WGU D320 · YJ02 · EXAM PREP
Managing Cloud Security
80 Practice Questions and Study Guide
Update
80 Questions 6 Sections Scenario-Based Full Rationales
NIST · CSA · ISO
Aligned to the WGU D320 (YJ02) competency blueprint and current 2026-2027 cloud security
standards. Coverage spans cloud computing fundamentals and governance, cloud security
architecture and design, identity and data protection, risk and compliance, operations and incident
response, and emerging trends including Zero Trust, confidential computing, CNAPP, and SASE.
WGU D320 · Managing Cloud Security · YJ02 Edition
,WGU D320 Managing Cloud Security (YJ02) | 80 Practice Questions | 2026/2027
WGU D320: Managing Cloud Security (YJ02)
80 Practice Questions and Study Guide - 2026/2027 Update
Aligned to the WGU D320 (YJ02) competency blueprint and current 2026-2027 cloud security standards, including NIST SP
800-145, NIST SP 800-207 (Zero Trust), CSA Security Guidance v4, ISO/IEC 27017/27018/27701, FedRAMP Rev 5, and the
EU-U.S. Data Privacy Framework.
Cognitive Level Target % Approximate Count
Recall / Terminology 25% ~20 questions
Application / Scenario 55% ~44 questions
Analysis / Judgment 20% ~16 questions
Question style: 80% scenario-based, 20% direct recall. Each question has exactly four options (A-D) with one correct answer
marked [CORRECT]. Rationales explain why the correct answer is right and why each distractor is wrong, citing applicable NIST,
CSA, ISO, and regulatory references.
Section 1: Cloud Computing Fundamentals and Governance
Cloud Models, Service Models, Deployment Models, and Cloud Strategy
Questions: Q1 - Q15
Q1. An organization is evaluating whether a proposed service offering qualifies as true cloud computing under
NIST SP 800-145. Which set of five essential characteristics must the service exhibit to be considered a cloud
service?
A. Multi-tenancy, virtualization, automation, orchestration, and self-service
B. On-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service
[CORRECT]
C. High availability, disaster recovery, encryption, identity management, and audit logging
D. Containerization, microservices, API gateways, CI/CD pipelines, and serverless computing
Correct Answer: B
Rationale:
NIST SP 800-145 defines cloud computing by five essential characteristics: on-demand self-service, broad network
access, resource pooling, rapid elasticity, and measured service. The other options describe implementation patterns or
supporting technologies (virtualization, microservices, security controls) that may be present but are not the defining
characteristics per NIST. A service missing any of the five NIST characteristics should not be marketed as cloud
computing per WGU D320 governance guidance.
WGU D320 - 2026/2027 Update - Study Guide Page 1
,WGU D320 Managing Cloud Security (YJ02) | 80 Practice Questions | 2026/2027
Q2. A cloud consumer provisions a new web server through a self-service portal at 2 a.m. without contacting
the provider's support team. Which NIST essential characteristic is being demonstrated?
A. Measured service
B. Resource pooling
C. Broad network access
D. On-demand self-service [CORRECT]
Correct Answer: D
Rationale:
On-demand self-service allows a consumer to unilaterally provision computing capabilities such as server time and
network storage without requiring human interaction with the provider. Resource pooling refers to multi-tenant resource
sharing, broad network access relates to access over the network through standard mechanisms, and measured service
refers to metered usage billing. The 2 a.m. self-service provisioning with no provider involvement is the textbook NIST
indicator of on-demand self-service.
Q3. A SaaS provider serves multiple customers from the same physical infrastructure, dynamically assigning
CPU and memory based on each tenant's load. Customers do not know or control the exact physical location of
their data. Which NIST characteristic best describes this?
A. Resource pooling [CORRECT]
B. Measured service
C. Broad network access
D. Rapid elasticity
Correct Answer: A
Rationale:
Resource pooling means the provider's computing resources are pooled to serve multiple consumers using a multi-tenant
model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand;
the customer generally has no control or knowledge over the exact location of provided resources. Rapid elasticity is
about scaling up/down quickly, measured service is about metering, and broad network access is about standardized
network access. The dynamic multi-tenant assignment and lack of location awareness is the hallmark of resource pooling.
WGU D320 - 2026/2027 Update - Study Guide Page 2
, WGU D320 Managing Cloud Security (YJ02) | 80 Practice Questions | 2026/2027
Q4. An e-commerce platform automatically scales out from 4 to 40 web server instances during a flash sale and
scales back down within minutes after traffic subsides. The customer is billed only for the additional
instance-hours consumed. Which two NIST characteristics are most directly demonstrated?
A. Broad network access and resource pooling
B. On-demand self-service and broad network access
C. Rapid elasticity and measured service [CORRECT]
D. Resource pooling and on-demand self-service
Correct Answer: C
Rationale:
Rapid elasticity means capabilities can be elastically provisioned and released to scale rapidly outward and inward
commensurate with demand; the consumer often perceives unlimited resources. Measured service means cloud systems
automatically control and optimize resource use by leveraging a metering capability at some abstraction level appropriate
to the type of service, with billing based on consumed resources. The auto-scaling and per-instance-hour billing
demonstrate both characteristics. The other options describe valid characteristics but do not match the scenario of
dynamic scaling plus consumption-based billing.
Q5. A startup wants to migrate its on-premises virtualization cluster to the cloud while retaining full control
over the operating system, middleware, and applications. The cloud provider should only manage the
underlying physical hardware, networking, storage, and virtualization layer. Which cloud service model fits
this requirement?
A. FaaS
B. SaaS
C. PaaS
D. IaaS [CORRECT]
Correct Answer: D
Rationale:
IaaS provides the consumer with the capability to provision processing, storage, networks, and other fundamental
computing resources where the consumer can deploy and run arbitrary software, including operating systems and
applications. The CSP manages facilities, hardware, networking, storage, and virtualization; the customer is responsible
for everything above the hypervisor (OS, middleware, applications, data). SaaS would have the provider manage
everything including the application; PaaS has the provider manage the OS and platform runtime; FaaS is a serverless
model. The startup's requirement to retain OS/middleware/application control maps directly to IaaS.
WGU D320 - 2026/2027 Update - Study Guide Page 3
Managing Cloud Security
80 Practice Questions and Study Guide
Update
80 Questions 6 Sections Scenario-Based Full Rationales
NIST · CSA · ISO
Aligned to the WGU D320 (YJ02) competency blueprint and current 2026-2027 cloud security
standards. Coverage spans cloud computing fundamentals and governance, cloud security
architecture and design, identity and data protection, risk and compliance, operations and incident
response, and emerging trends including Zero Trust, confidential computing, CNAPP, and SASE.
WGU D320 · Managing Cloud Security · YJ02 Edition
,WGU D320 Managing Cloud Security (YJ02) | 80 Practice Questions | 2026/2027
WGU D320: Managing Cloud Security (YJ02)
80 Practice Questions and Study Guide - 2026/2027 Update
Aligned to the WGU D320 (YJ02) competency blueprint and current 2026-2027 cloud security standards, including NIST SP
800-145, NIST SP 800-207 (Zero Trust), CSA Security Guidance v4, ISO/IEC 27017/27018/27701, FedRAMP Rev 5, and the
EU-U.S. Data Privacy Framework.
Cognitive Level Target % Approximate Count
Recall / Terminology 25% ~20 questions
Application / Scenario 55% ~44 questions
Analysis / Judgment 20% ~16 questions
Question style: 80% scenario-based, 20% direct recall. Each question has exactly four options (A-D) with one correct answer
marked [CORRECT]. Rationales explain why the correct answer is right and why each distractor is wrong, citing applicable NIST,
CSA, ISO, and regulatory references.
Section 1: Cloud Computing Fundamentals and Governance
Cloud Models, Service Models, Deployment Models, and Cloud Strategy
Questions: Q1 - Q15
Q1. An organization is evaluating whether a proposed service offering qualifies as true cloud computing under
NIST SP 800-145. Which set of five essential characteristics must the service exhibit to be considered a cloud
service?
A. Multi-tenancy, virtualization, automation, orchestration, and self-service
B. On-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service
[CORRECT]
C. High availability, disaster recovery, encryption, identity management, and audit logging
D. Containerization, microservices, API gateways, CI/CD pipelines, and serverless computing
Correct Answer: B
Rationale:
NIST SP 800-145 defines cloud computing by five essential characteristics: on-demand self-service, broad network
access, resource pooling, rapid elasticity, and measured service. The other options describe implementation patterns or
supporting technologies (virtualization, microservices, security controls) that may be present but are not the defining
characteristics per NIST. A service missing any of the five NIST characteristics should not be marketed as cloud
computing per WGU D320 governance guidance.
WGU D320 - 2026/2027 Update - Study Guide Page 1
,WGU D320 Managing Cloud Security (YJ02) | 80 Practice Questions | 2026/2027
Q2. A cloud consumer provisions a new web server through a self-service portal at 2 a.m. without contacting
the provider's support team. Which NIST essential characteristic is being demonstrated?
A. Measured service
B. Resource pooling
C. Broad network access
D. On-demand self-service [CORRECT]
Correct Answer: D
Rationale:
On-demand self-service allows a consumer to unilaterally provision computing capabilities such as server time and
network storage without requiring human interaction with the provider. Resource pooling refers to multi-tenant resource
sharing, broad network access relates to access over the network through standard mechanisms, and measured service
refers to metered usage billing. The 2 a.m. self-service provisioning with no provider involvement is the textbook NIST
indicator of on-demand self-service.
Q3. A SaaS provider serves multiple customers from the same physical infrastructure, dynamically assigning
CPU and memory based on each tenant's load. Customers do not know or control the exact physical location of
their data. Which NIST characteristic best describes this?
A. Resource pooling [CORRECT]
B. Measured service
C. Broad network access
D. Rapid elasticity
Correct Answer: A
Rationale:
Resource pooling means the provider's computing resources are pooled to serve multiple consumers using a multi-tenant
model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand;
the customer generally has no control or knowledge over the exact location of provided resources. Rapid elasticity is
about scaling up/down quickly, measured service is about metering, and broad network access is about standardized
network access. The dynamic multi-tenant assignment and lack of location awareness is the hallmark of resource pooling.
WGU D320 - 2026/2027 Update - Study Guide Page 2
, WGU D320 Managing Cloud Security (YJ02) | 80 Practice Questions | 2026/2027
Q4. An e-commerce platform automatically scales out from 4 to 40 web server instances during a flash sale and
scales back down within minutes after traffic subsides. The customer is billed only for the additional
instance-hours consumed. Which two NIST characteristics are most directly demonstrated?
A. Broad network access and resource pooling
B. On-demand self-service and broad network access
C. Rapid elasticity and measured service [CORRECT]
D. Resource pooling and on-demand self-service
Correct Answer: C
Rationale:
Rapid elasticity means capabilities can be elastically provisioned and released to scale rapidly outward and inward
commensurate with demand; the consumer often perceives unlimited resources. Measured service means cloud systems
automatically control and optimize resource use by leveraging a metering capability at some abstraction level appropriate
to the type of service, with billing based on consumed resources. The auto-scaling and per-instance-hour billing
demonstrate both characteristics. The other options describe valid characteristics but do not match the scenario of
dynamic scaling plus consumption-based billing.
Q5. A startup wants to migrate its on-premises virtualization cluster to the cloud while retaining full control
over the operating system, middleware, and applications. The cloud provider should only manage the
underlying physical hardware, networking, storage, and virtualization layer. Which cloud service model fits
this requirement?
A. FaaS
B. SaaS
C. PaaS
D. IaaS [CORRECT]
Correct Answer: D
Rationale:
IaaS provides the consumer with the capability to provision processing, storage, networks, and other fundamental
computing resources where the consumer can deploy and run arbitrary software, including operating systems and
applications. The CSP manages facilities, hardware, networking, storage, and virtualization; the customer is responsible
for everything above the hypervisor (OS, middleware, applications, data). SaaS would have the provider manage
everything including the application; PaaS has the provider manage the OS and platform runtime; FaaS is a serverless
model. The startup's requirement to retain OS/middleware/application control maps directly to IaaS.
WGU D320 - 2026/2027 Update - Study Guide Page 3
