering because the provider abstracts and measures resource consumption across
tenants, which is then translated into billable usage. Self-service (A), broad network access (B), and elasticity (D) are also essential
characteristics, but metering depends on pooling and abstraction. NIST SP 800-145 and WGU C838 list resource pooling as the basis
for usage accounting.
Q5: An organization adopts a hybrid cloud architecture where sensitive customer PII stays on-premises while
analytics workloads burst into a public cloud. Which design principle is being applied?
A. Data gravity separation [CORRECT] B. Vendor lock-in avoidance
C. Cloud repatriation D. Multi-cloud federation
Correct Answer: A
Rationale: Placing data according to its sensitivity and processing proximity reflects data gravity separation, where heavy/sensitive data
remains near its controls while compute bursts out. Vendor lock-in avoidance (A) involves abstraction layers; repatriation (C) is the
reverse migration back on-premises; multi-cloud (D) implies multiple public providers, not hybrid.
Q6: A CCSP candidate is asked to map responsibilities for OS hardening in an IaaS deployment. Who holds
primary accountability for OS-level patching and configuration baselines?
A. Cloud customer, because they control the B. Cloud provider, because they own the
guest OS [CORRECT] hypervisor
C. Shared equally with no clear owner D. Third-party managed security provider
(MSSP) by default
Correct Answer: A
Rationale: In IaaS, the provider secures the infrastructure (hypervisor, network, storage), while the customer owns and patches the guest
OS per the shared responsibility model. Option A confuses hypervisor responsibility with OS responsibility. C violates accountability
clarity, and D is incorrect because an MSSP is an optional delegation, not the default owner.
Western Governors University | College of IT | CCSP CBK + CSA Security Guidance v5
,C838 - Managing Cloud Security Final OA | CCSP-aligned | 2026/2027 Edition Page 3
Q7: Which cloud reference architecture, formally adopted by ISO/IEC, defines the roles, activities, and
functional components of cloud computing including cloud service customer, provider, and partner?
A. ISO/IEC 27017 B. ISO/IEC 17789 (cloud computing
reference architecture) [CORRECT]
C. NIST SP 500-299 D. CSA Enterprise Architecture
Correct Answer: B
Rationale: ISO/IEC 17789 specifies the cloud computing reference architecture defining the cloud service customer, provider, and
partner roles plus cross-cutting activities. ISO 27017 (A) covers cloud security controls, NIST 500-299 (C) is the NIST cloud security
reference, and CSA EA (D) is an industry framework, not the formal ISO reference.
Q8: In a SaaS email service, which responsibility properly remains with the cloud customer?
A. Maintaining the mail transport agents (MTAs)
B. Patching the underlying database engine
C. Configuring mailbox-level access and data loss prevention policies [CORRECT]
D. Securing the hypervisor and SAN
Correct Answer: C
Rationale: In SaaS, the customer retains control over tenant configuration, user access, mailbox permissions, and DLP policy at the
application layer. MTAs (A), the database engine (B), and hypervisor/SAN (D) are provider responsibilities. This is a classic
shared-responsibility scenario emphasized in WGU C838.
Q9: A retail company uses one public cloud for production web tier and a second public cloud for DR
replication. What architectural pattern is this, and what is its primary security benefit?
A. Hybrid cloud; lower latency B. Community cloud; shared compliance
posture
C. Private cloud; greater physical isolation D. Multi-cloud; reduces single-provider
concentration risk [CORRECT]
Correct Answer: D
Rationale: Using two public cloud providers is a multi-cloud pattern that mitigates provider-specific outages or compromise, addressing
concentration/vendor lock-in risk. Hybrid (A) mixes on-premises with cloud; community (C) serves a shared industry vertical; private
(D) implies single-tenant ownership.
Q10: A startup runs a multi-tenant SaaS application on a PaaS platform. The startup inherits which security
control set from the PaaS provider?
A. Application source code review B. End-user identity provisioning
C. Customer data classification D. Runtime, middleware, OS, and hypervisor
patching [CORRECT]
Correct Answer: D
Rationale: On PaaS, the provider manages runtime, middleware, OS, and hypervisor; the customer (the SaaS startup) is still responsible
for its own application code, customer data, and identity. Option A and D remain customer duties, and end-user identity provisioning
(C) is the customer’s application-layer responsibility. The CCSP CBK places OS/runtime under the PaaS provider.
Western Governors University | College of IT | CCSP CBK + CSA Security Guidance v5
, C838 - Managing Cloud Security Final OA | CCSP-aligned | 2026/2027 Edition Page 4
Q11: Which statement BEST describes the difference between broad network access and on-demand self-service
in NIST’s cloud characteristics?
A. Broad network access means access over the network using standard mechanisms; self-service means
consumers can provision capabilities without provider interaction [CORRECT]
B. Broad network access means consumer provisioning; self-service means Internet access
C. They are the same characteristic described differently
D. Broad network access applies only to private clouds; self-service applies only to public clouds
Correct Answer: A
Rationale: NIST SP 800-145 distinguishes broad network access (access via standard network mechanisms from heterogeneous clients)
from on-demand self-service (consumers provision capabilities unilaterally without human interaction with the provider). They are
distinct characteristics and apply across deployment models.
Q12: A regulated bank evaluates a community cloud shared with peer institutions and a common auditor. Which
governance artifact MOST effectively aligns cloud operations with shared compliance obligations?
A. A shared SOC 2 Type I report only
B. A bilateral NDA between any two members
C. A multi-party cloud customer agreement with joint audit rights and shared control inheritance
documentation [CORRECT]
D. A vendor risk questionnaire distributed annually
Correct Answer: C
Rationale: Community clouds require a multi-party customer agreement that codifies joint audit rights, shared control inheritance, and
dispute resolution among peers, reflecting the WGU C838 governance emphasis. A Type I report alone (A) is point-in-time and does not
address joint governance; an NDA (C) is insufficient for operational controls; an annual questionnaire (D) is too shallow for shared
operations.
Q13: In the shared responsibility model for IaaS, who is accountable for managing network ACLs and security
groups on virtual network interfaces?
A. Cloud provider only
B. Cloud customer only
C. Third-party firewall vendor exclusively
D. Customer configures; provider enforces the underlying network virtualization [CORRECT]
Correct Answer: D
Rationale: The customer configures security groups and ACLs at the tenant level, while the provider enforces them through the
underlying virtualized network fabric. Option B ignores provider enforcement; A wrongly removes customer responsibility; D is not the
default model. WGU C838 frames this as a shared operational control.
Q14: A healthcare organization wants to migrate an EHR system to the cloud but must satisfy HIPAA. They
choose a BAA-covered SaaS EHR provider. Which residual responsibility is the customer’s?
A. Encryption of database at rest
B. Maintenance of the EHR application code
C. Operating system hardening of the EHR servers
D. Configuration of role-based access to PHI and audit log review [CORRECT]
Correct Answer: D
Rationale: Even with a BAA-covered SaaS, the covered entity remains responsible for user access control to PHI, audit log review, and
workforce sanctions per HIPAA Security Rule. Encryption (A), app code (B), and OS hardening (D) are provider responsibilities in
SaaS. The CCSP CBK emphasizes that BAA coverage does not transfer identity and access governance.
Western Governors University | College of IT | CCSP CBK + CSA Security Guidance v5
