WGU D320 Managing Cloud Security Review |
Western Governors University | 2026/2027
Updated | 300+ Q&A with Verified Answers |
Grade A+
Competency-Based Review & Practice Assessment | Aligned with WGU D320 Course
Objectives
Western Governors University | College of IT | D320 Managing Cloud Security
Part 1 – Core Competency & Concept Review
Domain 1 – Cloud Security Concepts & Architecture
• Shared Responsibility Model – 2026 refresh: customer always owns data & identity;
provider owns host infrastructure. IaaS → customer patches OS; PaaS → customer
secures app runtime; SaaS → customer manages only user access & data
classification.
• Cloud Service Models – IaaS (EC2, GCE, Azure VM), PaaS (Elastic Beanstalk, Cloud
Run, App Service), SaaS (M365, Salesforce). Security control inheritance decreases
left-to-right.
• Security Reference Architectures – AWS Well-Architected Tool 2026 “Security” pillar,
Azure Cloud Adoption Framework (CAF) Secure methodology, Google Cloud
Landing-Zone v4 with “secure-by-default” guardrails.
,• Zero Trust – NIST 800-207 (2025 rev 2) “never trust, continuously verify”; enforce least
privilege per session; micro-segmentation with identity, device, network, workload
signals.
Domain 2 – Identity & Access Management (IAM)
• Principle of Least Privilege – enforce via AWS IAM Access Analyzer 2026 policy
optimization, Azure Entra Permissions Management, GCP Policy Analyzer.
• Federated Identity – SAML 2.0, OpenID Connect, OAuth 2.1 (FAPI 2.0 profile); SCIM 2.0
provisioning; workforce pools & workload identity federation for cross-cloud CI/CD.
• Multi-Factor Authentication – phishing-resistant FIDO2 passkeys now baseline for
privileged roles; conditional access policies evaluate device compliance, location, risk
score (Azure AD Protection, AWS IAM Identity Center).
• Role-Based + Attribute-Based Access Control – RBAC for coarse roles; ABAC for
dynamic tags (e.g., Project=PHI, Environment=Prod).
Domain 3 – Data Security & Compliance
• Encryption at Rest – AWS KMS dual-layer (hardware + software) keys, Azure Key Vault
HSM 2026 “Always Pluggable” HSM, GCP CMEK (Customer-Managed Encryption Key)
with external key manager (EKM).
• Encryption in Transit – TLS 1.3 mandatory; Perfect Forward Secrecy; mTLS service
mesh (Istio 1.23, AWS App Mesh, Azure Service Fabric).
• Key Management – envelope encryption, automatic key rotation ≤ 365 days,
bring-your-own-key (BYOK) vs hold-your-own-key (HYOK) for regulated data.
, • Data Loss Prevention – Microsoft Purview 2026 unified DLP, AWS Macie with S3
Object Lambda, Google Cloud DLP API with de-identification transforms.
• Compliance Mapping – GDPR (data subject rights), HIPAA §164.312 (audit controls,
encryption), PCI-DSS v4.0 (Req 3.5 key custodianship), ISO 27017 cloud extension,
FedRAMP High baselines updated 2026.
Domain 4 – Threat Detection & Incident Response
• Cloud Security Posture Management – CNAPP convergence (CrowdStrike, Prisma
Cloud 2026) checks CIS 1.9, NIST 800-53 r5, auto-remediation via Lambda/Azure
Functions.
• Cloud Workload Protection Platform – agentless scanning (eBPF), runtime container
protection, serverless layer-7 firewall.
• SIEM Integration – AWS CloudTrail Lake + GuardDuty 2026, Azure Sentinel UEBA,
Google Cloud SCC with Chronicle.
• Incident Response – customer responsibility to contain guest-OS & app layers;
run-books stored offline; use immutable audit logs (Object Lock, WORM).
Emerging 2026/2027 Topics
• AI/ML Security – Vertex AI Model Armor, AWS SageMaker Model Cards, supply-chain
scanning for ML models (ML-BOM).
• Quantum Risk – post-quantum TLS (Kyber) preview in AWS KMS, Azure managed CNG;
hybrid key exchange.
• Container & Serverless – Sigstore cosign, SBOM generation with SPDX 3.0, admission
controller policy (OPA Gatekeeper, Kyverno).
Western Governors University | 2026/2027
Updated | 300+ Q&A with Verified Answers |
Grade A+
Competency-Based Review & Practice Assessment | Aligned with WGU D320 Course
Objectives
Western Governors University | College of IT | D320 Managing Cloud Security
Part 1 – Core Competency & Concept Review
Domain 1 – Cloud Security Concepts & Architecture
• Shared Responsibility Model – 2026 refresh: customer always owns data & identity;
provider owns host infrastructure. IaaS → customer patches OS; PaaS → customer
secures app runtime; SaaS → customer manages only user access & data
classification.
• Cloud Service Models – IaaS (EC2, GCE, Azure VM), PaaS (Elastic Beanstalk, Cloud
Run, App Service), SaaS (M365, Salesforce). Security control inheritance decreases
left-to-right.
• Security Reference Architectures – AWS Well-Architected Tool 2026 “Security” pillar,
Azure Cloud Adoption Framework (CAF) Secure methodology, Google Cloud
Landing-Zone v4 with “secure-by-default” guardrails.
,• Zero Trust – NIST 800-207 (2025 rev 2) “never trust, continuously verify”; enforce least
privilege per session; micro-segmentation with identity, device, network, workload
signals.
Domain 2 – Identity & Access Management (IAM)
• Principle of Least Privilege – enforce via AWS IAM Access Analyzer 2026 policy
optimization, Azure Entra Permissions Management, GCP Policy Analyzer.
• Federated Identity – SAML 2.0, OpenID Connect, OAuth 2.1 (FAPI 2.0 profile); SCIM 2.0
provisioning; workforce pools & workload identity federation for cross-cloud CI/CD.
• Multi-Factor Authentication – phishing-resistant FIDO2 passkeys now baseline for
privileged roles; conditional access policies evaluate device compliance, location, risk
score (Azure AD Protection, AWS IAM Identity Center).
• Role-Based + Attribute-Based Access Control – RBAC for coarse roles; ABAC for
dynamic tags (e.g., Project=PHI, Environment=Prod).
Domain 3 – Data Security & Compliance
• Encryption at Rest – AWS KMS dual-layer (hardware + software) keys, Azure Key Vault
HSM 2026 “Always Pluggable” HSM, GCP CMEK (Customer-Managed Encryption Key)
with external key manager (EKM).
• Encryption in Transit – TLS 1.3 mandatory; Perfect Forward Secrecy; mTLS service
mesh (Istio 1.23, AWS App Mesh, Azure Service Fabric).
• Key Management – envelope encryption, automatic key rotation ≤ 365 days,
bring-your-own-key (BYOK) vs hold-your-own-key (HYOK) for regulated data.
, • Data Loss Prevention – Microsoft Purview 2026 unified DLP, AWS Macie with S3
Object Lambda, Google Cloud DLP API with de-identification transforms.
• Compliance Mapping – GDPR (data subject rights), HIPAA §164.312 (audit controls,
encryption), PCI-DSS v4.0 (Req 3.5 key custodianship), ISO 27017 cloud extension,
FedRAMP High baselines updated 2026.
Domain 4 – Threat Detection & Incident Response
• Cloud Security Posture Management – CNAPP convergence (CrowdStrike, Prisma
Cloud 2026) checks CIS 1.9, NIST 800-53 r5, auto-remediation via Lambda/Azure
Functions.
• Cloud Workload Protection Platform – agentless scanning (eBPF), runtime container
protection, serverless layer-7 firewall.
• SIEM Integration – AWS CloudTrail Lake + GuardDuty 2026, Azure Sentinel UEBA,
Google Cloud SCC with Chronicle.
• Incident Response – customer responsibility to contain guest-OS & app layers;
run-books stored offline; use immutable audit logs (Object Lock, WORM).
Emerging 2026/2027 Topics
• AI/ML Security – Vertex AI Model Armor, AWS SageMaker Model Cards, supply-chain
scanning for ML models (ML-BOM).
• Quantum Risk – post-quantum TLS (Kyber) preview in AWS KMS, Azure managed CNG;
hybrid key exchange.
• Container & Serverless – Sigstore cosign, SBOM generation with SPDX 3.0, admission
controller policy (OPA Gatekeeper, Kyverno).
