WGU C838 MANAGING CLOUD SECURITY FINAL EXAM OA 100
QUESTIONS AND ANSWERS LATEST 2027|
AGRADE
You are the security subject matter expert (SME) for an organization
̣ considering ̣ a transition from the legacy
̣ environment into a hosted cloud provider 's data center. One of the challeng es
̣
you 're facing ̣ is whether the cloud provider will be able to comply with the existing ̣ legislative
̣ and contractual frameworks your organization
̣ is required to follow. This is a issue.
a. Resiliency
b. Privacy
c. Performance
d. Regulatory
̣
D
76. You are the security subject matter expert (SME) for an org anization ̣ considering ̣ a transition from the legacy
̣ environ ment into a hosted cloud provider 's data center. One of the
challenge ̣ s you 're facing ̣ is whether the cloud provider will be able to allow your org a ̣ nization to substantiate and determine with some assurance that all of the contract terms are being ̣ met.
This is a(n)
issue.
a. Regulatory
̣
b. Privacy
c. Resiliency
d. Auditability
D
77. Encryption is an essential tool for affording ̣ security to cloud-based operations. While it is possible to encrypt every system, piece of data, and transaction that takes place on the cloud,
why might ̣ that not be the optimum choice for an organization? ̣
a. K ey length ̣ variances don 't provide any actual additional security.
b. It would cause additional processing ̣ overhead and time delay.
c. It might ̣ result in vendor lockout.
d. The data subjects might ̣ be upset by this.
B
78. Encryption is an essential tool for affording ̣ security to cloud-based operations. While it is possible to encrypt every system, piece of data, and transaction that takes place on the cloud,
why might ̣ that not be the optimum choice for an organization? ̣
a. It could increase the possibility of physical theft.
b. Encryption won 't work through ̣ out the environment.
c. The protection might ̣ be disproportionate to the value of the asset(s).
d. Users will be able to see everything ̣ within the organization. ̣
C
79. Which of the following ̣ is not an element of the identification component of identity and access manag ement ̣ (IAM)?
a. Provisioning ̣
b. Manage ̣ ment
c. Discretion
d. Deprovisioning ̣
C
80. Which of the following ̣ entities is most likely to play a vital role in the identity provisioning ̣ aspect of a user 's experience in an orga ̣ nization?
a. The accounting ̣ department
b. The human resources (HR) office
c. The maintenance team
d. The purchasing ̣ office
B
81. Why is the deprovisioning ̣ element of the identification component of identity and access manag e ̣ ment (IAM) so important?
a. Extra accounts cost so much extra money.
b. Open but unassign ̣ ed accounts are vulnerabilities.
c. User tracking ̣ is essential to performance.
d. Encryption has to be
maintained. B
82. All of the following ̣ are reasons to perform review and maintenance actions on user accounts except .
a. To determine whether the user still needs the same access
b. To determine whether the user is still with the orga ̣ nization
c. To determine whether the data set is still applicable to the user 's role
d. To determine whether the user is still performing ̣ well
D
83. Who should be involved in review and maintenance of user
accounts/access?
a. The user 's manager ̣
b. The security manage ̣ r
c. The accounting ̣ department
d. The incident response team
A
84. Which of the following ̣ protocols is most applicable to the identification process aspect of identity and access manag ement ̣ (IAM)?
a. Secure Sockets Layer (SSL)
b. Internet Protocol security (IPsec)
c. Lightweig
̣ ht
̣ Directory Access Protocol (LDAP)
d. Amorphous ancillary data transmission (AADT)
C
85. Privileged ̣ user (administrators, managers, ̣ and so forth) accounts need to be reviewed more closely than basic user accounts. Why is this?
a. Privilege ̣ d users have more encryption keys.
b. Regular ̣ users are more trustworthy.
c. There are extra controls on privileged ̣ user accounts.
d. Privileged ̣ users can cause more damage ̣ to the
organization.
̣ D
86. The additional review activities that migh ̣ t be performed for privilege
̣ d user accounts could include all of the following ̣ except .
a. Deeper personnel background ̣ checks
b. Review of personal financial accounts for privileged ̣ users
c. More frequent reviews of the necessity for access
d. Pat-down checks of privileged ̣ users to deter againsṭ physical
theft D
87. If personal financial account reviews are performed as an additional review control for privileg ed ̣ users, which of the following ̣ characteristics is least likely to be a useful indicator for
review purposes?
a. Too much money in the account
b. Too little money in the account
c. The bank branch being ̣ used by the privileged ̣ user
d. Specific senders/recipients
C
88. How often should the accounts of privileged ̣ users be reviewed?
a. Annually
b. Twice a year
c. Monthly
d. More often than regular ̣ user account
reviews D
89. Privilege ̣ d user account access should be .
a. Temporary
b. Pervasive
c. Thorough ̣
d. Granular
A
, WGU C838 MANAGING CLOUD SECURITY FINAL EXAM OA 100
QUESTIONS AND ANSWERS LATEST 2027|
AGRADE
90. The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to org anizations ̣ participating ̣ in cloud computing.̣ According ̣ to the CSA 's Notorious Nine list,
data breaches can be .
a. Overt or covert
b. International or subterranean
c. From internal or external sources
d. Voluminous or specific
C
91. The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to org anizations ̣ participating ̣ i n cloud computing.̣ According ̣ to the CSA, an organization
̣
that operates in the cloud environment and suffers a data breach may be required to .
a. Notify affected users
b. Reapply for cloud service
c. Scrub all affected physical memory
d. Change ̣ regulatory
̣ frameworks
A
92. The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to org anizations ̣ participating ̣ in cloud computing.̣ According ̣ to the CSA, an organization
̣
that suffers a data breach might ̣ suffer all of the following ̣ negative
̣ effects except .
a. Cost of compliance with notification laws
b. Loss of public perception/goodwill ̣
c. Loss of market share
d. Cost of detection
D
93. The Cloud Security Alliance (CSA) publishes, the Notorious Nine, a list of common threats to org anizations ̣ participating ̣ in cloud computing.̣ According ̣ to the CSA, in the event of a
data breach, a cloud customer will likely need to comply with all the following ̣ data breach notification requirements except .
a. Multiple state laws
b. Contractual notification requirements
c. All standards-based notification schemes
d. Any applicable federal
regulations
̣ C
94. The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to org anizations ̣ participating ̣ i n cloud computing.̣ According ̣ to the CSA, data loss can be
suffered as a result of activity.
a. Malicious or inadvertent
b. Casual or explicit
c. Web-based or stand-alone
d. Manage ̣ d or
independent A
95. The Cloud Security Alliance (CSA) publishes, the Notorious Nine, a list of common threats to org a ̣ nizations participating ̣ in cloud computing.̣ According ̣ to the CSA, all of the following ̣
activity can result in data loss except .
a. Misplaced crypto keys
b. Improper policy
c. Ineffectual backup procedures
d. Accidental overwrite
B
96. The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to org a ̣ nizations participating ̣ i n cloud computing.̣ According ̣ to the CSA, service traffic high ̣
jacking ̣ can affect all of the following ̣ portions of the CIA triad except .
a. Confidentiality
b. Integrity
̣
c. Availability
d. None. Service traffic high ̣ jacking ̣ can 't affect any portion of the CIA
triad. D
97. The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to org anizatio ̣ ns participating ̣ in cloud computing.̣ The CSA recommends the prohibition of
in order to diminish the likelihood of account/service traffic high ̣ jacking.̣
a. All user activity
b. Sharing ̣ account credentials between users and services
c. Multifactor authentication
d. Interstate commerce
B
98. The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to org a ̣ nizations participating ̣ i n cloud computing.̣ According ̣ to the CSA, which aspect of
cloud computing ̣ makes it particularly susceptible to account/service traffic hig h ̣ jacking?
̣
a. Scalability
b. Metered service
c. Remote access
d. Pooled resources
C
99. The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to org anizations ̣ participating ̣ i n cloud computing.̣ According ̣ to the CSA, what is one reason
the threat of insecure interfaces and APIs is so prevalent in cloud computing ? ̣
a. Most of the cloud customer 's interaction with resources will be performed through ̣ APIs.
b. APIs are inherently insecure.
c. Attackers have already published vulnerabilities for all known APIs.
d. APIs are known
carcinogens. ̣ A/B
100. .The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to organizations ̣ participating ̣ in cloud computing.̣ According ̣ to the CSA, what is one reason
the threat of insecure interfaces and APIs is so prevalent in cloud computing ? ̣
a. Cloud customers and third parties are continually enhancing ̣ and modifying ̣ APIs.
b. APIs can have automated settings. ̣
c. It is impossible to uninstall APIs.
d. APIs are a form of malware.
A
75. Software developers should receive cloud-specific training ̣ that high ̣ ligḥ ts the specific challenge
̣ s involved with having ̣ a production environment that operates in the cloud. One of
these challenges ̣ is .
a. Lack of management ̣ oversight ̣
b. Additional workload in creating ̣ go ̣ vernance for two environments (the cloud data center and client devices)
c. Increased threat of malware
d. The need for process isolation
D
76. Which security technique is most preferable when creating ̣ a limited functionality for customer service personnel to review account data related to sales made to your clientele?
a. Anonymization
b. Masking ̣
c. Encryption
d. Training ̣
B
77. At which phase of the software development life cycle (SDLC) is user involvement most crucial?
a. Define
b. Design ̣
c. Develop
d. Test
A
78. At which phase of the SDLC should security personnel first be involved?
a. Define
QUESTIONS AND ANSWERS LATEST 2027|
AGRADE
You are the security subject matter expert (SME) for an organization
̣ considering ̣ a transition from the legacy
̣ environment into a hosted cloud provider 's data center. One of the challeng es
̣
you 're facing ̣ is whether the cloud provider will be able to comply with the existing ̣ legislative
̣ and contractual frameworks your organization
̣ is required to follow. This is a issue.
a. Resiliency
b. Privacy
c. Performance
d. Regulatory
̣
D
76. You are the security subject matter expert (SME) for an org anization ̣ considering ̣ a transition from the legacy
̣ environ ment into a hosted cloud provider 's data center. One of the
challenge ̣ s you 're facing ̣ is whether the cloud provider will be able to allow your org a ̣ nization to substantiate and determine with some assurance that all of the contract terms are being ̣ met.
This is a(n)
issue.
a. Regulatory
̣
b. Privacy
c. Resiliency
d. Auditability
D
77. Encryption is an essential tool for affording ̣ security to cloud-based operations. While it is possible to encrypt every system, piece of data, and transaction that takes place on the cloud,
why might ̣ that not be the optimum choice for an organization? ̣
a. K ey length ̣ variances don 't provide any actual additional security.
b. It would cause additional processing ̣ overhead and time delay.
c. It might ̣ result in vendor lockout.
d. The data subjects might ̣ be upset by this.
B
78. Encryption is an essential tool for affording ̣ security to cloud-based operations. While it is possible to encrypt every system, piece of data, and transaction that takes place on the cloud,
why might ̣ that not be the optimum choice for an organization? ̣
a. It could increase the possibility of physical theft.
b. Encryption won 't work through ̣ out the environment.
c. The protection might ̣ be disproportionate to the value of the asset(s).
d. Users will be able to see everything ̣ within the organization. ̣
C
79. Which of the following ̣ is not an element of the identification component of identity and access manag ement ̣ (IAM)?
a. Provisioning ̣
b. Manage ̣ ment
c. Discretion
d. Deprovisioning ̣
C
80. Which of the following ̣ entities is most likely to play a vital role in the identity provisioning ̣ aspect of a user 's experience in an orga ̣ nization?
a. The accounting ̣ department
b. The human resources (HR) office
c. The maintenance team
d. The purchasing ̣ office
B
81. Why is the deprovisioning ̣ element of the identification component of identity and access manag e ̣ ment (IAM) so important?
a. Extra accounts cost so much extra money.
b. Open but unassign ̣ ed accounts are vulnerabilities.
c. User tracking ̣ is essential to performance.
d. Encryption has to be
maintained. B
82. All of the following ̣ are reasons to perform review and maintenance actions on user accounts except .
a. To determine whether the user still needs the same access
b. To determine whether the user is still with the orga ̣ nization
c. To determine whether the data set is still applicable to the user 's role
d. To determine whether the user is still performing ̣ well
D
83. Who should be involved in review and maintenance of user
accounts/access?
a. The user 's manager ̣
b. The security manage ̣ r
c. The accounting ̣ department
d. The incident response team
A
84. Which of the following ̣ protocols is most applicable to the identification process aspect of identity and access manag ement ̣ (IAM)?
a. Secure Sockets Layer (SSL)
b. Internet Protocol security (IPsec)
c. Lightweig
̣ ht
̣ Directory Access Protocol (LDAP)
d. Amorphous ancillary data transmission (AADT)
C
85. Privileged ̣ user (administrators, managers, ̣ and so forth) accounts need to be reviewed more closely than basic user accounts. Why is this?
a. Privilege ̣ d users have more encryption keys.
b. Regular ̣ users are more trustworthy.
c. There are extra controls on privileged ̣ user accounts.
d. Privileged ̣ users can cause more damage ̣ to the
organization.
̣ D
86. The additional review activities that migh ̣ t be performed for privilege
̣ d user accounts could include all of the following ̣ except .
a. Deeper personnel background ̣ checks
b. Review of personal financial accounts for privileged ̣ users
c. More frequent reviews of the necessity for access
d. Pat-down checks of privileged ̣ users to deter againsṭ physical
theft D
87. If personal financial account reviews are performed as an additional review control for privileg ed ̣ users, which of the following ̣ characteristics is least likely to be a useful indicator for
review purposes?
a. Too much money in the account
b. Too little money in the account
c. The bank branch being ̣ used by the privileged ̣ user
d. Specific senders/recipients
C
88. How often should the accounts of privileged ̣ users be reviewed?
a. Annually
b. Twice a year
c. Monthly
d. More often than regular ̣ user account
reviews D
89. Privilege ̣ d user account access should be .
a. Temporary
b. Pervasive
c. Thorough ̣
d. Granular
A
, WGU C838 MANAGING CLOUD SECURITY FINAL EXAM OA 100
QUESTIONS AND ANSWERS LATEST 2027|
AGRADE
90. The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to org anizations ̣ participating ̣ in cloud computing.̣ According ̣ to the CSA 's Notorious Nine list,
data breaches can be .
a. Overt or covert
b. International or subterranean
c. From internal or external sources
d. Voluminous or specific
C
91. The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to org anizations ̣ participating ̣ i n cloud computing.̣ According ̣ to the CSA, an organization
̣
that operates in the cloud environment and suffers a data breach may be required to .
a. Notify affected users
b. Reapply for cloud service
c. Scrub all affected physical memory
d. Change ̣ regulatory
̣ frameworks
A
92. The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to org anizations ̣ participating ̣ in cloud computing.̣ According ̣ to the CSA, an organization
̣
that suffers a data breach might ̣ suffer all of the following ̣ negative
̣ effects except .
a. Cost of compliance with notification laws
b. Loss of public perception/goodwill ̣
c. Loss of market share
d. Cost of detection
D
93. The Cloud Security Alliance (CSA) publishes, the Notorious Nine, a list of common threats to org anizations ̣ participating ̣ in cloud computing.̣ According ̣ to the CSA, in the event of a
data breach, a cloud customer will likely need to comply with all the following ̣ data breach notification requirements except .
a. Multiple state laws
b. Contractual notification requirements
c. All standards-based notification schemes
d. Any applicable federal
regulations
̣ C
94. The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to org anizations ̣ participating ̣ i n cloud computing.̣ According ̣ to the CSA, data loss can be
suffered as a result of activity.
a. Malicious or inadvertent
b. Casual or explicit
c. Web-based or stand-alone
d. Manage ̣ d or
independent A
95. The Cloud Security Alliance (CSA) publishes, the Notorious Nine, a list of common threats to org a ̣ nizations participating ̣ in cloud computing.̣ According ̣ to the CSA, all of the following ̣
activity can result in data loss except .
a. Misplaced crypto keys
b. Improper policy
c. Ineffectual backup procedures
d. Accidental overwrite
B
96. The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to org a ̣ nizations participating ̣ i n cloud computing.̣ According ̣ to the CSA, service traffic high ̣
jacking ̣ can affect all of the following ̣ portions of the CIA triad except .
a. Confidentiality
b. Integrity
̣
c. Availability
d. None. Service traffic high ̣ jacking ̣ can 't affect any portion of the CIA
triad. D
97. The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to org anizatio ̣ ns participating ̣ in cloud computing.̣ The CSA recommends the prohibition of
in order to diminish the likelihood of account/service traffic high ̣ jacking.̣
a. All user activity
b. Sharing ̣ account credentials between users and services
c. Multifactor authentication
d. Interstate commerce
B
98. The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to org a ̣ nizations participating ̣ i n cloud computing.̣ According ̣ to the CSA, which aspect of
cloud computing ̣ makes it particularly susceptible to account/service traffic hig h ̣ jacking?
̣
a. Scalability
b. Metered service
c. Remote access
d. Pooled resources
C
99. The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to org anizations ̣ participating ̣ i n cloud computing.̣ According ̣ to the CSA, what is one reason
the threat of insecure interfaces and APIs is so prevalent in cloud computing ? ̣
a. Most of the cloud customer 's interaction with resources will be performed through ̣ APIs.
b. APIs are inherently insecure.
c. Attackers have already published vulnerabilities for all known APIs.
d. APIs are known
carcinogens. ̣ A/B
100. .The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to organizations ̣ participating ̣ in cloud computing.̣ According ̣ to the CSA, what is one reason
the threat of insecure interfaces and APIs is so prevalent in cloud computing ? ̣
a. Cloud customers and third parties are continually enhancing ̣ and modifying ̣ APIs.
b. APIs can have automated settings. ̣
c. It is impossible to uninstall APIs.
d. APIs are a form of malware.
A
75. Software developers should receive cloud-specific training ̣ that high ̣ ligḥ ts the specific challenge
̣ s involved with having ̣ a production environment that operates in the cloud. One of
these challenges ̣ is .
a. Lack of management ̣ oversight ̣
b. Additional workload in creating ̣ go ̣ vernance for two environments (the cloud data center and client devices)
c. Increased threat of malware
d. The need for process isolation
D
76. Which security technique is most preferable when creating ̣ a limited functionality for customer service personnel to review account data related to sales made to your clientele?
a. Anonymization
b. Masking ̣
c. Encryption
d. Training ̣
B
77. At which phase of the software development life cycle (SDLC) is user involvement most crucial?
a. Define
b. Design ̣
c. Develop
d. Test
A
78. At which phase of the SDLC should security personnel first be involved?
a. Define
