WGU E025: CLOUD AND NETWORK SECURITY
MODELS OBJECTIVE ASSESSMENT (OA) Exam Prep
Document | 2026/2027 Edition | 200 Verified Questions - 189
Questions with Answers
WGU E025: Cloud and Network Security Models OA Exam 2026-189 QUESTIONS AND ANSWERS ALREADY
GRADED A+. 100% Verified Solutions | Updated Per Latest Guidelines | Graded A+
This comprehensive exam preparation document is meticulously designed for candidates of the WGU
E025: Cloud and Network Security Models Objective Assessment. It features 200 verified practice
questions that mirror the format and difficulty of the actual OA, ensuring thorough readiness. Each
question is accompanied by a detailed rationale and explanation, facilitating deep understanding of
core security concepts. Updated for the 2026/2027 academic year, this resource is an essential tool for
achieving a high score.
Key Features:
Cloud security architecture and shared responsibility models
Network security protocols, encryption, and VPN technologies
Identity and access management (IAM) in cloud environments
Threat modeling, risk assessment, and mitigation strategies
Compliance frameworks (NIST, ISO 27001, GDPR) and their application
Incident response and disaster recovery in cloud and network contexts
Updates for 2026:
- Aligned with the latest CompTIA Security+ and cloud security best practices
- Incorporates recent updates to NIST SP 800-53 and ISO/IEC 27001:2022
- Reflects current trends in zero trust architecture and SASE models
- Enhanced rationales to address common misconceptions and exam traps
- Updated question distribution to match the 2026/2027 OA blueprint
Abstract:
This exam preparation document offers a rigorous and systematic approach to mastering the content required for
the WGU E025: Cloud and Network Security Models Objective Assessment. With 200 meticulously crafted
questions, it covers a broad spectrum of topics including cloud deployment models, virtualization security, network
defense mechanisms, and cryptographic protocols. Each question is designed to assess not only recall but also
application and analysis, mirroring the cognitive level of the actual exam. Detailed rationales provide insight into
the correct answer and explain why distractors are incorrect, thereby reinforcing learning and promoting critical
thinking. The document is structured to facilitate progressive learning, with content areas clearly delineated and
weighted according to the exam blueprint. Updated for the 2026/2027 academic year, it incorporates the latest
industry standards and regulatory requirements, ensuring that candidates are well-prepared to meet the challenges
of the certification exam and their future careers in cybersecurity.
Keywords:
Cloud Security, Network Security, WGU E025, Objective Assessment, Practice Test, Exam Prep, 2026-2027,
Verified Questions, Rationales
Answer Format:
Each question is presented in a multiple-choice format with four options. The correct answer is clearly indicated,
followed by a comprehensive rationale that explains the underlying concepts and why the correct choice is valid.
Page 1
,Additionally, each distractor is analyzed to clarify why it is incorrect, enhancing understanding and retention.
Compliance Checklist:
Aligned with WGU E025 course objectives and assessment blueprint
Updated to reflect 2026/2027 industry standards and frameworks
Includes 200 verified questions with detailed rationales
Covers all major domains with appropriate weight distribution
Designed to simulate the actual exam environment and difficulty
Content Area Overview:
Content Area Questions Key Topics Weight
Cloud Security Architecture 1-40 Shared responsibility model, cloud 20%
deployment models, virtualization security,
container security
Network Security Fundamentals 41-80 OSI model, TCP/IP, firewalls, IDS/IPS, 20%
VPNs, secure protocols
Identity and Access 81-110 Authentication methods, authorization 15%
Management (IAM) models, SSO, MFA, directory services
Threats, Vulnerabilities, and 111-140 Threat actors, malware, social engineering, 15%
Risk Management risk assessment, mitigation strategies
Compliance, Governance, and 141-170 NIST, ISO 27001, GDPR, HIPAA, PCI-DSS, 15%
Legal Frameworks audit and monitoring
Incident Response and Business 171-200 Incident response phases, disaster recovery, 15%
Continuity backup strategies, forensic basics
Page 2
,Q1. In a shared responsibility model for a serverless function (FaaS) deployed on a
major cloud provider, which of the following security aspects remains the sole
responsibility of the customer?
A. Patching the underlying runtime environment
B. Configuring the function's execution role and permissions
C. Securing the physical data center
D. Managing the hypervisor layer
Correct Answer: B. Configuring the function's execution role and permissions
Rationale: In FaaS, the cloud provider secures the physical infrastructure, hypervisor, and
runtime; the customer is responsible for the function code, configuration, and IAM roles.
Execution roles and permissions are customer-managed, making B correct.
Why Wrong:
A - The provider patches the runtime environment in FaaS.
C - Physical data center security is the provider's responsibility.
D - Hypervisor management is the provider's responsibility.
Reference: CSA Security Guidance for Cloud Computing, v4, Section 2.1
Q2. A security architect is implementing a zero trust network access (ZTNA) model
for a hybrid workforce. Which of the following strategies best embodies the principle
of least privilege and micro-segmentation?
A. Deploying a VPN that provides full network access to authenticated users
B. Implementing identity-based policies that allow access only to specific applications,
with continuous verification
C. Placing all resources in a single flat network segment to simplify management
D. Using a next-generation firewall to inspect all traffic east-west
Correct Answer: B. Implementing identity-based policies that allow access only to
specific applications, with continuous verification
Rationale: ZTNA uses identity-based, per-application access with continuous verification,
aligning with least privilege and micro-segmentation. VPNs provide broad access, flat
networks violate segmentation, and NGFWs alone lack identity granularity.
Why Wrong:
A - VPNs typically grant broad network access, not per-application.
C - Flat networks increase lateral movement risk.
D - NGFWs inspect traffic but do not inherently enforce identity-based least privilege.
Reference: NIST SP 800-207, Zero Trust Architecture
Q3. A cloud security engineer is designing a key management strategy for a
multi-cloud environment. Which of the following approaches offers the strongest
Page 3
, protection against a single cloud provider compromise while maintaining operational
usability?
A. Using the native key management service (KMS) of each cloud provider to store
keys separately
B. Using a customer-managed key (CMK) stored in a hardware security module (HSM)
on-premises, with the cloud using it via Bring Your Own Key (BYOK) or Hold Your
Own Key (HYOK)
C. Embedding plaintext keys in application configuration for faster access
D. Using a single shared key across all cloud providers to simplify rotation
Correct Answer: B. Using a customer-managed key (CMK) stored in a hardware
security module (HSM) on-premises, with the cloud using it via Bring Your Own Key
(BYOK) or Hold Your Own Key (HYOK)
Rationale: BYOK/HYOK with an on-prem HSM ensures the customer retains control of
the root key, mitigating risk if a single provider is compromised. Native KMS keys are
controlled by the provider, plaintext keys are insecure, and shared keys increase blast
radius.
Why Wrong:
A - Native KMS means the provider manages the root key, reducing customer control.
C - Plaintext keys are a severe security risk.
D - Shared keys violate least privilege and increase impact of compromise.
Reference: NIST SP 800-57, Key Management; CSA Guidance for Key Management
Q4. During a forensic investigation of a suspected breach in a cloud environment,
which of the following evidence sources would provide the most reliable,
tamper-evident record of API calls and access events?
A. Application logs stored in a SIEM with a 30-day retention
B. Cloud provider's activity trail logs (e.g., AWS CloudTrail) with integrity validation
enabled and logs stored in an immutable S3 bucket with versioning and MFA delete
C. System administrator's personal notes on changes made
D. Network flow logs from the VPC
Correct Answer: B. Cloud provider's activity trail logs (e.g., AWS CloudTrail) with
integrity validation enabled and logs stored in an immutable S3 bucket with
versioning and MFA delete
Rationale: CloudTrail with integrity validation and immutable storage provides
cryptographic tamper-evidence and long-term retention, crucial for forensic validity.
SIEM logs may be altered, admin notes are not authoritative, and VPC flow logs lack
API-level detail.
Why Wrong:
A - SIEM logs may be altered or have limited retention.
Page 4
MODELS OBJECTIVE ASSESSMENT (OA) Exam Prep
Document | 2026/2027 Edition | 200 Verified Questions - 189
Questions with Answers
WGU E025: Cloud and Network Security Models OA Exam 2026-189 QUESTIONS AND ANSWERS ALREADY
GRADED A+. 100% Verified Solutions | Updated Per Latest Guidelines | Graded A+
This comprehensive exam preparation document is meticulously designed for candidates of the WGU
E025: Cloud and Network Security Models Objective Assessment. It features 200 verified practice
questions that mirror the format and difficulty of the actual OA, ensuring thorough readiness. Each
question is accompanied by a detailed rationale and explanation, facilitating deep understanding of
core security concepts. Updated for the 2026/2027 academic year, this resource is an essential tool for
achieving a high score.
Key Features:
Cloud security architecture and shared responsibility models
Network security protocols, encryption, and VPN technologies
Identity and access management (IAM) in cloud environments
Threat modeling, risk assessment, and mitigation strategies
Compliance frameworks (NIST, ISO 27001, GDPR) and their application
Incident response and disaster recovery in cloud and network contexts
Updates for 2026:
- Aligned with the latest CompTIA Security+ and cloud security best practices
- Incorporates recent updates to NIST SP 800-53 and ISO/IEC 27001:2022
- Reflects current trends in zero trust architecture and SASE models
- Enhanced rationales to address common misconceptions and exam traps
- Updated question distribution to match the 2026/2027 OA blueprint
Abstract:
This exam preparation document offers a rigorous and systematic approach to mastering the content required for
the WGU E025: Cloud and Network Security Models Objective Assessment. With 200 meticulously crafted
questions, it covers a broad spectrum of topics including cloud deployment models, virtualization security, network
defense mechanisms, and cryptographic protocols. Each question is designed to assess not only recall but also
application and analysis, mirroring the cognitive level of the actual exam. Detailed rationales provide insight into
the correct answer and explain why distractors are incorrect, thereby reinforcing learning and promoting critical
thinking. The document is structured to facilitate progressive learning, with content areas clearly delineated and
weighted according to the exam blueprint. Updated for the 2026/2027 academic year, it incorporates the latest
industry standards and regulatory requirements, ensuring that candidates are well-prepared to meet the challenges
of the certification exam and their future careers in cybersecurity.
Keywords:
Cloud Security, Network Security, WGU E025, Objective Assessment, Practice Test, Exam Prep, 2026-2027,
Verified Questions, Rationales
Answer Format:
Each question is presented in a multiple-choice format with four options. The correct answer is clearly indicated,
followed by a comprehensive rationale that explains the underlying concepts and why the correct choice is valid.
Page 1
,Additionally, each distractor is analyzed to clarify why it is incorrect, enhancing understanding and retention.
Compliance Checklist:
Aligned with WGU E025 course objectives and assessment blueprint
Updated to reflect 2026/2027 industry standards and frameworks
Includes 200 verified questions with detailed rationales
Covers all major domains with appropriate weight distribution
Designed to simulate the actual exam environment and difficulty
Content Area Overview:
Content Area Questions Key Topics Weight
Cloud Security Architecture 1-40 Shared responsibility model, cloud 20%
deployment models, virtualization security,
container security
Network Security Fundamentals 41-80 OSI model, TCP/IP, firewalls, IDS/IPS, 20%
VPNs, secure protocols
Identity and Access 81-110 Authentication methods, authorization 15%
Management (IAM) models, SSO, MFA, directory services
Threats, Vulnerabilities, and 111-140 Threat actors, malware, social engineering, 15%
Risk Management risk assessment, mitigation strategies
Compliance, Governance, and 141-170 NIST, ISO 27001, GDPR, HIPAA, PCI-DSS, 15%
Legal Frameworks audit and monitoring
Incident Response and Business 171-200 Incident response phases, disaster recovery, 15%
Continuity backup strategies, forensic basics
Page 2
,Q1. In a shared responsibility model for a serverless function (FaaS) deployed on a
major cloud provider, which of the following security aspects remains the sole
responsibility of the customer?
A. Patching the underlying runtime environment
B. Configuring the function's execution role and permissions
C. Securing the physical data center
D. Managing the hypervisor layer
Correct Answer: B. Configuring the function's execution role and permissions
Rationale: In FaaS, the cloud provider secures the physical infrastructure, hypervisor, and
runtime; the customer is responsible for the function code, configuration, and IAM roles.
Execution roles and permissions are customer-managed, making B correct.
Why Wrong:
A - The provider patches the runtime environment in FaaS.
C - Physical data center security is the provider's responsibility.
D - Hypervisor management is the provider's responsibility.
Reference: CSA Security Guidance for Cloud Computing, v4, Section 2.1
Q2. A security architect is implementing a zero trust network access (ZTNA) model
for a hybrid workforce. Which of the following strategies best embodies the principle
of least privilege and micro-segmentation?
A. Deploying a VPN that provides full network access to authenticated users
B. Implementing identity-based policies that allow access only to specific applications,
with continuous verification
C. Placing all resources in a single flat network segment to simplify management
D. Using a next-generation firewall to inspect all traffic east-west
Correct Answer: B. Implementing identity-based policies that allow access only to
specific applications, with continuous verification
Rationale: ZTNA uses identity-based, per-application access with continuous verification,
aligning with least privilege and micro-segmentation. VPNs provide broad access, flat
networks violate segmentation, and NGFWs alone lack identity granularity.
Why Wrong:
A - VPNs typically grant broad network access, not per-application.
C - Flat networks increase lateral movement risk.
D - NGFWs inspect traffic but do not inherently enforce identity-based least privilege.
Reference: NIST SP 800-207, Zero Trust Architecture
Q3. A cloud security engineer is designing a key management strategy for a
multi-cloud environment. Which of the following approaches offers the strongest
Page 3
, protection against a single cloud provider compromise while maintaining operational
usability?
A. Using the native key management service (KMS) of each cloud provider to store
keys separately
B. Using a customer-managed key (CMK) stored in a hardware security module (HSM)
on-premises, with the cloud using it via Bring Your Own Key (BYOK) or Hold Your
Own Key (HYOK)
C. Embedding plaintext keys in application configuration for faster access
D. Using a single shared key across all cloud providers to simplify rotation
Correct Answer: B. Using a customer-managed key (CMK) stored in a hardware
security module (HSM) on-premises, with the cloud using it via Bring Your Own Key
(BYOK) or Hold Your Own Key (HYOK)
Rationale: BYOK/HYOK with an on-prem HSM ensures the customer retains control of
the root key, mitigating risk if a single provider is compromised. Native KMS keys are
controlled by the provider, plaintext keys are insecure, and shared keys increase blast
radius.
Why Wrong:
A - Native KMS means the provider manages the root key, reducing customer control.
C - Plaintext keys are a severe security risk.
D - Shared keys violate least privilege and increase impact of compromise.
Reference: NIST SP 800-57, Key Management; CSA Guidance for Key Management
Q4. During a forensic investigation of a suspected breach in a cloud environment,
which of the following evidence sources would provide the most reliable,
tamper-evident record of API calls and access events?
A. Application logs stored in a SIEM with a 30-day retention
B. Cloud provider's activity trail logs (e.g., AWS CloudTrail) with integrity validation
enabled and logs stored in an immutable S3 bucket with versioning and MFA delete
C. System administrator's personal notes on changes made
D. Network flow logs from the VPC
Correct Answer: B. Cloud provider's activity trail logs (e.g., AWS CloudTrail) with
integrity validation enabled and logs stored in an immutable S3 bucket with
versioning and MFA delete
Rationale: CloudTrail with integrity validation and immutable storage provides
cryptographic tamper-evidence and long-term retention, crucial for forensic validity.
SIEM logs may be altered, admin notes are not authoritative, and VPC flow logs lack
API-level detail.
Why Wrong:
A - SIEM logs may be altered or have limited retention.
Page 4
