WGU D320 | Managing Cloud Security (YJ02) | Pre-Assessment 2026/2027 70 Questions | 100% Verified
WGU D320 | Managing Cloud Security (YJ02)
PRE-ASSESSMENT (PA) | UPDATE
70 Questions & Answers | 100% Verified Correct
Aligned with WGU D320 Pre-Assessment Blueprint and 2026/2027 Curriculum Standards
Instructions: This pre-assessment consists of 70 multiple-choice questions distributed across six content
domains aligned with the WGU D320 Managing Cloud Security (YJ02) course competencies. Each question has
exactly one correct answer (A, B, C, or D). The correct answer is indicated inline with the tag [CORRECT],
followed by a concise rationale citing NIST, CSA, ISO/IEC, FedRAMP, GDPR, HIPAA, PCI DSS, or other applicable
standards where relevant. Question design reflects the WGU D320 cognitive distribution of approximately 25%
recall, 55% application, and 20% analysis, with 80% of items scenario-based and 20% direct recall. Use this exam
for self-assessment, competency gap identification, and targeted review prior to attempting the WGU D320
Pre-Assessment.
Section Domain Q Range
1 Cloud Computing Fundamentals and Service Models Q1 - Q12
2 Cloud Security Architecture and Shared Responsibility Q13 - Q24
3 Identity, Access Management, and Data Security Q25 - Q38
4 Cloud Risk Management, Compliance, and Legal Issues Q39 - Q50
5 Cloud Operations, Incident Response, and Business Continuity Q51 - Q62
6 Standards, Certifications, and Emerging Trends Q63 - Q70
Section 1: Cloud Computing Fundamentals and Service Models (Q1 - Q12)
Definitions, NIST SP 800-145 essential characteristics, IaaS / PaaS / SaaS responsibility boundaries, deployment models
(public, private, community, hybrid, multi-cloud), and NIST cloud reference architecture actors.
Page 1
,WGU D320 | Managing Cloud Security (YJ02) | Pre-Assessment 2026/2027 70 Questions | 100% Verified
Q1: A cloud provider automatically provisions compute resources to a tenant in response to a workload spike
and bills the tenant only for the resources actually consumed. Which pair of NIST SP 800-145 essential
characteristics is being demonstrated?
A. Broad network access and resource pooling
B. Rapid elasticity and measured service [CORRECT]
C. On-demand self-service and broad network access
D. Resource pooling and on-demand self-service
Correct Answer: B
Rationale: Rapid elasticity describes the ability to scale resources quickly outward and inward in response to demand,
while measured service is the metering and billing of resource usage. The scenario specifically highlights automatic
scaling (elasticity) followed by consumption-based billing (measured service). Broad network access refers to
reachability over standard networks, and resource pooling refers to multi-tenant sharing of underlying physical
resources, neither of which is the focus of the scenario.
Q2: A SaaS customer wants to ensure their CRM data is stored in a way that isolates it from other tenants
while still benefiting from shared infrastructure. Which NIST essential characteristic is most directly
responsible for this requirement?
A. On-demand self-service
B. Broad network access
C. Resource pooling [CORRECT]
D. Rapid elasticity
Correct Answer: C
Rationale: Resource pooling is the characteristic in which the provider's computing resources are pooled to serve
multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned
and reassigned according to consumer demand. This is what enables logical isolation of tenant data on shared
infrastructure. On-demand self-service refers to a consumer provisioning capabilities unilaterally without human
interaction with the provider. Broad network access refers to accessibility over the network through standard
mechanisms, while rapid elasticity refers to the ability to scale resources elastically.
Q3: A startup deploys its e-commerce application to a cloud platform where the provider manages the
underlying servers, storage, networking, operating system, middleware, and runtime, while the startup is
responsible only for its application code, data, and access configurations. Which cloud service model is being
used?
A. Infrastructure as a Service (IaaS)
B. Platform as a Service (PaaS) [CORRECT]
C. Software as a Service (SaaS)
D. Function as a Service (FaaS)
Correct Answer: B
Rationale: PaaS is the service model in which the consumer deploys applications onto a cloud infrastructure that the
provider manages, including the operating system, middleware, and runtime, while the consumer retains control over
the deployed applications and possibly the hosting environment configurations. In IaaS, the consumer would also
manage the operating system, middleware, and runtime. In SaaS, the consumer uses the provider's applications
directly with no control over the underlying infrastructure. FaaS is a specialized form of PaaS where code runs in
response to events.
Page 2
, WGU D320 | Managing Cloud Security (YJ02) | Pre-Assessment 2026/2027 70 Questions | 100% Verified
Q4: An organization using Microsoft 365 for email needs to determine which security controls they are
responsible for. According to the Shared Responsibility Model, which of the following is the customer's
responsibility in a SaaS environment?
A. Patching the underlying email server operating system
B. Configuring mail-flow rules and data loss prevention (DLP) policies [CORRECT]
C. Maintaining physical security of the data center hosting the service
D. Updating the hypervisor that virtualizes the email platform
Correct Answer: B
Rationale: In a SaaS model, the provider is responsible for the underlying infrastructure, OS, middleware, and
application platform, including patching and physical security. The customer remains responsible for data, identity
and access management, endpoint protection, and configuration of the application's security posture, such as
mail-flow rules and DLP policies. Choices A, C, and D all fall on the provider side of the SaaS shared responsibility
boundary. This is a classic D320 Pre-Assessment pitfall - confusing what the customer 'manages' versus what the
customer 'configures'.
Q5: A company running virtual machines on AWS EC2 has just deployed a new Linux-based web server.
According to the Shared Responsibility Model, which of the following tasks is the customer's responsibility?
A. Maintaining the underlying host hardware
B. Securing the hypervisor
C. Installing and patching the guest operating system and web server software [CORRECT]
D. Physical security of the availability zone
Correct Answer: C
Rationale: In an IaaS model, the provider is responsible for the underlying physical infrastructure, including hardware,
hypervisor, and facility security (security 'of' the cloud). The customer is responsible for everything above the
hypervisor, including the guest OS, applications, data, identity, and network configurations such as security groups
(security 'in' the cloud). Patching the guest OS and web server software is therefore the customer's responsibility. The
other three options are all provider responsibilities in IaaS.
Q6: A software development team deploys a custom application on a managed cloud application platform
(e.g., AWS Elastic Beanstalk or Azure App Service). The team needs to apply a critical security patch to a
vulnerable library used by their application. According to the Shared Responsibility Model, who is responsible
for applying this patch?
A. The cloud provider, because it manages the platform runtime
B. The customer, because the application code and its dependencies are customer-managed [CORRECT]
C. The cloud auditor, under the SOC 2 monitoring scope
D. The cloud broker, as an intermediary service
Correct Answer: B
Rationale: In a PaaS model, the provider manages the infrastructure, OS, middleware, and runtime, but the customer
remains responsible for the deployed applications and the libraries those applications depend on. Therefore, patching
a vulnerable library in the customer's application is the customer's responsibility, even though the runtime itself is
provider-managed. The provider's responsibility ends at the platform layer. A cloud auditor does not assume
operational responsibility for patching, and a cloud broker is an intermediary for service selection, not application
maintenance.
Page 3
WGU D320 | Managing Cloud Security (YJ02)
PRE-ASSESSMENT (PA) | UPDATE
70 Questions & Answers | 100% Verified Correct
Aligned with WGU D320 Pre-Assessment Blueprint and 2026/2027 Curriculum Standards
Instructions: This pre-assessment consists of 70 multiple-choice questions distributed across six content
domains aligned with the WGU D320 Managing Cloud Security (YJ02) course competencies. Each question has
exactly one correct answer (A, B, C, or D). The correct answer is indicated inline with the tag [CORRECT],
followed by a concise rationale citing NIST, CSA, ISO/IEC, FedRAMP, GDPR, HIPAA, PCI DSS, or other applicable
standards where relevant. Question design reflects the WGU D320 cognitive distribution of approximately 25%
recall, 55% application, and 20% analysis, with 80% of items scenario-based and 20% direct recall. Use this exam
for self-assessment, competency gap identification, and targeted review prior to attempting the WGU D320
Pre-Assessment.
Section Domain Q Range
1 Cloud Computing Fundamentals and Service Models Q1 - Q12
2 Cloud Security Architecture and Shared Responsibility Q13 - Q24
3 Identity, Access Management, and Data Security Q25 - Q38
4 Cloud Risk Management, Compliance, and Legal Issues Q39 - Q50
5 Cloud Operations, Incident Response, and Business Continuity Q51 - Q62
6 Standards, Certifications, and Emerging Trends Q63 - Q70
Section 1: Cloud Computing Fundamentals and Service Models (Q1 - Q12)
Definitions, NIST SP 800-145 essential characteristics, IaaS / PaaS / SaaS responsibility boundaries, deployment models
(public, private, community, hybrid, multi-cloud), and NIST cloud reference architecture actors.
Page 1
,WGU D320 | Managing Cloud Security (YJ02) | Pre-Assessment 2026/2027 70 Questions | 100% Verified
Q1: A cloud provider automatically provisions compute resources to a tenant in response to a workload spike
and bills the tenant only for the resources actually consumed. Which pair of NIST SP 800-145 essential
characteristics is being demonstrated?
A. Broad network access and resource pooling
B. Rapid elasticity and measured service [CORRECT]
C. On-demand self-service and broad network access
D. Resource pooling and on-demand self-service
Correct Answer: B
Rationale: Rapid elasticity describes the ability to scale resources quickly outward and inward in response to demand,
while measured service is the metering and billing of resource usage. The scenario specifically highlights automatic
scaling (elasticity) followed by consumption-based billing (measured service). Broad network access refers to
reachability over standard networks, and resource pooling refers to multi-tenant sharing of underlying physical
resources, neither of which is the focus of the scenario.
Q2: A SaaS customer wants to ensure their CRM data is stored in a way that isolates it from other tenants
while still benefiting from shared infrastructure. Which NIST essential characteristic is most directly
responsible for this requirement?
A. On-demand self-service
B. Broad network access
C. Resource pooling [CORRECT]
D. Rapid elasticity
Correct Answer: C
Rationale: Resource pooling is the characteristic in which the provider's computing resources are pooled to serve
multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned
and reassigned according to consumer demand. This is what enables logical isolation of tenant data on shared
infrastructure. On-demand self-service refers to a consumer provisioning capabilities unilaterally without human
interaction with the provider. Broad network access refers to accessibility over the network through standard
mechanisms, while rapid elasticity refers to the ability to scale resources elastically.
Q3: A startup deploys its e-commerce application to a cloud platform where the provider manages the
underlying servers, storage, networking, operating system, middleware, and runtime, while the startup is
responsible only for its application code, data, and access configurations. Which cloud service model is being
used?
A. Infrastructure as a Service (IaaS)
B. Platform as a Service (PaaS) [CORRECT]
C. Software as a Service (SaaS)
D. Function as a Service (FaaS)
Correct Answer: B
Rationale: PaaS is the service model in which the consumer deploys applications onto a cloud infrastructure that the
provider manages, including the operating system, middleware, and runtime, while the consumer retains control over
the deployed applications and possibly the hosting environment configurations. In IaaS, the consumer would also
manage the operating system, middleware, and runtime. In SaaS, the consumer uses the provider's applications
directly with no control over the underlying infrastructure. FaaS is a specialized form of PaaS where code runs in
response to events.
Page 2
, WGU D320 | Managing Cloud Security (YJ02) | Pre-Assessment 2026/2027 70 Questions | 100% Verified
Q4: An organization using Microsoft 365 for email needs to determine which security controls they are
responsible for. According to the Shared Responsibility Model, which of the following is the customer's
responsibility in a SaaS environment?
A. Patching the underlying email server operating system
B. Configuring mail-flow rules and data loss prevention (DLP) policies [CORRECT]
C. Maintaining physical security of the data center hosting the service
D. Updating the hypervisor that virtualizes the email platform
Correct Answer: B
Rationale: In a SaaS model, the provider is responsible for the underlying infrastructure, OS, middleware, and
application platform, including patching and physical security. The customer remains responsible for data, identity
and access management, endpoint protection, and configuration of the application's security posture, such as
mail-flow rules and DLP policies. Choices A, C, and D all fall on the provider side of the SaaS shared responsibility
boundary. This is a classic D320 Pre-Assessment pitfall - confusing what the customer 'manages' versus what the
customer 'configures'.
Q5: A company running virtual machines on AWS EC2 has just deployed a new Linux-based web server.
According to the Shared Responsibility Model, which of the following tasks is the customer's responsibility?
A. Maintaining the underlying host hardware
B. Securing the hypervisor
C. Installing and patching the guest operating system and web server software [CORRECT]
D. Physical security of the availability zone
Correct Answer: C
Rationale: In an IaaS model, the provider is responsible for the underlying physical infrastructure, including hardware,
hypervisor, and facility security (security 'of' the cloud). The customer is responsible for everything above the
hypervisor, including the guest OS, applications, data, identity, and network configurations such as security groups
(security 'in' the cloud). Patching the guest OS and web server software is therefore the customer's responsibility. The
other three options are all provider responsibilities in IaaS.
Q6: A software development team deploys a custom application on a managed cloud application platform
(e.g., AWS Elastic Beanstalk or Azure App Service). The team needs to apply a critical security patch to a
vulnerable library used by their application. According to the Shared Responsibility Model, who is responsible
for applying this patch?
A. The cloud provider, because it manages the platform runtime
B. The customer, because the application code and its dependencies are customer-managed [CORRECT]
C. The cloud auditor, under the SOC 2 monitoring scope
D. The cloud broker, as an intermediary service
Correct Answer: B
Rationale: In a PaaS model, the provider manages the infrastructure, OS, middleware, and runtime, but the customer
remains responsible for the deployed applications and the libraries those applications depend on. Therefore, patching
a vulnerable library in the customer's application is the customer's responsibility, even though the runtime itself is
provider-managed. The provider's responsibility ends at the platform layer. A cloud auditor does not assume
operational responsibility for patching, and a cloud broker is an intermediary for service selection, not application
maintenance.
Page 3
