WGU E025 PERFORMANCE
ASSESSMENT (PA) | SECURE
HYBRID CLOUD & NETWORK
LATEST MOCK PRACTICE SET
190 Questions with Answers and Detailed Rationales
100 PERCENT GUARANTEED PASS
INSTANT DOWNLOAD ANSWERS INCLUDED
IMPORTANCE OF THIS DOCUMENT
This comprehensive examination preparation guide has been meticulously developed to help you succeed in the
WGU E025 PERFORMANCE ASSESSMENT (PA) | SECURE HYBRID CLOUD & NETWORK SOLUTION |
COMPLETE PASSED PROJECT | RUBRIC-ALIGNED | 2026 UPDATE.. It contains 190 carefully selected
questions that reflect the most current exam content and testing strategies. Each question is accompanied by a
correct answer and a detailed rationale that explains the underlying pathophysiology, pharmacology, or clinical
reasoning.
Self-Assessment – Test your knowledge and Exam Preparation – Familiarize yourself with the
identify areas requiring further question format and content
study areas
Concept Reinforcement – Deepen your Confidence Building – Develop test-taking
understanding through strategies and reduce
evidence-based exam anxiety
rationales
Time Management – Practice answering
questions under simulated
exam conditions
Review Summary 190 Questions
Foundations - Application - WGU E025 Performance Assessment PA Secure Hybrid Cloud & Network
Solution Complete Passed Project Rubric-aligned 2026 Update Secure Hybrid Cloud & Network Solution
WGU E025 Performance Assessment Graduate
All answers with rationales
,Table of Contents
Content Area Questions Key Topics
Cloud Architecture AND 1-32 Cloud, Hybrid, On-premises, Security, Network
Design
Network Security AND 33-64 Cloud, Hybrid, On-premises, Security, Network
Segmentation
Hybrid Cloud Connectivity 65-96 Cloud, Hybrid, On-premises, Network, Ensure
Identity AND Access 97-128 Hybrid, Cloud, On-premises, Network, Security
Management IAM
DATA Protection AND 129-160 Cloud, Hybrid, Security, Network, On-premises
Encryption
Compliance AND 161-190 Cloud, Hybrid, On-premises, Network, Security
Governance
TOTAL 190 All questions include answers and detailed rationales
,Section A - Cloud Architecture AND Design
Q1.
In a hybrid cloud architecture, a security architect must enforce consistent security
policies across on-premises and cloud workloads. Which approach best implements a
zero-trust model while minimizing operational overhead?
A. Deploy a cloud-based security B. Implement a centralized identity provider
information and event management (SIEM) with conditional access policies that
to aggregate logs and trigger alerts. evaluate device posture and user risk in real
time.
C. Use a traditional perimeter firewall with D. Establish separate identity repositories
VPN tunnels to connect all remote users to for cloud and on-premises systems, syncing
the corporate network. passwords daily.
Correct: B - Implement a centralized identity provider with conditional access policies that
evaluate device posture and user risk in real time.
Rationale:Zero-trust requires continuous verification of identity and device posture, not just
network location. Centralized identity with conditional access enforces adaptive policies
across both environments, aligning with zero-trust principles. SIEM is reactive, perimeter
VPNs rely on implicit trust, and separate identity repositories violate the principle of unified
identity and increase risk.
Q2.
A company is migrating a legacy application to a hybrid cloud. The application requires
low-latency access to an on-premises database. Which network design provides the most
secure and efficient connectivity?
A. Expose the database via a public B. Establish a site-to-site VPN over the
endpoint with IP whitelisting. internet with traffic shaping.
C. Use a dedicated private connection (e.g., D. Implement a software-defined WAN
AWS Direct Connect or Azure (SD-WAN) that routes traffic over the
ExpressRoute) with private IP addressing internet with encryption.
and network security groups.
Correct: C - Use a dedicated private connection (e.g., AWS Direct Connect or Azure
ExpressRoute) with private IP addressing and network security groups.
Rationale:Dedicated private connections provide consistent low latency, avoid internet
exposure, and support private IP communication. VPNs and SD-WAN traverse the internet,
introducing latency variability and potential exposure. Public endpoints with whitelisting are
insecure and not designed for high-volume database traffic.
Page 3
, Section A - Cloud Architecture AND Design
Q3.
During a hybrid cloud incident, a security analyst identifies that an attacker exfiltrated
encrypted data from a cloud storage bucket. The encryption keys are stored in the same
cloud provider's key management service (KMS). Which control would have most
effectively mitigated this exfiltration?
A. Enabling server-side encryption with B. Implementing a data loss prevention
customer-managed keys (SSE-KMS) on the (DLP) policy that monitors and blocks
bucket. anomalous outbound traffic.
C. Using a separate key management D. Enabling versioning on the bucket to
system (e.g., on-premises HSM) with strict allow rollback of deleted objects.
access policies and separation of duties.
Correct: C - Using a separate key management system (e.g., on-premises HSM) with strict
access policies and separation of duties.
Rationale:Storing keys in the same KMS as the data creates a single point of failure. A
separate HSM, ideally on-premises, with strict access controls ensures that even if data is
accessed, the keys remain protected, preventing decryption. SSE-KMS still relies on the
same KMS, DLP is reactive, and versioning does not prevent exfiltration.
Q4.
A healthcare organization deploys a hybrid cloud solution to store electronic health
records (EHRs). They must comply with HIPAA and minimize egress costs. Which storage
and data lifecycle strategy best meets these requirements?
A. Store all data in the cloud and rely on B. Keep active patient data on-premises for
cloud provider's backup and archival tiers. low-latency access and archive inactive
records to cloud cold storage with lifecycle
policies.
C. Use a single cloud storage class for all D. Replicate all data to multiple cloud
data to simplify management. regions to ensure high availability.
Correct: B - Keep active patient data on-premises for low-latency access and archive
inactive records to cloud cold storage with lifecycle policies.
Rationale:Tiered storage aligns with data lifecycle: active data on-premises ensures fast
access and control, while cold storage for archives reduces costs. HIPAA compliance requires
business associate agreements and encryption regardless of location. Single-class storage is
cost-inefficient; multi-region replication increases egress costs and complexity.
Q5.
A security team is designing a hybrid cloud network. They need to inspect traffic between
on-premises and cloud workloads for threats. Which architecture provides the most
comprehensive inspection with minimal latency impact?
Page 4
ASSESSMENT (PA) | SECURE
HYBRID CLOUD & NETWORK
LATEST MOCK PRACTICE SET
190 Questions with Answers and Detailed Rationales
100 PERCENT GUARANTEED PASS
INSTANT DOWNLOAD ANSWERS INCLUDED
IMPORTANCE OF THIS DOCUMENT
This comprehensive examination preparation guide has been meticulously developed to help you succeed in the
WGU E025 PERFORMANCE ASSESSMENT (PA) | SECURE HYBRID CLOUD & NETWORK SOLUTION |
COMPLETE PASSED PROJECT | RUBRIC-ALIGNED | 2026 UPDATE.. It contains 190 carefully selected
questions that reflect the most current exam content and testing strategies. Each question is accompanied by a
correct answer and a detailed rationale that explains the underlying pathophysiology, pharmacology, or clinical
reasoning.
Self-Assessment – Test your knowledge and Exam Preparation – Familiarize yourself with the
identify areas requiring further question format and content
study areas
Concept Reinforcement – Deepen your Confidence Building – Develop test-taking
understanding through strategies and reduce
evidence-based exam anxiety
rationales
Time Management – Practice answering
questions under simulated
exam conditions
Review Summary 190 Questions
Foundations - Application - WGU E025 Performance Assessment PA Secure Hybrid Cloud & Network
Solution Complete Passed Project Rubric-aligned 2026 Update Secure Hybrid Cloud & Network Solution
WGU E025 Performance Assessment Graduate
All answers with rationales
,Table of Contents
Content Area Questions Key Topics
Cloud Architecture AND 1-32 Cloud, Hybrid, On-premises, Security, Network
Design
Network Security AND 33-64 Cloud, Hybrid, On-premises, Security, Network
Segmentation
Hybrid Cloud Connectivity 65-96 Cloud, Hybrid, On-premises, Network, Ensure
Identity AND Access 97-128 Hybrid, Cloud, On-premises, Network, Security
Management IAM
DATA Protection AND 129-160 Cloud, Hybrid, Security, Network, On-premises
Encryption
Compliance AND 161-190 Cloud, Hybrid, On-premises, Network, Security
Governance
TOTAL 190 All questions include answers and detailed rationales
,Section A - Cloud Architecture AND Design
Q1.
In a hybrid cloud architecture, a security architect must enforce consistent security
policies across on-premises and cloud workloads. Which approach best implements a
zero-trust model while minimizing operational overhead?
A. Deploy a cloud-based security B. Implement a centralized identity provider
information and event management (SIEM) with conditional access policies that
to aggregate logs and trigger alerts. evaluate device posture and user risk in real
time.
C. Use a traditional perimeter firewall with D. Establish separate identity repositories
VPN tunnels to connect all remote users to for cloud and on-premises systems, syncing
the corporate network. passwords daily.
Correct: B - Implement a centralized identity provider with conditional access policies that
evaluate device posture and user risk in real time.
Rationale:Zero-trust requires continuous verification of identity and device posture, not just
network location. Centralized identity with conditional access enforces adaptive policies
across both environments, aligning with zero-trust principles. SIEM is reactive, perimeter
VPNs rely on implicit trust, and separate identity repositories violate the principle of unified
identity and increase risk.
Q2.
A company is migrating a legacy application to a hybrid cloud. The application requires
low-latency access to an on-premises database. Which network design provides the most
secure and efficient connectivity?
A. Expose the database via a public B. Establish a site-to-site VPN over the
endpoint with IP whitelisting. internet with traffic shaping.
C. Use a dedicated private connection (e.g., D. Implement a software-defined WAN
AWS Direct Connect or Azure (SD-WAN) that routes traffic over the
ExpressRoute) with private IP addressing internet with encryption.
and network security groups.
Correct: C - Use a dedicated private connection (e.g., AWS Direct Connect or Azure
ExpressRoute) with private IP addressing and network security groups.
Rationale:Dedicated private connections provide consistent low latency, avoid internet
exposure, and support private IP communication. VPNs and SD-WAN traverse the internet,
introducing latency variability and potential exposure. Public endpoints with whitelisting are
insecure and not designed for high-volume database traffic.
Page 3
, Section A - Cloud Architecture AND Design
Q3.
During a hybrid cloud incident, a security analyst identifies that an attacker exfiltrated
encrypted data from a cloud storage bucket. The encryption keys are stored in the same
cloud provider's key management service (KMS). Which control would have most
effectively mitigated this exfiltration?
A. Enabling server-side encryption with B. Implementing a data loss prevention
customer-managed keys (SSE-KMS) on the (DLP) policy that monitors and blocks
bucket. anomalous outbound traffic.
C. Using a separate key management D. Enabling versioning on the bucket to
system (e.g., on-premises HSM) with strict allow rollback of deleted objects.
access policies and separation of duties.
Correct: C - Using a separate key management system (e.g., on-premises HSM) with strict
access policies and separation of duties.
Rationale:Storing keys in the same KMS as the data creates a single point of failure. A
separate HSM, ideally on-premises, with strict access controls ensures that even if data is
accessed, the keys remain protected, preventing decryption. SSE-KMS still relies on the
same KMS, DLP is reactive, and versioning does not prevent exfiltration.
Q4.
A healthcare organization deploys a hybrid cloud solution to store electronic health
records (EHRs). They must comply with HIPAA and minimize egress costs. Which storage
and data lifecycle strategy best meets these requirements?
A. Store all data in the cloud and rely on B. Keep active patient data on-premises for
cloud provider's backup and archival tiers. low-latency access and archive inactive
records to cloud cold storage with lifecycle
policies.
C. Use a single cloud storage class for all D. Replicate all data to multiple cloud
data to simplify management. regions to ensure high availability.
Correct: B - Keep active patient data on-premises for low-latency access and archive
inactive records to cloud cold storage with lifecycle policies.
Rationale:Tiered storage aligns with data lifecycle: active data on-premises ensures fast
access and control, while cold storage for archives reduces costs. HIPAA compliance requires
business associate agreements and encryption regardless of location. Single-class storage is
cost-inefficient; multi-region replication increases egress costs and complexity.
Q5.
A security team is designing a hybrid cloud network. They need to inspect traffic between
on-premises and cloud workloads for threats. Which architecture provides the most
comprehensive inspection with minimal latency impact?
Page 4
