WGU D320 – Managing Cloud Security
Final Prep Exam (Latest Update
2026/2027) Questions and Verified
Answers | 100% Correct | Grade A.
1. Which cloud security principle focuses on granting users only the
permissions necessary to perform their job functions?
A. Defense in depth
B. Security through obscurity
C. Principle of least privilege
D. Shared responsibility
Rationale: The principle of least privilege limits user permissions to only
those required for assigned responsibilities. This reduces the attack
surface, minimizes the risk of accidental or malicious actions, and helps
contain damage if an account is compromised. It is a foundational
concept in identity and access management (IAM).
2. Which cloud deployment model provides infrastructure
exclusively for a single organization?
A. Public cloud
B. Private cloud
,C. Hybrid cloud
D. Community cloud
Rationale: A private cloud is dedicated to one organization and offers
greater control over security, compliance, and customization. Although
it may involve higher costs than public cloud environments, it is often
selected for organizations with strict regulatory or security
requirements.
3. What is the primary responsibility of a cloud customer in the
Infrastructure as a Service (IaaS) model?
A. Maintaining physical servers
B. Managing the cloud provider's facilities
C. Securing the operating system, applications, and data
D. Replacing failed hardware
Rationale: Under IaaS, the cloud provider manages the physical
infrastructure while customers are responsible for securing operating
systems, applications, user accounts, configurations, and stored data.
Understanding the shared responsibility model is essential for cloud
security.
4. Which security control is considered a preventive control?
A. Audit log review
B. Security information and event management (SIEM)
C. Multi-factor authentication (MFA)
D. Incident report
,Rationale: Preventive controls stop security incidents before they occur.
Multi-factor authentication significantly reduces the likelihood of
unauthorized access by requiring additional verification beyond a
password.
5. What is the primary purpose of encryption at rest?
A. Protect data traveling across networks
B. Protect stored data from unauthorized access
C. Improve storage performance
D. Compress files
Rationale: Encryption at rest protects stored information on disks,
databases, and storage devices. If storage media is stolen or improperly
accessed, encrypted data remains unreadable without the appropriate
decryption keys.
6. Which Identity and Access Management (IAM) feature allows
temporary access credentials?
A. Static passwords
B. Local user accounts
C. Security tokens or temporary credentials
D. Shared administrator accounts
Rationale: Temporary credentials reduce long-term credential exposure
and are commonly used for applications, federated identities, and
privileged operations. They automatically expire, lowering the risk
associated with compromised credentials.
, 7. Which attack attempts to overwhelm cloud resources and make
services unavailable?
A. SQL injection
B. Cross-site scripting
C. Distributed Denial-of-Service (DDoS)
D. Phishing
Rationale: A DDoS attack floods systems with excessive traffic,
consuming resources until legitimate users can no longer access
services. Cloud providers often offer DDoS mitigation services to absorb
and filter malicious traffic.
8. What is the primary goal of network segmentation?
A. Increase internet bandwidth
B. Limit the spread of security threats between network segments
C. Reduce storage requirements
D. Simplify password management
Rationale: Network segmentation divides a network into smaller zones,
reducing lateral movement by attackers and containing security
incidents. It also helps organizations apply security policies based on
business requirements.
9. Which cloud security technology monitors activity and generates
alerts based on suspicious events?
Final Prep Exam (Latest Update
2026/2027) Questions and Verified
Answers | 100% Correct | Grade A.
1. Which cloud security principle focuses on granting users only the
permissions necessary to perform their job functions?
A. Defense in depth
B. Security through obscurity
C. Principle of least privilege
D. Shared responsibility
Rationale: The principle of least privilege limits user permissions to only
those required for assigned responsibilities. This reduces the attack
surface, minimizes the risk of accidental or malicious actions, and helps
contain damage if an account is compromised. It is a foundational
concept in identity and access management (IAM).
2. Which cloud deployment model provides infrastructure
exclusively for a single organization?
A. Public cloud
B. Private cloud
,C. Hybrid cloud
D. Community cloud
Rationale: A private cloud is dedicated to one organization and offers
greater control over security, compliance, and customization. Although
it may involve higher costs than public cloud environments, it is often
selected for organizations with strict regulatory or security
requirements.
3. What is the primary responsibility of a cloud customer in the
Infrastructure as a Service (IaaS) model?
A. Maintaining physical servers
B. Managing the cloud provider's facilities
C. Securing the operating system, applications, and data
D. Replacing failed hardware
Rationale: Under IaaS, the cloud provider manages the physical
infrastructure while customers are responsible for securing operating
systems, applications, user accounts, configurations, and stored data.
Understanding the shared responsibility model is essential for cloud
security.
4. Which security control is considered a preventive control?
A. Audit log review
B. Security information and event management (SIEM)
C. Multi-factor authentication (MFA)
D. Incident report
,Rationale: Preventive controls stop security incidents before they occur.
Multi-factor authentication significantly reduces the likelihood of
unauthorized access by requiring additional verification beyond a
password.
5. What is the primary purpose of encryption at rest?
A. Protect data traveling across networks
B. Protect stored data from unauthorized access
C. Improve storage performance
D. Compress files
Rationale: Encryption at rest protects stored information on disks,
databases, and storage devices. If storage media is stolen or improperly
accessed, encrypted data remains unreadable without the appropriate
decryption keys.
6. Which Identity and Access Management (IAM) feature allows
temporary access credentials?
A. Static passwords
B. Local user accounts
C. Security tokens or temporary credentials
D. Shared administrator accounts
Rationale: Temporary credentials reduce long-term credential exposure
and are commonly used for applications, federated identities, and
privileged operations. They automatically expire, lowering the risk
associated with compromised credentials.
, 7. Which attack attempts to overwhelm cloud resources and make
services unavailable?
A. SQL injection
B. Cross-site scripting
C. Distributed Denial-of-Service (DDoS)
D. Phishing
Rationale: A DDoS attack floods systems with excessive traffic,
consuming resources until legitimate users can no longer access
services. Cloud providers often offer DDoS mitigation services to absorb
and filter malicious traffic.
8. What is the primary goal of network segmentation?
A. Increase internet bandwidth
B. Limit the spread of security threats between network segments
C. Reduce storage requirements
D. Simplify password management
Rationale: Network segmentation divides a network into smaller zones,
reducing lateral movement by attackers and containing security
incidents. It also helps organizations apply security policies based on
business requirements.
9. Which cloud security technology monitors activity and generates
alerts based on suspicious events?
