WGU D485 DGN2 Task 1: SWBTL LLC
Cloud Security Plan (Latest Exam Prep)
Questions and Well Graded Solutions
with Rationales Updated 2026-2027
Master the WGU D485 DGN2 Task 1 exam with this complete SWBTL LLC Cloud Security
Implementation Plan. This comprehensive study resource provides verified questions and
detailed rationales covering Microsoft Azure Government migration, RBAC, encryption, FISMA,
and PCI DSS compliance frameworks. Perfect for student review, this guide ensures a deep
understanding of cloud security architecture, data protection, and shared responsibility
models. Accelerate your preparation and ace your assessment today!
Cloud Architecture and Shared Responsibility
Which cloud service model places the maximum amount of operational and security
responsibility on the customer?
a) Software as a Service (SaaS)
b) Platform as a Service (PaaS)
c) Infrastructure as a Service (IaaS)
d) Database as a Service (DBaaS)
• Answer: c) Infrastructure as a Service (IaaS)
• Rationale: In an IaaS model, the provider only secures the physical infrastructure,
virtualization layer, and hardware. The customer is responsible for the operating
system, middleware, runtime, data, and applications.
2. Under the shared responsibility model, who is responsible for data governance and
classification in a public cloud environment?
a) The cloud service provider completely
b) The customer completely
c) The third-party auditor
d) Shared equally between provider and customer
• Answer: b) The customer completely
• Rationale: Regardless of the cloud deployment model (IaaS, PaaS, or SaaS), data
ownership, governance, and classification always remain the sole responsibility of
the customer.
3. Which deployment model provides exclusive cloud resources to a single organization
but is hosted and managed by a third-party provider off-premises?
a) Public Cloud
b) Hosted Private Cloud
c) Hybrid Cloud
d) Community Cloud
• Answer: b) Hosted Private Cloud
• Rationale: A hosted private cloud offers dedicated physical or logical infrastructure
to one specific organization while being physically located and maintained within a
provider's data center.
1|Page
,4. In a Platform as a Service (PaaS) model, which of the following is typically managed
by the cloud service provider?
a) Application code
b) Operating system patching
c) User access credentials
d) Data endpoints
• Answer: b) Operating system patching
• Rationale: PaaS abstracts the underlying operating system and infrastructure away
from the user, meaning the cloud provider handles OS security updates,
maintenance, and patching.
5. What is the primary benefit of deploying workloads in Azure Government compared
to standard Azure commercial regions?
a) Lower subscription and compute costs
b) Dedicated physical isolation and strict US citizen screening requirements
c) Faster deployment of cutting-edge preview features
d) Global geographic availability across all continents
• Answer: b) Dedicated physical isolation and strict US citizen screening
requirements
• Rationale: Azure Government is physically isolated from commercial Azure
networks and enforces strict background checks on personnel to meet stringent
federal security requirements.
6. Which cloud security concept emphasizes that an organization should not trust
anything inside or outside its perimeters and must verify every access request?
a) Defense in Depth
b) Zero Trust Architecture
c) Network Segmentation
d) Perimeter Defense
• Answer: b) Zero Trust Architecture
• Rationale: Zero Trust Architecture operates on the core principle of "never trust,
always verify," requiring explicit validation for every access attempt regardless of
origin.
7. When a customer shifts an application from on-premises to a SaaS solution, what
responsibility transfers entirely to the cloud provider?
a) Application security vulnerabilities and patching
b) Data access management and roles
c) Mobile device management configurations
d) Information asset classification
• Answer: a) Application security vulnerabilities and patching
• Rationale: In a SaaS model, the provider delivers the entire software stack. The
customer merely consumes the software, meaning application-level patching is
handled by the provider.
8. Which concept describes the ability of a cloud infrastructure to dynamically scale
security controls and resources up or down based on demand?
a) High Availability
b) Fault Tolerance
c) Elasticity
d) Redundancy
• Answer: c) Elasticity
2|Page
,• Rationale: Elasticity allows cloud computing resources to scale dynamically to
match demand, ensuring security appliances or firewalls can scale up to handle
sudden spikes in traffic.
9. What is a primary security risk associated with "Shadow IT" in an enterprise cloud
environment?
a) Increased infrastructure costs
b) Decreased network latency
c) Unauthorized data storage outside corporate security controls
d) Automated compliance logging failures
• Answer: c) Unauthorized data storage outside corporate security controls
• Rationale: Shadow IT refers to employees using cloud services without IT
department approval, leading to corporate data being exposed on unmonitored or
non-compliant platforms.
10. Which cloud security mechanism ensures that data or resources cannot be modified
or deleted without authorization, fulfilling the 'Integrity' leg of the CIA triad?
a) Multi-Factor Authentication
b) Cryptographic Hashing and Digital Signatures
c) Transport Layer Security
d) Data Loss Prevention policies
• Answer: b) Cryptographic Hashing and Digital Signatures
• Rationale: Hashing and digital signatures allow systems to verify that a file,
configuration, or message has not been altered or tampered with during transit or
storage.
11. Under the shared responsibility model for a hybrid cloud connection, who is
responsible for configuring the on-premises edge router connecting to Azure
ExpressRoute?
a) Microsoft Azure Support
b) The enterprise customer
c) The internet service provider exclusively
d) The regulatory auditor
• Answer: b) The enterprise customer
• Rationale: The customer retains absolute control and responsibility for configuring,
maintaining, and securing their own on-premises infrastructure and boundary
routers.
12. Which core cloud design principle minimizes the blast radius of a security breach by
isolating workloads into distinct segments?
a) Horizontal Scaling
b) Loose Coupling
c) Compartmentalization
d) Monolithic Design
• Answer: c) Compartmentalization
• Rationale: Compartmentalization or micro-segmentation divides networks and
applications into isolated zones, preventing an attacker from moving laterally across
the infrastructure.
13. What type of control is an automated alert generated when an unauthorized user
attempts to change an Azure Network Security Group configuration?
a) Preventive Control
b) Detective Control
c) Corrective Control
d) Deterrent Control
3|Page
, • Answer: b) Detective Control
• Rationale: Detective controls focus on identifying and alerting security personnel to
unauthorized or anomalous activity after or during its occurrence.
14. Why is hypervisor vulnerability management critical for public cloud service
providers?
a) It prevents users from consuming too much storage bandwidth
b) It prevents escape attacks where a malicious user breaches tenant isolation
c) It automates billing tracking for virtual machine usage
d) It optimizes database query response times
• Answer: b) It prevents escape attacks where a malicious user breaches tenant
isolation
• Rationale: A hypervisor escape allows an attacker on one virtual machine to access
the underlying host physical server or other guest virtual machines, breaking multi-
tenancy boundaries.
15. Which cloud infrastructure component represents a distinct physical data center
location equipped with independent power, cooling, and networking?
a) Availability Zone
b) Resource Group
c) Management Group
d) Region Pair
• Answer: a) Availability Zone
• Rationale: Availability Zones are unique physical locations within an Azure region
designed to protect applications from data center failures through physical isolation.
16. Who is responsible for physical security controls, such as biometric scanners and
CCTV, at an Azure Government data center?
a) The customer's physical security team
b) Microsoft Azure Government operations team
c) The Federal Bureau of Investigation (FBI)
d) Local law enforcement agencies
• Answer: b) Microsoft Azure Government operations team
• Rationale: Physical security of the cloud data centers is entirely handled by the
cloud provider in public and government cloud deployment architectures.
17. What is the primary security objective of implementing a Cloud Access Security
Broker (CASB)?
a) To block physical access to corporate data centers
b) To enforce security, compliance, and governance policies between cloud
consumers and cloud providers
c) To accelerate network data transfers using caching
d) To replace local firewalls with virtual private networks
• Answer: b) To enforce security, compliance, and governance policies between
cloud consumers and cloud providers
• Rationale: A CASB sits between cloud users and cloud applications to monitor
activity, enforce security policies, and detect shadow IT or data exfiltration.
18. Which concept describes an architecture where an organization uses multiple cloud
computing services from different providers to avoid vendor lock-in?
a) Hybrid Cloud
b) Multi-Cloud
c) Distributed Grid
d) Community Cloud
• Answer: b) Multi-Cloud
4|Page
Cloud Security Plan (Latest Exam Prep)
Questions and Well Graded Solutions
with Rationales Updated 2026-2027
Master the WGU D485 DGN2 Task 1 exam with this complete SWBTL LLC Cloud Security
Implementation Plan. This comprehensive study resource provides verified questions and
detailed rationales covering Microsoft Azure Government migration, RBAC, encryption, FISMA,
and PCI DSS compliance frameworks. Perfect for student review, this guide ensures a deep
understanding of cloud security architecture, data protection, and shared responsibility
models. Accelerate your preparation and ace your assessment today!
Cloud Architecture and Shared Responsibility
Which cloud service model places the maximum amount of operational and security
responsibility on the customer?
a) Software as a Service (SaaS)
b) Platform as a Service (PaaS)
c) Infrastructure as a Service (IaaS)
d) Database as a Service (DBaaS)
• Answer: c) Infrastructure as a Service (IaaS)
• Rationale: In an IaaS model, the provider only secures the physical infrastructure,
virtualization layer, and hardware. The customer is responsible for the operating
system, middleware, runtime, data, and applications.
2. Under the shared responsibility model, who is responsible for data governance and
classification in a public cloud environment?
a) The cloud service provider completely
b) The customer completely
c) The third-party auditor
d) Shared equally between provider and customer
• Answer: b) The customer completely
• Rationale: Regardless of the cloud deployment model (IaaS, PaaS, or SaaS), data
ownership, governance, and classification always remain the sole responsibility of
the customer.
3. Which deployment model provides exclusive cloud resources to a single organization
but is hosted and managed by a third-party provider off-premises?
a) Public Cloud
b) Hosted Private Cloud
c) Hybrid Cloud
d) Community Cloud
• Answer: b) Hosted Private Cloud
• Rationale: A hosted private cloud offers dedicated physical or logical infrastructure
to one specific organization while being physically located and maintained within a
provider's data center.
1|Page
,4. In a Platform as a Service (PaaS) model, which of the following is typically managed
by the cloud service provider?
a) Application code
b) Operating system patching
c) User access credentials
d) Data endpoints
• Answer: b) Operating system patching
• Rationale: PaaS abstracts the underlying operating system and infrastructure away
from the user, meaning the cloud provider handles OS security updates,
maintenance, and patching.
5. What is the primary benefit of deploying workloads in Azure Government compared
to standard Azure commercial regions?
a) Lower subscription and compute costs
b) Dedicated physical isolation and strict US citizen screening requirements
c) Faster deployment of cutting-edge preview features
d) Global geographic availability across all continents
• Answer: b) Dedicated physical isolation and strict US citizen screening
requirements
• Rationale: Azure Government is physically isolated from commercial Azure
networks and enforces strict background checks on personnel to meet stringent
federal security requirements.
6. Which cloud security concept emphasizes that an organization should not trust
anything inside or outside its perimeters and must verify every access request?
a) Defense in Depth
b) Zero Trust Architecture
c) Network Segmentation
d) Perimeter Defense
• Answer: b) Zero Trust Architecture
• Rationale: Zero Trust Architecture operates on the core principle of "never trust,
always verify," requiring explicit validation for every access attempt regardless of
origin.
7. When a customer shifts an application from on-premises to a SaaS solution, what
responsibility transfers entirely to the cloud provider?
a) Application security vulnerabilities and patching
b) Data access management and roles
c) Mobile device management configurations
d) Information asset classification
• Answer: a) Application security vulnerabilities and patching
• Rationale: In a SaaS model, the provider delivers the entire software stack. The
customer merely consumes the software, meaning application-level patching is
handled by the provider.
8. Which concept describes the ability of a cloud infrastructure to dynamically scale
security controls and resources up or down based on demand?
a) High Availability
b) Fault Tolerance
c) Elasticity
d) Redundancy
• Answer: c) Elasticity
2|Page
,• Rationale: Elasticity allows cloud computing resources to scale dynamically to
match demand, ensuring security appliances or firewalls can scale up to handle
sudden spikes in traffic.
9. What is a primary security risk associated with "Shadow IT" in an enterprise cloud
environment?
a) Increased infrastructure costs
b) Decreased network latency
c) Unauthorized data storage outside corporate security controls
d) Automated compliance logging failures
• Answer: c) Unauthorized data storage outside corporate security controls
• Rationale: Shadow IT refers to employees using cloud services without IT
department approval, leading to corporate data being exposed on unmonitored or
non-compliant platforms.
10. Which cloud security mechanism ensures that data or resources cannot be modified
or deleted without authorization, fulfilling the 'Integrity' leg of the CIA triad?
a) Multi-Factor Authentication
b) Cryptographic Hashing and Digital Signatures
c) Transport Layer Security
d) Data Loss Prevention policies
• Answer: b) Cryptographic Hashing and Digital Signatures
• Rationale: Hashing and digital signatures allow systems to verify that a file,
configuration, or message has not been altered or tampered with during transit or
storage.
11. Under the shared responsibility model for a hybrid cloud connection, who is
responsible for configuring the on-premises edge router connecting to Azure
ExpressRoute?
a) Microsoft Azure Support
b) The enterprise customer
c) The internet service provider exclusively
d) The regulatory auditor
• Answer: b) The enterprise customer
• Rationale: The customer retains absolute control and responsibility for configuring,
maintaining, and securing their own on-premises infrastructure and boundary
routers.
12. Which core cloud design principle minimizes the blast radius of a security breach by
isolating workloads into distinct segments?
a) Horizontal Scaling
b) Loose Coupling
c) Compartmentalization
d) Monolithic Design
• Answer: c) Compartmentalization
• Rationale: Compartmentalization or micro-segmentation divides networks and
applications into isolated zones, preventing an attacker from moving laterally across
the infrastructure.
13. What type of control is an automated alert generated when an unauthorized user
attempts to change an Azure Network Security Group configuration?
a) Preventive Control
b) Detective Control
c) Corrective Control
d) Deterrent Control
3|Page
, • Answer: b) Detective Control
• Rationale: Detective controls focus on identifying and alerting security personnel to
unauthorized or anomalous activity after or during its occurrence.
14. Why is hypervisor vulnerability management critical for public cloud service
providers?
a) It prevents users from consuming too much storage bandwidth
b) It prevents escape attacks where a malicious user breaches tenant isolation
c) It automates billing tracking for virtual machine usage
d) It optimizes database query response times
• Answer: b) It prevents escape attacks where a malicious user breaches tenant
isolation
• Rationale: A hypervisor escape allows an attacker on one virtual machine to access
the underlying host physical server or other guest virtual machines, breaking multi-
tenancy boundaries.
15. Which cloud infrastructure component represents a distinct physical data center
location equipped with independent power, cooling, and networking?
a) Availability Zone
b) Resource Group
c) Management Group
d) Region Pair
• Answer: a) Availability Zone
• Rationale: Availability Zones are unique physical locations within an Azure region
designed to protect applications from data center failures through physical isolation.
16. Who is responsible for physical security controls, such as biometric scanners and
CCTV, at an Azure Government data center?
a) The customer's physical security team
b) Microsoft Azure Government operations team
c) The Federal Bureau of Investigation (FBI)
d) Local law enforcement agencies
• Answer: b) Microsoft Azure Government operations team
• Rationale: Physical security of the cloud data centers is entirely handled by the
cloud provider in public and government cloud deployment architectures.
17. What is the primary security objective of implementing a Cloud Access Security
Broker (CASB)?
a) To block physical access to corporate data centers
b) To enforce security, compliance, and governance policies between cloud
consumers and cloud providers
c) To accelerate network data transfers using caching
d) To replace local firewalls with virtual private networks
• Answer: b) To enforce security, compliance, and governance policies between
cloud consumers and cloud providers
• Rationale: A CASB sits between cloud users and cloud applications to monitor
activity, enforce security policies, and detect shadow IT or data exfiltration.
18. Which concept describes an architecture where an organization uses multiple cloud
computing services from different providers to avoid vendor lock-in?
a) Hybrid Cloud
b) Multi-Cloud
c) Distributed Grid
d) Community Cloud
• Answer: b) Multi-Cloud
4|Page
