WGU E025 TASK 1
PERFORMANCE ASSESSMENT |
HYBRID CLOUD SECURITY
LATEST MOCK PRACTICE SET
190 Questions with Answers and Detailed Rationales
100 PERCENT GUARANTEED PASS
INSTANT DOWNLOAD ANSWERS INCLUDED
IMPORTANCE OF THIS DOCUMENT
This comprehensive examination preparation guide has been meticulously developed to help you succeed in the
WGU E025 TASK 1 PERFORMANCE ASSESSMENT | HYBRID CLOUD SECURITY ARCHITECTURE: ZERO
TRUST, IDENTITY FEDERATION, CSPM & NGFW | 2026 UPDATE. It contains 190 carefully selected questions
that reflect the most current exam content and testing strategies. Each question is accompanied by a correct
answer and a detailed rationale that explains the underlying pathophysiology, pharmacology, or clinical reasoning.
Self-Assessment – Test your knowledge and Exam Preparation – Familiarize yourself with the
identify areas requiring further question format and content
study areas
Concept Reinforcement – Deepen your Confidence Building – Develop test-taking
understanding through strategies and reduce
evidence-based exam anxiety
rationales
Time Management – Practice answering
questions under simulated
exam conditions
Review Summary 190 Questions
Foundations - Application - WGU E025 TASK 1 Performance Assessment Hybrid Cloud Security
Architecture ZERO Trust Identity Federation CSPM & NGFW 2026 Update Hybrid Cloud Security Architecture
Graduate
All answers with rationales
,Table of Contents
Content Area Questions Key Topics
ZERO Trust Architecture 1-32 Cloud, Hybrid, Security, Trust, Environment
Identity Federation AND 33-64 Cloud, Security, Hybrid, Access, Policy
Access Management
Cloud Security Posture 65-96 Cloud, Security, Hybrid, Environment, Trust
Management CSPM
Next-generation Firewall 97-128 Cloud, Security, Hybrid, Trust, Environment
NGFW Implementation
Hybrid Cloud Security 129-160 Cloud, Hybrid, Trust, Security, Access
Design
Threat Detection AND 161-190 Cloud, Security, Trust, Hybrid, Access
Response
TOTAL 190 All questions include answers and detailed rationales
,Section A - ZERO Trust Architecture
Q1.
In a hybrid cloud environment where an on-premises Active Directory is federated with
Azure AD via AD FS, a security architect must ensure that conditional access policies
evaluate sign-in risk in real time. Which configuration best achieves this without
introducing a dependency on the on-premises component?
A. Configure Azure AD Conditional Access B. Configure AD FS to perform MFA and
to use the 'Sign-in risk' condition and enable pass the authentication strength claim to
Azure AD Identity Protection, ensuring risk Azure AD, relying on AD FS to evaluate
detection is evaluated before token sign-in risk.
issuance.
C. Use Azure AD Domain Services to D. Set up a VPN tunnel between
synchronize risk scores from on-premises on-premises and Azure to ensure that risk
domain controllers and evaluate them in signals are transmitted instantly to Azure AD
Azure AD. for evaluation.
Correct: A - Configure Azure AD Conditional Access to use the 'Sign-in risk' condition and
enable Azure AD Identity Protection, ensuring risk detection is evaluated before token
issuance.
Rationale:Azure AD Identity Protection and Conditional Access evaluate sign-in risk in the
cloud, independent of on-premises AD FS. B incorrectly relies on AD FS for risk evaluation,
which is not a native function. C is irrelevant because Azure AD DS doesn't provide risk
scores. D is a network solution that doesn't address risk evaluation logic.
Q2.
A security engineer is evaluating a next-generation firewall (NGFW) deployment for a
hybrid cloud architecture. The NGFW must decrypt and inspect TLS traffic to both
on-premises and cloud workloads. Which approach minimizes the risk of breaking
end-to-end encryption while maintaining visibility?
A. Perform SSL/TLS interception at the B. Enable TLS 1.3 passthrough and rely on
NGFW using a trusted root CA, and the cloud provider's native logging for
configure the NGFW to re-encrypt traffic encrypted traffic analysis.
with the original server certificate.
C. Use SSL/TLS interception with a D. Deploy the NGFW in inline mode with
dedicated CA and ensure clients trust the TLS decryption only for traffic destined to
NGFW's certificate, while allowing the internet, not for internal cloud traffic.
exceptions for regulated applications.
Correct: C - Use SSL/TLS interception with a dedicated CA and ensure clients trust the
NGFW's certificate, while allowing exceptions for regulated applications.
Page 3
, Section A - ZERO Trust Architecture
Rationale: SSL/TLS interception with a dedicated CA and client trust is the standard
approach, but exceptions for regulated apps prevent breaking compliance. A is incorrect
because re-encrypting with the original server certificate is impossible without the private key.
B lacks visibility. D is incomplete as it doesn't cover internal traffic.
Q3.
In a hybrid cloud using AWS and on-premises data centers, a security team deploys a
CSPM tool. The tool must automatically remediate misconfigurations without manual
intervention. Which capability is essential to avoid security gaps and operational
overhead?
A. Integration with infrastructure-as-code B. Real-time alerting to a SIEM for every
(IaC) templates to enforce security policies misconfiguration detected.
during CI/CD pipelines.
C. A rule engine that supports custom D. The ability to generate compliance
policies written in JSON or YAML. reports for frameworks like CIS and NIST.
Correct: A - Integration with infrastructure-as-code (IaC) templates to enforce security
policies during CI/CD pipelines.
Rationale:Automated remediation is best achieved by integrating CSPM with IaC to prevent
misconfigurations at deployment time. B is reactive, not automatic remediation. C and D are
features but don't directly provide automated remediation.
Q4.
A security architect is designing a zero trust architecture for a hybrid cloud. They plan to
implement micro-segmentation. Which principle is most critical to ensure that
micro-segmentation is effective in a dynamic cloud environment?
A. Using a single centralized firewall to B. Defining segmentation policies based on
enforce all segmentation policies. workload identities and continuously
updating them as workloads change.
C. Segmenting the network based on IP D. Deploying a next-generation firewall at
subnets and VLANs. the internet edge to inspect all traffic.
Correct: B - Defining segmentation policies based on workload identities and
continuously updating them as workloads change.
Rationale:Micro-segmentation in cloud relies on identity-based policies that adapt to dynamic
workloads, not static IP-based segmentation. A and D are centralized and edge-based, not
micro-segmentation. C is traditional network segmentation which is insufficient.
Page 4
PERFORMANCE ASSESSMENT |
HYBRID CLOUD SECURITY
LATEST MOCK PRACTICE SET
190 Questions with Answers and Detailed Rationales
100 PERCENT GUARANTEED PASS
INSTANT DOWNLOAD ANSWERS INCLUDED
IMPORTANCE OF THIS DOCUMENT
This comprehensive examination preparation guide has been meticulously developed to help you succeed in the
WGU E025 TASK 1 PERFORMANCE ASSESSMENT | HYBRID CLOUD SECURITY ARCHITECTURE: ZERO
TRUST, IDENTITY FEDERATION, CSPM & NGFW | 2026 UPDATE. It contains 190 carefully selected questions
that reflect the most current exam content and testing strategies. Each question is accompanied by a correct
answer and a detailed rationale that explains the underlying pathophysiology, pharmacology, or clinical reasoning.
Self-Assessment – Test your knowledge and Exam Preparation – Familiarize yourself with the
identify areas requiring further question format and content
study areas
Concept Reinforcement – Deepen your Confidence Building – Develop test-taking
understanding through strategies and reduce
evidence-based exam anxiety
rationales
Time Management – Practice answering
questions under simulated
exam conditions
Review Summary 190 Questions
Foundations - Application - WGU E025 TASK 1 Performance Assessment Hybrid Cloud Security
Architecture ZERO Trust Identity Federation CSPM & NGFW 2026 Update Hybrid Cloud Security Architecture
Graduate
All answers with rationales
,Table of Contents
Content Area Questions Key Topics
ZERO Trust Architecture 1-32 Cloud, Hybrid, Security, Trust, Environment
Identity Federation AND 33-64 Cloud, Security, Hybrid, Access, Policy
Access Management
Cloud Security Posture 65-96 Cloud, Security, Hybrid, Environment, Trust
Management CSPM
Next-generation Firewall 97-128 Cloud, Security, Hybrid, Trust, Environment
NGFW Implementation
Hybrid Cloud Security 129-160 Cloud, Hybrid, Trust, Security, Access
Design
Threat Detection AND 161-190 Cloud, Security, Trust, Hybrid, Access
Response
TOTAL 190 All questions include answers and detailed rationales
,Section A - ZERO Trust Architecture
Q1.
In a hybrid cloud environment where an on-premises Active Directory is federated with
Azure AD via AD FS, a security architect must ensure that conditional access policies
evaluate sign-in risk in real time. Which configuration best achieves this without
introducing a dependency on the on-premises component?
A. Configure Azure AD Conditional Access B. Configure AD FS to perform MFA and
to use the 'Sign-in risk' condition and enable pass the authentication strength claim to
Azure AD Identity Protection, ensuring risk Azure AD, relying on AD FS to evaluate
detection is evaluated before token sign-in risk.
issuance.
C. Use Azure AD Domain Services to D. Set up a VPN tunnel between
synchronize risk scores from on-premises on-premises and Azure to ensure that risk
domain controllers and evaluate them in signals are transmitted instantly to Azure AD
Azure AD. for evaluation.
Correct: A - Configure Azure AD Conditional Access to use the 'Sign-in risk' condition and
enable Azure AD Identity Protection, ensuring risk detection is evaluated before token
issuance.
Rationale:Azure AD Identity Protection and Conditional Access evaluate sign-in risk in the
cloud, independent of on-premises AD FS. B incorrectly relies on AD FS for risk evaluation,
which is not a native function. C is irrelevant because Azure AD DS doesn't provide risk
scores. D is a network solution that doesn't address risk evaluation logic.
Q2.
A security engineer is evaluating a next-generation firewall (NGFW) deployment for a
hybrid cloud architecture. The NGFW must decrypt and inspect TLS traffic to both
on-premises and cloud workloads. Which approach minimizes the risk of breaking
end-to-end encryption while maintaining visibility?
A. Perform SSL/TLS interception at the B. Enable TLS 1.3 passthrough and rely on
NGFW using a trusted root CA, and the cloud provider's native logging for
configure the NGFW to re-encrypt traffic encrypted traffic analysis.
with the original server certificate.
C. Use SSL/TLS interception with a D. Deploy the NGFW in inline mode with
dedicated CA and ensure clients trust the TLS decryption only for traffic destined to
NGFW's certificate, while allowing the internet, not for internal cloud traffic.
exceptions for regulated applications.
Correct: C - Use SSL/TLS interception with a dedicated CA and ensure clients trust the
NGFW's certificate, while allowing exceptions for regulated applications.
Page 3
, Section A - ZERO Trust Architecture
Rationale: SSL/TLS interception with a dedicated CA and client trust is the standard
approach, but exceptions for regulated apps prevent breaking compliance. A is incorrect
because re-encrypting with the original server certificate is impossible without the private key.
B lacks visibility. D is incomplete as it doesn't cover internal traffic.
Q3.
In a hybrid cloud using AWS and on-premises data centers, a security team deploys a
CSPM tool. The tool must automatically remediate misconfigurations without manual
intervention. Which capability is essential to avoid security gaps and operational
overhead?
A. Integration with infrastructure-as-code B. Real-time alerting to a SIEM for every
(IaC) templates to enforce security policies misconfiguration detected.
during CI/CD pipelines.
C. A rule engine that supports custom D. The ability to generate compliance
policies written in JSON or YAML. reports for frameworks like CIS and NIST.
Correct: A - Integration with infrastructure-as-code (IaC) templates to enforce security
policies during CI/CD pipelines.
Rationale:Automated remediation is best achieved by integrating CSPM with IaC to prevent
misconfigurations at deployment time. B is reactive, not automatic remediation. C and D are
features but don't directly provide automated remediation.
Q4.
A security architect is designing a zero trust architecture for a hybrid cloud. They plan to
implement micro-segmentation. Which principle is most critical to ensure that
micro-segmentation is effective in a dynamic cloud environment?
A. Using a single centralized firewall to B. Defining segmentation policies based on
enforce all segmentation policies. workload identities and continuously
updating them as workloads change.
C. Segmenting the network based on IP D. Deploying a next-generation firewall at
subnets and VLANs. the internet edge to inspect all traffic.
Correct: B - Defining segmentation policies based on workload identities and
continuously updating them as workloads change.
Rationale:Micro-segmentation in cloud relies on identity-based policies that adapt to dynamic
workloads, not static IP-based segmentation. A and D are centralized and edge-based, not
micro-segmentation. C is traditional network segmentation which is insufficient.
Page 4
