1|Page
WGU D320 CCSP Exam 2026-2027 BANK QUESTIONS
WITH DETAILED VERIFIED ANSWERS EXAM
QUESTIONS WILL COME FROM HERE (100% Latest
Already Graded A+
QUESTION 1
An organization is deploying a new cloud-based customer relationship
management system. The security architect must ensure that data is
protected both at rest and in transit. Which of the following
cryptographic controls BEST addresses this requirement?
A. Transport Layer Security for data in transit and Advanced Encryption
Standard for data at rest
B. Secure Sockets Layer for data in transit and Data Encryption Standard
for data at rest
C. Internet Protocol Security for data in transit and Rivest Cipher for
data at rest
D. Pretty Good Privacy for data in transit and Triple Data Encryption
Standard for data at rest
Answer: A
Explanation: Transport Layer Security is the modern standard for
securing data in transit over networks, providing encryption and
,2|Page
integrity protection. Advanced Encryption Standard is the current
symmetric encryption standard recommended for data at rest due to its
strong security and performance characteristics. SSL is deprecated and
insecure, DES and Triple DES are considered weak by modern standards,
and RC4 has known vulnerabilities.
QUESTION 2
Which of the following cloud service models provides the customer
with the LEAST amount of control over the underlying infrastructure?
A. Infrastructure as a Service
B. Platform as a Service
C. Software as a Service
D. Function as a Service
Answer: C
Explanation: In the Software as a Service model, the cloud provider
manages virtually the entire stack, including applications, runtime,
middleware, operating systems, virtualization, servers, storage, and
networking. The customer has minimal control beyond configuration
settings and user-level access controls. IaaS provides the most customer
control, PaaS provides intermediate control, and FaaS still allows some
infrastructure management capabilities.
QUESTION 3
,3|Page
A cloud security architect is designing a disaster recovery plan for a
mission-critical application. The recovery time objective is 15 minutes,
and the recovery point objective is 5 minutes. Which of the following
deployment strategies is MOST appropriate?
A. Warm standby with asynchronous replication
B. Cold standby with daily backups
C. Active-active with synchronous replication
D. Pilot light with weekly snapshots
Answer: C
Explanation: An active-active deployment with synchronous replication
provides the lowest recovery time and point objectives because both
sites are actively processing traffic and data is continuously
synchronized. This configuration allows for near-instantaneous failover
with minimal data loss. Warm standby with asynchronous replication
cannot achieve a 5-minute RPO due to replication latency. Cold standby
and weekly snapshots cannot meet the 15-minute RTO. Pilot light
configurations typically have recovery times measured in hours.
QUESTION 4
Which of the following is a PRIMARY characteristic of a zero-trust
security architecture?
A. Implicit trust for internal network traffic
B. Continuous verification of all access requests
C. Perimeter-based security controls
, 4|Page
D. Single-factor authentication for internal users
Answer: B
Explanation: Zero-trust architecture is fundamentally based on the
principle of never trusting any user, device, or network segment
implicitly. Every access request must be continuously verified,
authenticated, and authorized regardless of its source location. This
contrasts sharply with traditional perimeter-based models that
implicitly trust internal network traffic. Zero-trust mandates multi-
factor authentication and does not rely on network location for trust
decisions.
QUESTION 5
A cloud customer needs to ensure that their data can be securely
deleted when no longer needed, even after the cloud provider has
replicated it across multiple geographic regions. Which of the following
techniques BEST addresses this requirement?
A. Data encryption with customer-managed keys
B. Data compression before storage
C. Data tokenization during transmission
D. Data deduplication across storage nodes
Answer: A
Explanation: When data is encrypted using customer-managed keys,
secure deletion can be achieved by simply destroying the encryption
WGU D320 CCSP Exam 2026-2027 BANK QUESTIONS
WITH DETAILED VERIFIED ANSWERS EXAM
QUESTIONS WILL COME FROM HERE (100% Latest
Already Graded A+
QUESTION 1
An organization is deploying a new cloud-based customer relationship
management system. The security architect must ensure that data is
protected both at rest and in transit. Which of the following
cryptographic controls BEST addresses this requirement?
A. Transport Layer Security for data in transit and Advanced Encryption
Standard for data at rest
B. Secure Sockets Layer for data in transit and Data Encryption Standard
for data at rest
C. Internet Protocol Security for data in transit and Rivest Cipher for
data at rest
D. Pretty Good Privacy for data in transit and Triple Data Encryption
Standard for data at rest
Answer: A
Explanation: Transport Layer Security is the modern standard for
securing data in transit over networks, providing encryption and
,2|Page
integrity protection. Advanced Encryption Standard is the current
symmetric encryption standard recommended for data at rest due to its
strong security and performance characteristics. SSL is deprecated and
insecure, DES and Triple DES are considered weak by modern standards,
and RC4 has known vulnerabilities.
QUESTION 2
Which of the following cloud service models provides the customer
with the LEAST amount of control over the underlying infrastructure?
A. Infrastructure as a Service
B. Platform as a Service
C. Software as a Service
D. Function as a Service
Answer: C
Explanation: In the Software as a Service model, the cloud provider
manages virtually the entire stack, including applications, runtime,
middleware, operating systems, virtualization, servers, storage, and
networking. The customer has minimal control beyond configuration
settings and user-level access controls. IaaS provides the most customer
control, PaaS provides intermediate control, and FaaS still allows some
infrastructure management capabilities.
QUESTION 3
,3|Page
A cloud security architect is designing a disaster recovery plan for a
mission-critical application. The recovery time objective is 15 minutes,
and the recovery point objective is 5 minutes. Which of the following
deployment strategies is MOST appropriate?
A. Warm standby with asynchronous replication
B. Cold standby with daily backups
C. Active-active with synchronous replication
D. Pilot light with weekly snapshots
Answer: C
Explanation: An active-active deployment with synchronous replication
provides the lowest recovery time and point objectives because both
sites are actively processing traffic and data is continuously
synchronized. This configuration allows for near-instantaneous failover
with minimal data loss. Warm standby with asynchronous replication
cannot achieve a 5-minute RPO due to replication latency. Cold standby
and weekly snapshots cannot meet the 15-minute RTO. Pilot light
configurations typically have recovery times measured in hours.
QUESTION 4
Which of the following is a PRIMARY characteristic of a zero-trust
security architecture?
A. Implicit trust for internal network traffic
B. Continuous verification of all access requests
C. Perimeter-based security controls
, 4|Page
D. Single-factor authentication for internal users
Answer: B
Explanation: Zero-trust architecture is fundamentally based on the
principle of never trusting any user, device, or network segment
implicitly. Every access request must be continuously verified,
authenticated, and authorized regardless of its source location. This
contrasts sharply with traditional perimeter-based models that
implicitly trust internal network traffic. Zero-trust mandates multi-
factor authentication and does not rely on network location for trust
decisions.
QUESTION 5
A cloud customer needs to ensure that their data can be securely
deleted when no longer needed, even after the cloud provider has
replicated it across multiple geographic regions. Which of the following
techniques BEST addresses this requirement?
A. Data encryption with customer-managed keys
B. Data compression before storage
C. Data tokenization during transmission
D. Data deduplication across storage nodes
Answer: A
Explanation: When data is encrypted using customer-managed keys,
secure deletion can be achieved by simply destroying the encryption
