WGU C838 MANAGING CLOUD
SECURITY FINAL EXAM OA ACTUAL
EXAM 2025 TEST COMPREHENSIVE
QUESTIONS AND VERIFIED
ANSWERS (DETAILED &
ELABORATED) 100% SOLVED 2025!!
What are the 4 characteristics of cloud computing? - ansBroad network access
On-demand services
Resource Pooling
Measured or "metered" service
What NIST publication number defines cloud computing? - ans800-145
What ISO/IEC standard provides information on cloud computing? - ans17788
What is another way of describing a functional business requirement? - ansnecessary
What is another way of describing a nonfunctional business requirement? - ansnot necessary
What is the greatest driver pushing orgs to the cloud? - ansCost savings
What is cloud bursting? - ansAbility to increase available cloud resources on demand
What are 3 characteristics of cloud computing? - ansElasticity
Simplicity
Scalability
What is a cloud customer? - ansAnyone purchasing cloud services
What is a cloud user? - ansAnyone using cloud services
What are the three cloud computing service models? - ansSaaS(Software as a service)
PaaS(Platform as a service)
IaaS(Infrastructure as a service)
What is IaaS (Infrastructure as a Service)? - ansCloud provider provides all the physical
capability and administration, while the customer is responsible for logical resources.
What is PaaS (Platform as a Service)? - ansA cloud computing service that provides the
hardware and the operating system and is responsible for updating and maintaining both.
What is SaaS (Software As A Service)? - ansCloud provider manages everything.
What are the four cloud deployment models? - ansPublic
Private
Community
Hybrid
What cloud model is owned by a single organization? - ansPrivate
What cloud model is an arrangement of two or more cloud servers? - ansHybrid
What cloud model is a shared setup between orgs? - ansCommunity
What cloud model is open for free usage? - ansPublic
What is a cloud service provider? - ansCloud service provider manages and provides entire
hosting ability
What is a Cloud Access Security Broker? - ansThird-party acting as an intermediary for
identity and access management
What do regulators do? - ansEnsure organizations are in compliance with regulatory
framework.
What word in the CIA triad describes: What protects information from unauthorized
access/dissemination? - ansConfidentiality
,WGU C838 MANAGING CLOUD
SECURITY FINAL EXAM OA ACTUAL
EXAM 2025 TEST COMPREHENSIVE
QUESTIONS AND VERIFIED
ANSWERS (DETAILED &
ELABORATED) 100% SOLVED 2025!!
What word in the CIA triad describes: Ensuring that information is not subject to
unauthorized modification? - ansIntegrity
What word in the CIA triad describes: Ensuring that authorized users can access the
information when they are permitted to do so? - ansAvailability
What is a cloud architect? - ansExpert in cloud computing
What is cloud os also known as? - ansPaaS
NIST standard number that lists accredited and outmoded cryptosystems - ansFIPS 140-2
customer may be unable to leave, migrate, or transfer to an alternate provider due to technical
or non-technical constraints. - ansvendor lock-m
What is cloud migration? - ansProcess of transitioning part of a company's data or services
from onsite premises to the cloud
What is cloud portability? - ansMove applications and data between cloud providers
What offers a degree of assurance that nobody w/o authorization will be able to access other's
data? - ansEncryption
If a cloud customer wants a secure, isolated sandbox in order to conduct software
development and testing, which cloud service model would probably be best? - ansPaaS
What technology has NOT made cloud service viable? - ansSmart hubs
What determines the critical paths, processes, and assets of an organization? - ansBIA
Fully-operational environment with very little maintenance or administration necessary,
which cloud service model would probably be best? - ansPaaS
customer is unable to recover or access their own data due to the cloud provider going into
bankruptcy or otherwise leaving the market. - ansVendor lock-out
What are four examples of things to know to decide how to handle risks within an org? -
ansInventory of all assets
Valuation of each asset
Critical paths, processes, and assets
Clear understanding of risk appetite
T/F: Assets are only tangible items. - ansFalse. Assets are everything owned or controlled by
an org.
The process of evaluating assets? - ansBusiness Impact Analysis(BIA)
What is criticality? - ansSomething an org could not operate or exist without
What are 5 examples of criticality for an org - ansTangible assets
Intangible assets
Processes
Data paths
Personnel
In risk, what is the avoidance method? - ansAvoiding high risk
In risk, what is the acceptance method? - ansAcceptable level of risk
In risk, what is an example of the avoidance method? - ansInsurance
In risk, what is the mitigation method? - ansControls or countermeasures
, WGU C838 MANAGING CLOUD
SECURITY FINAL EXAM OA ACTUAL
EXAM 2025 TEST COMPREHENSIVE
QUESTIONS AND VERIFIED
ANSWERS (DETAILED &
ELABORATED) 100% SOLVED 2025!!
Assets can be what? - ansTangible
Intangible
Personnel
What does Business Impact Analysis do? - ansDefines which of the assets provide the
intrinsic value of an organization.
What is risk appetite - ansLevel, Amount, or Type of risk that an org finds acceptable
What is the IaaS boundary? - ansThe provider is responsible for connectivity and power and
the customer is in charge for installation of software.
What is the PaaS boundary? - ansThe provider is responsible for updates and administration
of the OS and the customer monitors and reviews software events.
What is the SaaS boundary? - ansThe provider is responsible for system maintenance and the
customer supplies and processes data to and in the system.
What should encryption be used for in a cloud datacenter? - ansLong-term storage/archiving
Protecting near-term stored files, such as snapshots of virtualized instances
Preventing unauthorized access to specific datasets by authorized personnel
What should encryption be used for in communications between cloud providers and users? -
ansCreating secure sessions
Ensuring the integrity and confidentiality of data in transit
What are 4 controls/mechanisms a cloud provider should play a role in in layered defense? -
ansStrong personnel controls
Technological controls
Physical controls
Governance mechanisms
In cloud layered defense what are examples of personnel controls? - ansbackground checks
continual monitoring
In cloud layered defense what are examples of technological controls? - ansencryption
event logging
access control enforcement
In cloud layered defense what is an examples of physical controls? - ansaccess to overall
campus
In cloud layered defense what is an example of governance mechanisms? - ansauditing
What are ways for securing devices in a datacenter? - ansGuess accounts removed
no default passwords
systems are patched, maintained and updated
unused ports are closed
limited physical access
What is layered defense? - ansThe practice of having multiple overlapping means of securing
the environment with a variety of methods
Who determines risk appetite? - anssenior management
SECURITY FINAL EXAM OA ACTUAL
EXAM 2025 TEST COMPREHENSIVE
QUESTIONS AND VERIFIED
ANSWERS (DETAILED &
ELABORATED) 100% SOLVED 2025!!
What are the 4 characteristics of cloud computing? - ansBroad network access
On-demand services
Resource Pooling
Measured or "metered" service
What NIST publication number defines cloud computing? - ans800-145
What ISO/IEC standard provides information on cloud computing? - ans17788
What is another way of describing a functional business requirement? - ansnecessary
What is another way of describing a nonfunctional business requirement? - ansnot necessary
What is the greatest driver pushing orgs to the cloud? - ansCost savings
What is cloud bursting? - ansAbility to increase available cloud resources on demand
What are 3 characteristics of cloud computing? - ansElasticity
Simplicity
Scalability
What is a cloud customer? - ansAnyone purchasing cloud services
What is a cloud user? - ansAnyone using cloud services
What are the three cloud computing service models? - ansSaaS(Software as a service)
PaaS(Platform as a service)
IaaS(Infrastructure as a service)
What is IaaS (Infrastructure as a Service)? - ansCloud provider provides all the physical
capability and administration, while the customer is responsible for logical resources.
What is PaaS (Platform as a Service)? - ansA cloud computing service that provides the
hardware and the operating system and is responsible for updating and maintaining both.
What is SaaS (Software As A Service)? - ansCloud provider manages everything.
What are the four cloud deployment models? - ansPublic
Private
Community
Hybrid
What cloud model is owned by a single organization? - ansPrivate
What cloud model is an arrangement of two or more cloud servers? - ansHybrid
What cloud model is a shared setup between orgs? - ansCommunity
What cloud model is open for free usage? - ansPublic
What is a cloud service provider? - ansCloud service provider manages and provides entire
hosting ability
What is a Cloud Access Security Broker? - ansThird-party acting as an intermediary for
identity and access management
What do regulators do? - ansEnsure organizations are in compliance with regulatory
framework.
What word in the CIA triad describes: What protects information from unauthorized
access/dissemination? - ansConfidentiality
,WGU C838 MANAGING CLOUD
SECURITY FINAL EXAM OA ACTUAL
EXAM 2025 TEST COMPREHENSIVE
QUESTIONS AND VERIFIED
ANSWERS (DETAILED &
ELABORATED) 100% SOLVED 2025!!
What word in the CIA triad describes: Ensuring that information is not subject to
unauthorized modification? - ansIntegrity
What word in the CIA triad describes: Ensuring that authorized users can access the
information when they are permitted to do so? - ansAvailability
What is a cloud architect? - ansExpert in cloud computing
What is cloud os also known as? - ansPaaS
NIST standard number that lists accredited and outmoded cryptosystems - ansFIPS 140-2
customer may be unable to leave, migrate, or transfer to an alternate provider due to technical
or non-technical constraints. - ansvendor lock-m
What is cloud migration? - ansProcess of transitioning part of a company's data or services
from onsite premises to the cloud
What is cloud portability? - ansMove applications and data between cloud providers
What offers a degree of assurance that nobody w/o authorization will be able to access other's
data? - ansEncryption
If a cloud customer wants a secure, isolated sandbox in order to conduct software
development and testing, which cloud service model would probably be best? - ansPaaS
What technology has NOT made cloud service viable? - ansSmart hubs
What determines the critical paths, processes, and assets of an organization? - ansBIA
Fully-operational environment with very little maintenance or administration necessary,
which cloud service model would probably be best? - ansPaaS
customer is unable to recover or access their own data due to the cloud provider going into
bankruptcy or otherwise leaving the market. - ansVendor lock-out
What are four examples of things to know to decide how to handle risks within an org? -
ansInventory of all assets
Valuation of each asset
Critical paths, processes, and assets
Clear understanding of risk appetite
T/F: Assets are only tangible items. - ansFalse. Assets are everything owned or controlled by
an org.
The process of evaluating assets? - ansBusiness Impact Analysis(BIA)
What is criticality? - ansSomething an org could not operate or exist without
What are 5 examples of criticality for an org - ansTangible assets
Intangible assets
Processes
Data paths
Personnel
In risk, what is the avoidance method? - ansAvoiding high risk
In risk, what is the acceptance method? - ansAcceptable level of risk
In risk, what is an example of the avoidance method? - ansInsurance
In risk, what is the mitigation method? - ansControls or countermeasures
, WGU C838 MANAGING CLOUD
SECURITY FINAL EXAM OA ACTUAL
EXAM 2025 TEST COMPREHENSIVE
QUESTIONS AND VERIFIED
ANSWERS (DETAILED &
ELABORATED) 100% SOLVED 2025!!
Assets can be what? - ansTangible
Intangible
Personnel
What does Business Impact Analysis do? - ansDefines which of the assets provide the
intrinsic value of an organization.
What is risk appetite - ansLevel, Amount, or Type of risk that an org finds acceptable
What is the IaaS boundary? - ansThe provider is responsible for connectivity and power and
the customer is in charge for installation of software.
What is the PaaS boundary? - ansThe provider is responsible for updates and administration
of the OS and the customer monitors and reviews software events.
What is the SaaS boundary? - ansThe provider is responsible for system maintenance and the
customer supplies and processes data to and in the system.
What should encryption be used for in a cloud datacenter? - ansLong-term storage/archiving
Protecting near-term stored files, such as snapshots of virtualized instances
Preventing unauthorized access to specific datasets by authorized personnel
What should encryption be used for in communications between cloud providers and users? -
ansCreating secure sessions
Ensuring the integrity and confidentiality of data in transit
What are 4 controls/mechanisms a cloud provider should play a role in in layered defense? -
ansStrong personnel controls
Technological controls
Physical controls
Governance mechanisms
In cloud layered defense what are examples of personnel controls? - ansbackground checks
continual monitoring
In cloud layered defense what are examples of technological controls? - ansencryption
event logging
access control enforcement
In cloud layered defense what is an examples of physical controls? - ansaccess to overall
campus
In cloud layered defense what is an example of governance mechanisms? - ansauditing
What are ways for securing devices in a datacenter? - ansGuess accounts removed
no default passwords
systems are patched, maintained and updated
unused ports are closed
limited physical access
What is layered defense? - ansThe practice of having multiple overlapping means of securing
the environment with a variety of methods
Who determines risk appetite? - anssenior management
