WGU D485 DGN2 TASK 1: Cloud Security Implementation
Plan – Complete -Question Test Bank 2027
1. The Cloud Security Implementation Plan for SWBTL LLC primarily
focuses on securing which public cloud environment?
A) Azure Commercial
B) Azure Government
C) AWS GovCloud
D) Google Cloud Platform
*B) Azure Government *
Rationale: Azure Government provides the FedRAMP, DoD IL5, and FISMA
compliance necessary for SWBTL LLC's government contracts, while also
supporting PCI DSS for payment card transactions .
2. Which service model is recommended for SWBTL LLC under the
Azure Government environment?
A) SaaS
B) PaaS
C) IaaS
D) FaaS
*C) IaaS *
Rationale: IaaS provides the greatest control over the infrastructure,
operating systems, and security configurations, which is necessary for
meeting both FISMA and PCI DSS compliance requirements .
,3. The consultant who was leading SWBTL LLC's migration to Azure:
A) Completed the migration successfully
B) Abruptly quit, leaving the environment in disrepair
C) Was promoted within the company
D) Never started the migration
*B) Abruptly quit, leaving the environment in disrepair *
Rationale: The consultant hired to start and finish the migration abruptly
quit, leading to serious concern about the migration process and leaving the
Azure environment in need of serious repair .
4. SWBTL LLC must comply with which of the following compliance
frameworks?
A) FISMA only
B) PCI DSS only
C) Both FISMA and PCI DSS
D) HIPAA only
*C) Both FISMA and PCI DSS *
Rationale: SWBTL LLC must comply with FISMA due to U.S. government
contracts and PCI DSS due to daily payment card transactions .
5. Which Azure service should SWBTL LLC implement to enforce the
principle of least privilege by providing temporary, time-bound
administrative access?
,A) Azure Active Directory Identity Protection
B) Microsoft Entra ID Conditional Access
C) Microsoft Entra ID Privileged Identity Management (PIM)
D) Azure Role-Based Access Control (RBAC) permanent assignments
*C) Microsoft Entra ID Privileged Identity Management (PIM) *
Rationale: Microsoft Entra ID PIM provides "just-in-time" (JIT) privileged
access, allowing administrative roles to be active only when needed .
6. To protect administrative accounts from phishing attacks, which
authentication configuration should SWBTL LLC mandate?
A) Standard password with security questions
B) SMS-based one-time passcodes
C) Voice-call verification codes
D) Phishing-resistant Multi-Factor Authentication using FIDO2 security keys
*D) Phishing-resistant Multi-Factor Authentication using FIDO2
security keys *
Rationale: Phishing-resistant MFA using FIDO2 or certificate-based
authentication prevents attackers from intercepting tokens through proxy
sites, fulfilling strict federal and PCI DSS access control requirements .
7. Which Entra ID feature restricts cloud management portal access to
corporate-managed, compliant laptops?
A) Conditional Access Policies
B) Entra ID Connect
C) Azure App Registrations
D) Management Group RBAC
, *A) Conditional Access Policies *
Rationale: Conditional Access Policies act as an explicit policy engine that
evaluates signals (device state, user location, risk profile) before granting
access to cloud resources .
8. To isolate administrative duties, ensuring a user assigned to manage
virtual networks cannot view or alter database logs, the cloud architect
should implement:
A) Defense-in-depth
B) Separation of Duties
C) Absolute Authorization
D) Perimeter Securing
*B) Separation of Duties *
Rationale: Separation of duties splits critical responsibilities among different
roles to mitigate internal risks and prevent single-user system compromises .
9. What type of authorization mechanism is applied when assigning a
user the built-in "Storage Blob Data Contributor" role in Azure?
A) Attribute-Based Access Control (ABAC)
B) Role-Based Access Control (RBAC)
C) Discretionary Access Control (DAC)
D) Mandatory Access Control (MAC)
*B) Role-Based Access Control (RBAC) *
Rationale: Azure RBAC grants specific operational permissions over cloud
resources by mapping identities to pre-defined or custom security roles .
Plan – Complete -Question Test Bank 2027
1. The Cloud Security Implementation Plan for SWBTL LLC primarily
focuses on securing which public cloud environment?
A) Azure Commercial
B) Azure Government
C) AWS GovCloud
D) Google Cloud Platform
*B) Azure Government *
Rationale: Azure Government provides the FedRAMP, DoD IL5, and FISMA
compliance necessary for SWBTL LLC's government contracts, while also
supporting PCI DSS for payment card transactions .
2. Which service model is recommended for SWBTL LLC under the
Azure Government environment?
A) SaaS
B) PaaS
C) IaaS
D) FaaS
*C) IaaS *
Rationale: IaaS provides the greatest control over the infrastructure,
operating systems, and security configurations, which is necessary for
meeting both FISMA and PCI DSS compliance requirements .
,3. The consultant who was leading SWBTL LLC's migration to Azure:
A) Completed the migration successfully
B) Abruptly quit, leaving the environment in disrepair
C) Was promoted within the company
D) Never started the migration
*B) Abruptly quit, leaving the environment in disrepair *
Rationale: The consultant hired to start and finish the migration abruptly
quit, leading to serious concern about the migration process and leaving the
Azure environment in need of serious repair .
4. SWBTL LLC must comply with which of the following compliance
frameworks?
A) FISMA only
B) PCI DSS only
C) Both FISMA and PCI DSS
D) HIPAA only
*C) Both FISMA and PCI DSS *
Rationale: SWBTL LLC must comply with FISMA due to U.S. government
contracts and PCI DSS due to daily payment card transactions .
5. Which Azure service should SWBTL LLC implement to enforce the
principle of least privilege by providing temporary, time-bound
administrative access?
,A) Azure Active Directory Identity Protection
B) Microsoft Entra ID Conditional Access
C) Microsoft Entra ID Privileged Identity Management (PIM)
D) Azure Role-Based Access Control (RBAC) permanent assignments
*C) Microsoft Entra ID Privileged Identity Management (PIM) *
Rationale: Microsoft Entra ID PIM provides "just-in-time" (JIT) privileged
access, allowing administrative roles to be active only when needed .
6. To protect administrative accounts from phishing attacks, which
authentication configuration should SWBTL LLC mandate?
A) Standard password with security questions
B) SMS-based one-time passcodes
C) Voice-call verification codes
D) Phishing-resistant Multi-Factor Authentication using FIDO2 security keys
*D) Phishing-resistant Multi-Factor Authentication using FIDO2
security keys *
Rationale: Phishing-resistant MFA using FIDO2 or certificate-based
authentication prevents attackers from intercepting tokens through proxy
sites, fulfilling strict federal and PCI DSS access control requirements .
7. Which Entra ID feature restricts cloud management portal access to
corporate-managed, compliant laptops?
A) Conditional Access Policies
B) Entra ID Connect
C) Azure App Registrations
D) Management Group RBAC
, *A) Conditional Access Policies *
Rationale: Conditional Access Policies act as an explicit policy engine that
evaluates signals (device state, user location, risk profile) before granting
access to cloud resources .
8. To isolate administrative duties, ensuring a user assigned to manage
virtual networks cannot view or alter database logs, the cloud architect
should implement:
A) Defense-in-depth
B) Separation of Duties
C) Absolute Authorization
D) Perimeter Securing
*B) Separation of Duties *
Rationale: Separation of duties splits critical responsibilities among different
roles to mitigate internal risks and prevent single-user system compromises .
9. What type of authorization mechanism is applied when assigning a
user the built-in "Storage Blob Data Contributor" role in Azure?
A) Attribute-Based Access Control (ABAC)
B) Role-Based Access Control (RBAC)
C) Discretionary Access Control (DAC)
D) Mandatory Access Control (MAC)
*B) Role-Based Access Control (RBAC) *
Rationale: Azure RBAC grants specific operational permissions over cloud
resources by mapping identities to pre-defined or custom security roles .
