WESTERN GOVERNORS UNIVERSITY | COURSE: D320
Managing Cloud Security
Quiz Bank — 120 Questions with Complete Answers
Total Questions: 120 Multiple-Choice Questions
Cognitive Mix: 25% Recall / 55% Application / 20% Analysis
Question Style: 80% Scenario-Based, 20% Direct Recall
Sections: 7 Thematic Domains
Standards Alignment: NIST SP 800-145, ISO/IEC 17788/17789, ISO/IEC 27017/27018/27701, CSA STAR, GDPR, HIP
Edition: Curriculum Aligned
Competency: WGU D320 Managing Cloud Security (YJ02)
Aligned with WGU D320 (YJ02) competencies, NIST SP 800-145, ISO/IEC 17788/17789, ISO/IEC
27017/27018/27701, CSA CCM, GDPR, HIPAA, PCI DSS, and FedRAMP
WGU D320 Managing Cloud Security Quiz Bank | Page 1
,About This Quiz Bank
This quiz bank is a comprehensive study companion for WGU D320 Managing Cloud Security (YJ02), designed to
evaluate and reinforce mastery of cloud security principles required by the 2026/2027 WGU curriculum. The 120
multiple-choice questions span seven thematic domains, beginning with NIST SP 800-145 cloud computing characteristics
and ISO/IEC 17788/17789 cloud reference architecture, progressing through the Shared Responsibility Model, IAM and
data protection, network and infrastructure controls, risk and compliance, security operations and BCDR, and culminating
in Zero Trust and emerging cloud-native trends such as confidential computing, CNAPP, and SASE.
The cognitive level distribution is 25 percent recall, 55 percent application, and 20 percent analysis, mirroring the WGU
D320 exam weighting. Approximately 80 percent of the items are scenario-based, requiring candidates to reason through
realistic cloud security decisions involving AWS, Azure, and GCP service models, multi-tenant isolation, IAM federation,
encryption boundaries, vendor risk, jurisdictional constraints, and disaster recovery trade-offs. The remaining 20 percent
are direct terminology and standards-recognition questions.
Each item includes a verified correct answer and a 3-4 sentence rationale that explains both why the correct option is right
and why the distractors are wrong, with explicit references to NIST publications, ISO/IEC standards, CSA guidance, the
Shared Responsibility Model, cryptographic principles, and regulatory frameworks. Distractors were crafted to reflect
common D320 exam pitfalls such as confusing security of the cloud with security in the cloud, mixing up deployment
models, conflating authentication with federation, misapplying encryption modes, and selecting inappropriate DR
strategies for a given RTO/RPO. Successful completion of this quiz bank indicates readiness for the WGU D320 objective
assessment.
Exam Structure Overview
# Section Question Range Count
1 Cloud Computing Fundamentals and Architecture Q1–Q20 20
2 Cloud Security Architecture and Shared Responsibility Q21–Q40 20
3 Identity, Access Management, and Data Security Q41–Q62 22
4 Cloud Network and Infrastructure Security Q63–Q78 16
5 Cloud Risk, Compliance, Legal, and Auditing Q79–Q95 17
6 Cloud Security Operations, Incident Response, and BCDR Q96–Q110 15
7 Standards, Zero Trust, and Emerging Trends Q111–Q120 10
TOTAL Q1–Q120 120
WGU D320 Managing Cloud Security Quiz Bank | Page 2
, Section 1: Cloud Computing Fundamentals and Architecture
Definitions, Essential Characteristics, Reference Architecture, Service Models, & Deployment Models — NIST
SP 800-145 and ISO/IEC 17788/17789
Q1: A cloud architect is drafting a procurement justification memo and must cite the authoritative
NIST definition of cloud computing. According to NIST SP 800-145, which set of five essential
characteristics uniquely distinguishes cloud computing from traditional on-premises IT?
A. Multi-tenancy, virtualization, automation, scalability, and high availability
B. On-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service
[CORRECT]
C. Software-as-a-Service, Platform-as-a-Service, Infrastructure-as-a-Service, public, and private deployment
D. Confidentiality, integrity, availability, accountability, and auditability
Correct Answer: B
Rationale: NIST SP 800-145 explicitly enumerates five essential characteristics of cloud computing: on-demand self-service,
broad network access, resource pooling, rapid elasticity, and measured service. These five, taken together, distinguish cloud
from traditional hosting. Option A confuses common implementation features with the definitional characteristics; Option C
lists service and deployment models rather than characteristics; Option D lists the classic CIA triad plus governance
properties, which are security objectives rather than cloud essentials.
Q2: A development team provisions three new virtual machines at 2 a.m. through a self-service
portal without submitting a ticket or contacting the cloud provider. Which essential cloud
characteristic is most directly demonstrated by this scenario?
A. Resource pooling
B. Broad network access
C. On-demand self-service [CORRECT]
D. Measured service
Correct Answer: C
Rationale: On-demand self-service, as defined in NIST SP 800-145, allows a cloud consumer to unilaterally provision
computing capabilities such as server time and network storage without requiring human interaction with the provider. The 2
a.m. self-service portal provisioning directly demonstrates this characteristic. Resource pooling refers to multi-tenant sharing
of underlying physical resources, broad network access refers to access over the network through standard mechanisms, and
measured service refers to metering and billing of usage.
WGU D320 Managing Cloud Security Quiz Bank | Page 3
, Q3: A healthcare SaaS vendor wants to ensure that clinicians can access the application from
hospital workstations, home laptops, tablets, and smartphones over both wired and wireless
networks. Which NIST essential characteristic must the vendor's architecture primarily support?
A. Rapid elasticity
B. Broad network access [CORRECT]
C. On-demand self-service
D. Resource pooling
Correct Answer: B
Rationale: Broad network access requires that cloud capabilities are accessible over the network through standard
mechanisms that promote use by heterogeneous client platforms such as mobile phones, tablets, laptops, and workstations.
The scenario's emphasis on multiple device types and network paths directly invokes this characteristic. Rapid elasticity
concerns capacity scaling, on-demand self-service concerns provisioning autonomy, and resource pooling concerns
multi-tenant sharing of physical infrastructure.
Q4: An analyst is comparing a multi-tenant public cloud with a single-tenant dedicated hosting
arrangement. Which essential characteristic most clearly differentiates the public cloud model and
is the architectural foundation that enables provider economies of scale?
A. Resource pooling [CORRECT]
B. On-demand self-service
C. Broad network access
D. Measured service
Correct Answer: A
Rationale: Resource pooling, per NIST SP 800-145, means the provider's computing resources are pooled to serve multiple
consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned
according to consumer demand. This pooling is the foundation of provider economies of scale and the architectural property
that most clearly separates a true public cloud from single-tenant dedicated hosting. The other options are also NIST
characteristics but do not describe multi-tenant resource sharing.
Q5: During a quarterly review, a cloud consumer observes that capacity was automatically scaled
from 50 to 200 web instances within minutes to absorb a marketing spike, then scaled back down
to 50 after traffic subsided. The customer was billed only for the additional capacity actually
consumed. Which two NIST characteristics are jointly demonstrated?
A. On-demand self-service and broad network access
B. Rapid elasticity and measured service [CORRECT]
C. Resource pooling and on-demand self-service
D. Broad network access and resource pooling
Correct Answer: B
Rationale: Rapid elasticity refers to capabilities being elastically provisioned and released, often automatically, to scale
rapidly outward and inward commensurate with demand; measured service means cloud systems automatically control and
optimize resource use by leveraging a metering capability at some abstraction level appropriate to the type of service, with
consumers billed only for what they use. The auto-scaling and pay-only-for-usage pattern jointly demonstrates both. The
other options describe distinct characteristics but do not match the scenario's scaling-plus-billing pattern.
WGU D320 Managing Cloud Security Quiz Bank | Page 4
Managing Cloud Security
Quiz Bank — 120 Questions with Complete Answers
Total Questions: 120 Multiple-Choice Questions
Cognitive Mix: 25% Recall / 55% Application / 20% Analysis
Question Style: 80% Scenario-Based, 20% Direct Recall
Sections: 7 Thematic Domains
Standards Alignment: NIST SP 800-145, ISO/IEC 17788/17789, ISO/IEC 27017/27018/27701, CSA STAR, GDPR, HIP
Edition: Curriculum Aligned
Competency: WGU D320 Managing Cloud Security (YJ02)
Aligned with WGU D320 (YJ02) competencies, NIST SP 800-145, ISO/IEC 17788/17789, ISO/IEC
27017/27018/27701, CSA CCM, GDPR, HIPAA, PCI DSS, and FedRAMP
WGU D320 Managing Cloud Security Quiz Bank | Page 1
,About This Quiz Bank
This quiz bank is a comprehensive study companion for WGU D320 Managing Cloud Security (YJ02), designed to
evaluate and reinforce mastery of cloud security principles required by the 2026/2027 WGU curriculum. The 120
multiple-choice questions span seven thematic domains, beginning with NIST SP 800-145 cloud computing characteristics
and ISO/IEC 17788/17789 cloud reference architecture, progressing through the Shared Responsibility Model, IAM and
data protection, network and infrastructure controls, risk and compliance, security operations and BCDR, and culminating
in Zero Trust and emerging cloud-native trends such as confidential computing, CNAPP, and SASE.
The cognitive level distribution is 25 percent recall, 55 percent application, and 20 percent analysis, mirroring the WGU
D320 exam weighting. Approximately 80 percent of the items are scenario-based, requiring candidates to reason through
realistic cloud security decisions involving AWS, Azure, and GCP service models, multi-tenant isolation, IAM federation,
encryption boundaries, vendor risk, jurisdictional constraints, and disaster recovery trade-offs. The remaining 20 percent
are direct terminology and standards-recognition questions.
Each item includes a verified correct answer and a 3-4 sentence rationale that explains both why the correct option is right
and why the distractors are wrong, with explicit references to NIST publications, ISO/IEC standards, CSA guidance, the
Shared Responsibility Model, cryptographic principles, and regulatory frameworks. Distractors were crafted to reflect
common D320 exam pitfalls such as confusing security of the cloud with security in the cloud, mixing up deployment
models, conflating authentication with federation, misapplying encryption modes, and selecting inappropriate DR
strategies for a given RTO/RPO. Successful completion of this quiz bank indicates readiness for the WGU D320 objective
assessment.
Exam Structure Overview
# Section Question Range Count
1 Cloud Computing Fundamentals and Architecture Q1–Q20 20
2 Cloud Security Architecture and Shared Responsibility Q21–Q40 20
3 Identity, Access Management, and Data Security Q41–Q62 22
4 Cloud Network and Infrastructure Security Q63–Q78 16
5 Cloud Risk, Compliance, Legal, and Auditing Q79–Q95 17
6 Cloud Security Operations, Incident Response, and BCDR Q96–Q110 15
7 Standards, Zero Trust, and Emerging Trends Q111–Q120 10
TOTAL Q1–Q120 120
WGU D320 Managing Cloud Security Quiz Bank | Page 2
, Section 1: Cloud Computing Fundamentals and Architecture
Definitions, Essential Characteristics, Reference Architecture, Service Models, & Deployment Models — NIST
SP 800-145 and ISO/IEC 17788/17789
Q1: A cloud architect is drafting a procurement justification memo and must cite the authoritative
NIST definition of cloud computing. According to NIST SP 800-145, which set of five essential
characteristics uniquely distinguishes cloud computing from traditional on-premises IT?
A. Multi-tenancy, virtualization, automation, scalability, and high availability
B. On-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service
[CORRECT]
C. Software-as-a-Service, Platform-as-a-Service, Infrastructure-as-a-Service, public, and private deployment
D. Confidentiality, integrity, availability, accountability, and auditability
Correct Answer: B
Rationale: NIST SP 800-145 explicitly enumerates five essential characteristics of cloud computing: on-demand self-service,
broad network access, resource pooling, rapid elasticity, and measured service. These five, taken together, distinguish cloud
from traditional hosting. Option A confuses common implementation features with the definitional characteristics; Option C
lists service and deployment models rather than characteristics; Option D lists the classic CIA triad plus governance
properties, which are security objectives rather than cloud essentials.
Q2: A development team provisions three new virtual machines at 2 a.m. through a self-service
portal without submitting a ticket or contacting the cloud provider. Which essential cloud
characteristic is most directly demonstrated by this scenario?
A. Resource pooling
B. Broad network access
C. On-demand self-service [CORRECT]
D. Measured service
Correct Answer: C
Rationale: On-demand self-service, as defined in NIST SP 800-145, allows a cloud consumer to unilaterally provision
computing capabilities such as server time and network storage without requiring human interaction with the provider. The 2
a.m. self-service portal provisioning directly demonstrates this characteristic. Resource pooling refers to multi-tenant sharing
of underlying physical resources, broad network access refers to access over the network through standard mechanisms, and
measured service refers to metering and billing of usage.
WGU D320 Managing Cloud Security Quiz Bank | Page 3
, Q3: A healthcare SaaS vendor wants to ensure that clinicians can access the application from
hospital workstations, home laptops, tablets, and smartphones over both wired and wireless
networks. Which NIST essential characteristic must the vendor's architecture primarily support?
A. Rapid elasticity
B. Broad network access [CORRECT]
C. On-demand self-service
D. Resource pooling
Correct Answer: B
Rationale: Broad network access requires that cloud capabilities are accessible over the network through standard
mechanisms that promote use by heterogeneous client platforms such as mobile phones, tablets, laptops, and workstations.
The scenario's emphasis on multiple device types and network paths directly invokes this characteristic. Rapid elasticity
concerns capacity scaling, on-demand self-service concerns provisioning autonomy, and resource pooling concerns
multi-tenant sharing of physical infrastructure.
Q4: An analyst is comparing a multi-tenant public cloud with a single-tenant dedicated hosting
arrangement. Which essential characteristic most clearly differentiates the public cloud model and
is the architectural foundation that enables provider economies of scale?
A. Resource pooling [CORRECT]
B. On-demand self-service
C. Broad network access
D. Measured service
Correct Answer: A
Rationale: Resource pooling, per NIST SP 800-145, means the provider's computing resources are pooled to serve multiple
consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned
according to consumer demand. This pooling is the foundation of provider economies of scale and the architectural property
that most clearly separates a true public cloud from single-tenant dedicated hosting. The other options are also NIST
characteristics but do not describe multi-tenant resource sharing.
Q5: During a quarterly review, a cloud consumer observes that capacity was automatically scaled
from 50 to 200 web instances within minutes to absorb a marketing spike, then scaled back down
to 50 after traffic subsided. The customer was billed only for the additional capacity actually
consumed. Which two NIST characteristics are jointly demonstrated?
A. On-demand self-service and broad network access
B. Rapid elasticity and measured service [CORRECT]
C. Resource pooling and on-demand self-service
D. Broad network access and resource pooling
Correct Answer: B
Rationale: Rapid elasticity refers to capabilities being elastically provisioned and released, often automatically, to scale
rapidly outward and inward commensurate with demand; measured service means cloud systems automatically control and
optimize resource use by leveraging a metering capability at some abstraction level appropriate to the type of service, with
consumers billed only for what they use. The auto-scaling and pay-only-for-usage pattern jointly demonstrates both. The
other options describe distinct characteristics but do not match the scenario's scaling-plus-billing pattern.
WGU D320 Managing Cloud Security Quiz Bank | Page 4
