WGU E027 Task 2: Infrastructure Implementation Report Azure
IaaS, Ubuntu VM, Nginx, SSL/TLS, iperf3 & Monitoring 100 Practice
Exam Questions with Detailed Rationales
EXECUTIVE SUMMARY
This comprehensive question bank covers the complete implementation of a
production-ready infrastructure on Microsoft Azure IaaS, featuring an Ubuntu VM with
Nginx reverse proxy, Let's Encrypt SSL/TLS encryption, iperf3 network benchmarking,
and Monit monitoring. Based on the WGU E027 Task 2 requirements, these questions
reflect actual deployment scenarios, troubleshooting, and infrastructure best practices.
SECTION 1: AZURE IaaS FOUNDATIONS
Question 1
What is the primary purpose of creating a custom Virtual Network (VNet) when
deploying infrastructure on Azure IaaS?
A) To reduce the cost of virtual machines
B) To provide network isolation and segmentation for security
C) To increase the speed of the internet connection
D) To automatically deploy SSL certificates
,Answer: B) To provide network isolation and segmentation for security
Rationale: A custom VNet provides network isolation and segmentation, which is a key
security best practice. Placing resources in public and private subnets ensures the database
remains inaccessible to the public internet . This aligns with Azure's "secure-by-design"
principle .
Question 2
Which of the following is the correct CIDR range for a typical Azure VNet used in a
production deployment?
A) 192.168.0.0/24
B) 10.0.0.0/16
C) 172.16.0.0/12
D) 10.0.0.0/8
Answer: B) 10.0.0.0/16
Rationale: The 10.0.0.0/16 CIDR range (65536 IP addresses) is commonly used for
production Azure VNets . This provides ample address space for future expansion while
maintaining proper network segmentation between public and private subnets.
Question 3
A properly segmented production architecture on Azure places which components in a
private subnet?
A) Web servers and load balancers
B) Databases and backend services
C) SSH jump hosts only
D) Nginx reverse proxy
Answer: B) Databases and backend services
,Rationale: Production architectures place databases and backend services in private
subnets to ensure they are never exposed to the public internet . Public subnets host web
servers, reverse proxies, and other components that need internet-facing access .
Question 4
What is the purpose of a Network Security Group (NSG) in Azure IaaS deployments?
A) To encrypt all network traffic automatically
B) To control inbound and outbound traffic to resources
C) To deploy virtual machines faster
D) To manage SSL certificates
Answer: B) To control inbound and outbound traffic to resources
Rationale: NSGs control inbound and outbound traffic to resources by specifying
allow/deny rules based on ports, protocols, and source/destination IP addresses . This
provides a critical layer of security by restricting database access only to specific VMs .
Question 5
Why should public database access be disabled in a production Azure deployment?
A) To reduce costs
B) To ensure the database is never exposed to the public internet
C) To increase database performance
D) To simplify configuration
Answer: B) To ensure the database is never exposed to the public internet
Rationale: Disabling public database access is a fundamental security best practice.
Production architectures rely on private network connectivity, with databases accessible
only within the VNet . This prevents unauthorized external access and data breaches.
, SECTION 2: UBUNTU VM PROVISIONING
Question 6
Which Ubuntu version is typically recommended for production deployments on Azure
IaaS?
A) Ubuntu 18.04 LTS
B) Ubuntu 20.04 LTS
C) Ubuntu 22.04 LTS
D) Ubuntu 24.04 LTS
Answer: C) Ubuntu 22.04 LTS
Rationale: Ubuntu 22.04 LTS provides long-term support and stability, making it a
common choice for production deployments . LTS versions provide five years of security
updates and are the basis for Azure's Linux workload offerings .
Question 7
Which authentication method should be used to secure SSH access to Azure VMs?
A) Password authentication only
B) SSH key-pair authentication
C) Username and password with complexity requirements
D) No authentication required
Answer: B) SSH key-pair authentication
Rationale: SSH key-pair authentication is the recommended security best practice for
production VMs . Password authentication should be disabled to prevent brute force
attacks, and only authorized users with private keys should be allowed access .
Question 8
IaaS, Ubuntu VM, Nginx, SSL/TLS, iperf3 & Monitoring 100 Practice
Exam Questions with Detailed Rationales
EXECUTIVE SUMMARY
This comprehensive question bank covers the complete implementation of a
production-ready infrastructure on Microsoft Azure IaaS, featuring an Ubuntu VM with
Nginx reverse proxy, Let's Encrypt SSL/TLS encryption, iperf3 network benchmarking,
and Monit monitoring. Based on the WGU E027 Task 2 requirements, these questions
reflect actual deployment scenarios, troubleshooting, and infrastructure best practices.
SECTION 1: AZURE IaaS FOUNDATIONS
Question 1
What is the primary purpose of creating a custom Virtual Network (VNet) when
deploying infrastructure on Azure IaaS?
A) To reduce the cost of virtual machines
B) To provide network isolation and segmentation for security
C) To increase the speed of the internet connection
D) To automatically deploy SSL certificates
,Answer: B) To provide network isolation and segmentation for security
Rationale: A custom VNet provides network isolation and segmentation, which is a key
security best practice. Placing resources in public and private subnets ensures the database
remains inaccessible to the public internet . This aligns with Azure's "secure-by-design"
principle .
Question 2
Which of the following is the correct CIDR range for a typical Azure VNet used in a
production deployment?
A) 192.168.0.0/24
B) 10.0.0.0/16
C) 172.16.0.0/12
D) 10.0.0.0/8
Answer: B) 10.0.0.0/16
Rationale: The 10.0.0.0/16 CIDR range (65536 IP addresses) is commonly used for
production Azure VNets . This provides ample address space for future expansion while
maintaining proper network segmentation between public and private subnets.
Question 3
A properly segmented production architecture on Azure places which components in a
private subnet?
A) Web servers and load balancers
B) Databases and backend services
C) SSH jump hosts only
D) Nginx reverse proxy
Answer: B) Databases and backend services
,Rationale: Production architectures place databases and backend services in private
subnets to ensure they are never exposed to the public internet . Public subnets host web
servers, reverse proxies, and other components that need internet-facing access .
Question 4
What is the purpose of a Network Security Group (NSG) in Azure IaaS deployments?
A) To encrypt all network traffic automatically
B) To control inbound and outbound traffic to resources
C) To deploy virtual machines faster
D) To manage SSL certificates
Answer: B) To control inbound and outbound traffic to resources
Rationale: NSGs control inbound and outbound traffic to resources by specifying
allow/deny rules based on ports, protocols, and source/destination IP addresses . This
provides a critical layer of security by restricting database access only to specific VMs .
Question 5
Why should public database access be disabled in a production Azure deployment?
A) To reduce costs
B) To ensure the database is never exposed to the public internet
C) To increase database performance
D) To simplify configuration
Answer: B) To ensure the database is never exposed to the public internet
Rationale: Disabling public database access is a fundamental security best practice.
Production architectures rely on private network connectivity, with databases accessible
only within the VNet . This prevents unauthorized external access and data breaches.
, SECTION 2: UBUNTU VM PROVISIONING
Question 6
Which Ubuntu version is typically recommended for production deployments on Azure
IaaS?
A) Ubuntu 18.04 LTS
B) Ubuntu 20.04 LTS
C) Ubuntu 22.04 LTS
D) Ubuntu 24.04 LTS
Answer: C) Ubuntu 22.04 LTS
Rationale: Ubuntu 22.04 LTS provides long-term support and stability, making it a
common choice for production deployments . LTS versions provide five years of security
updates and are the basis for Azure's Linux workload offerings .
Question 7
Which authentication method should be used to secure SSH access to Azure VMs?
A) Password authentication only
B) SSH key-pair authentication
C) Username and password with complexity requirements
D) No authentication required
Answer: B) SSH key-pair authentication
Rationale: SSH key-pair authentication is the recommended security best practice for
production VMs . Password authentication should be disabled to prevent brute force
attacks, and only authorized users with private keys should be allowed access .
Question 8
