WGU D282 Cloud Foundations OA (pdf) | 2026/2027 | Objective
Assessment | Cloud Computing
1. According to the AWS Shared Responsibility Model, which entity is
responsible for protecting the AWS infrastructure that runs all of the services
offered in the AWS Cloud?
A) The customer
B) Both the customer and AWS
C) AWS
D) A third-party auditor
Correct Answer: AWS
Rationale: According to the AWS Shared Responsibility Model, AWS is
responsible for protecting the infrastructure that runs all of the services
offered in the AWS Cloud. This includes hardware, software, networking, and
facilities. The customer is responsible for security within the cloud, such as
data, applications, and operating systems.
2. Which AWS service provides a centralized view of compliance reports from
third-party auditors?
A) AWS Config
B) AWS Trusted Advisor
C) AWS Artifact
D) AWS CloudTrail
Correct Answer: AWS Artifact
Rationale: AWS Artifact is a service that provides on-demand access to AWS
security and compliance reports and select online agreements. The "Artifact
Reports" section provides compliance reporting from third-party auditors.
,3. A systems analyst wants to monitor the CPU utilization rate for an EC2
instance and receive a notification when CPU utilization exceeds 60% for five
consecutive minutes. What should the analyst implement?
A) An Amazon CloudWatch alarm
B) An AWS CloudTrail trail
C) An AWS Config rule
D) An AWS Trusted Advisor check
Correct Answer: An Amazon CloudWatch alarm
Rationale: Amazon CloudWatch alarms monitor a single metric over a
specified time period and perform one or more actions based on the value of
the metric relative to a threshold. A CloudWatch alarm is the correct tool to
monitor CPU utilization and trigger notifications.
4. An e-commerce company is concerned about Distributed Denial of Service
(DDoS) attacks and wants to protect its web applications. Which AWS
solution provides protection against infrastructure-layer DDoS attacks?
A) AWS WAF
B) AWS Shield
C) AWS GuardDuty
D) AWS Inspector
Correct Answer: AWS Shield
Rationale: AWS Shield is a managed DDoS protection service that safeguards
applications running on AWS. AWS Shield Standard provides protection
against common network and transport layer DDoS attacks, while Shield
Advanced provides enhanced protection.
,5. A startup uses Amazon EC2 Auto Scaling to adjust the number of EC2
instances running its business applications. The startup wants to
automatically add or remove EC2 instances according to conditions the
business defines. Which ability of the AWS Cloud is the startup leveraging?
A) Reliability
B) Agility
C) Elasticity
D) Scalability
Correct Answer: Elasticity
Rationale: Elasticity is the ability to automatically scale resources up or down
based on demand. Amazon EC2 Auto Scaling enables this by adding or
removing instances according to defined conditions, which is a key benefit of
cloud computing.
6. Which AWS service is used to track user activity and API calls within an
AWS account?
A) Amazon CloudWatch
B) AWS CloudTrail
C) AWS Config
D) AWS Trusted Advisor
Correct Answer: AWS CloudTrail
Rationale: AWS CloudTrail is a service that enables governance, compliance,
operational auditing, and risk auditing of your AWS account. It logs API calls
and user activity, providing a history of AWS API calls for your account.
, 7. What is the primary responsibility of a Security Administrator in the
context of cloud computing?
A) To maintain and operate the computer network
B) To investigate incidents and keep the cloud secure
C) To manage development and scripting processes
D) To integrate services and utilize CloudWatch
Correct Answer: To investigate incidents and keep the cloud secure
Rationale: A Security Administrator is responsible for the CIA Triad of Cloud,
investigating incidents, and keeping the cloud environment secure.
8. Which AWS service is used to define allowed or denied permissions for a
user or resource?
A) AWS Security Groups
B) AWS Identity and Access Management (IAM) policies
C) AWS CloudTrail logs
D) AWS Resource Tags
Correct Answer: AWS Identity and Access Management (IAM) policies
Rationale: IAM policies are JSON documents that define permissions for
users, groups, and roles. They specify what actions are allowed or denied on
which AWS resources.
9. Which component manages several IAM users and allows you to specify
security permissions for a given set of users?
A) An AWS IAM policy
B) An AWS IAM role
Assessment | Cloud Computing
1. According to the AWS Shared Responsibility Model, which entity is
responsible for protecting the AWS infrastructure that runs all of the services
offered in the AWS Cloud?
A) The customer
B) Both the customer and AWS
C) AWS
D) A third-party auditor
Correct Answer: AWS
Rationale: According to the AWS Shared Responsibility Model, AWS is
responsible for protecting the infrastructure that runs all of the services
offered in the AWS Cloud. This includes hardware, software, networking, and
facilities. The customer is responsible for security within the cloud, such as
data, applications, and operating systems.
2. Which AWS service provides a centralized view of compliance reports from
third-party auditors?
A) AWS Config
B) AWS Trusted Advisor
C) AWS Artifact
D) AWS CloudTrail
Correct Answer: AWS Artifact
Rationale: AWS Artifact is a service that provides on-demand access to AWS
security and compliance reports and select online agreements. The "Artifact
Reports" section provides compliance reporting from third-party auditors.
,3. A systems analyst wants to monitor the CPU utilization rate for an EC2
instance and receive a notification when CPU utilization exceeds 60% for five
consecutive minutes. What should the analyst implement?
A) An Amazon CloudWatch alarm
B) An AWS CloudTrail trail
C) An AWS Config rule
D) An AWS Trusted Advisor check
Correct Answer: An Amazon CloudWatch alarm
Rationale: Amazon CloudWatch alarms monitor a single metric over a
specified time period and perform one or more actions based on the value of
the metric relative to a threshold. A CloudWatch alarm is the correct tool to
monitor CPU utilization and trigger notifications.
4. An e-commerce company is concerned about Distributed Denial of Service
(DDoS) attacks and wants to protect its web applications. Which AWS
solution provides protection against infrastructure-layer DDoS attacks?
A) AWS WAF
B) AWS Shield
C) AWS GuardDuty
D) AWS Inspector
Correct Answer: AWS Shield
Rationale: AWS Shield is a managed DDoS protection service that safeguards
applications running on AWS. AWS Shield Standard provides protection
against common network and transport layer DDoS attacks, while Shield
Advanced provides enhanced protection.
,5. A startup uses Amazon EC2 Auto Scaling to adjust the number of EC2
instances running its business applications. The startup wants to
automatically add or remove EC2 instances according to conditions the
business defines. Which ability of the AWS Cloud is the startup leveraging?
A) Reliability
B) Agility
C) Elasticity
D) Scalability
Correct Answer: Elasticity
Rationale: Elasticity is the ability to automatically scale resources up or down
based on demand. Amazon EC2 Auto Scaling enables this by adding or
removing instances according to defined conditions, which is a key benefit of
cloud computing.
6. Which AWS service is used to track user activity and API calls within an
AWS account?
A) Amazon CloudWatch
B) AWS CloudTrail
C) AWS Config
D) AWS Trusted Advisor
Correct Answer: AWS CloudTrail
Rationale: AWS CloudTrail is a service that enables governance, compliance,
operational auditing, and risk auditing of your AWS account. It logs API calls
and user activity, providing a history of AWS API calls for your account.
, 7. What is the primary responsibility of a Security Administrator in the
context of cloud computing?
A) To maintain and operate the computer network
B) To investigate incidents and keep the cloud secure
C) To manage development and scripting processes
D) To integrate services and utilize CloudWatch
Correct Answer: To investigate incidents and keep the cloud secure
Rationale: A Security Administrator is responsible for the CIA Triad of Cloud,
investigating incidents, and keeping the cloud environment secure.
8. Which AWS service is used to define allowed or denied permissions for a
user or resource?
A) AWS Security Groups
B) AWS Identity and Access Management (IAM) policies
C) AWS CloudTrail logs
D) AWS Resource Tags
Correct Answer: AWS Identity and Access Management (IAM) policies
Rationale: IAM policies are JSON documents that define permissions for
users, groups, and roles. They specify what actions are allowed or denied on
which AWS resources.
9. Which component manages several IAM users and allows you to specify
security permissions for a given set of users?
A) An AWS IAM policy
B) An AWS IAM role
