WGU D485 CLOUD SECURITY EXAM
PREP TESTED QUESTIONS AND
COMPLETE SOLUTIONS
◉ WAF (Web Application Firewall)
Answer: Protects web applications by filtering HTTP/HTTPS
traffic. Blocks OWASP Top 10 attacks (SQLi, XSS, etc.). Sits in front
of web servers.
◉ IDS (Intrusion Detection System)
Answer: Detects and ALERTS on malicious traffic. Passive — does
not block. Can be network-based (NIDS) or host-based (HIDS).
◉ IPS (Intrusion Prevention System)
Answer: Detects and STOPS malicious traffic. Inline and active.
Upgrade from IDS in terms of response capability.
◉ DMZ (Demilitarized Zone)
Answer: Network segment between the internet and internal
network. Hosts public-facing services (web, email) while
protecting internal resources.
◉ Microsegmentation
,Answer: Divides the network into small isolated zones. Limits
lateral movement after a breach. Core component of Zero Trust
architectures.
◉ Bastion Host
Answer: Hardened server that is the sole controlled entry point
from a lower-security zone into a higher-security zone.
◉ VPN (Virtual Private Network)
Answer: Encrypts traffic over public networks. IPSec VPN
preferred for cloud uploads. Site-to-site vs. remote access
variants.
◉ Zero Trust
Answer: Never trust, always verify. No implicit trust based on
network location. Every request is authenticated and authorized
regardless of source.
◉ NIC (Network Interface Card) Teaming
Answer: Combining multiple physical NICs into one logical
interface. Provides redundancy (failover) and increased
bandwidth (load balancing).
◉ VLAN (Virtual Local Area Network)
,Answer: Logically segments a physical network into separate
broadcast domains without additional hardware. Isolates
sensitive systems on shared infrastructure.
◉ NACL (Network Access Control List)
Answer: Stateless firewall at the subnet level. Evaluates each
packet independently against numbered allow/deny rules. In
AWS, protects entire subnets.
◉ NSG (Network Security Group)
Answer: Stateful firewall at the resource/instance level. Tracks
connection state — return traffic automatically permitted.
Common in Azure.
◉ Hub and Spoke Network
Answer: Central hub (transit VPC or service provider) connects to
multiple spoke networks. Traffic flows through hub for
centralized security inspection.
◉ Defense in Depth
Answer: Multiple layers of security controls so if one fails, others
still protect. No single point of failure in security posture.
◉ Air Gap
Answer: Complete physical/logical isolation from other networks.
Highest security for classified or critical systems.
, ◉ Egress Monitoring
Answer: Monitors outbound traffic for data exfiltration, C2
(Command and Control) beaconing, and policy violations.
◉ Authentication vs Authorization
Answer: Authentication = proving who you are. Authorization =
what you are allowed to do. These are separate and sequential
steps.
◉ MFA (Multi-Factor Authentication)
Answer: Requires two or more factors: something you know
(password), something you have (token), something you are
(biometric).
◉ SAML (Security Assertion Markup Language)
Answer: XML-based standard for exchanging authentication and
authorization data between an IdP (Identity Provider) and SP
(Service Provider). Common for enterprise SSO.
◉ OAuth 2.0
Answer: Authorization framework allowing third-party apps to
access resources on behalf of a user without exposing credentials.
Issues access tokens.
◉ OpenID Connect (OIDC)
PREP TESTED QUESTIONS AND
COMPLETE SOLUTIONS
◉ WAF (Web Application Firewall)
Answer: Protects web applications by filtering HTTP/HTTPS
traffic. Blocks OWASP Top 10 attacks (SQLi, XSS, etc.). Sits in front
of web servers.
◉ IDS (Intrusion Detection System)
Answer: Detects and ALERTS on malicious traffic. Passive — does
not block. Can be network-based (NIDS) or host-based (HIDS).
◉ IPS (Intrusion Prevention System)
Answer: Detects and STOPS malicious traffic. Inline and active.
Upgrade from IDS in terms of response capability.
◉ DMZ (Demilitarized Zone)
Answer: Network segment between the internet and internal
network. Hosts public-facing services (web, email) while
protecting internal resources.
◉ Microsegmentation
,Answer: Divides the network into small isolated zones. Limits
lateral movement after a breach. Core component of Zero Trust
architectures.
◉ Bastion Host
Answer: Hardened server that is the sole controlled entry point
from a lower-security zone into a higher-security zone.
◉ VPN (Virtual Private Network)
Answer: Encrypts traffic over public networks. IPSec VPN
preferred for cloud uploads. Site-to-site vs. remote access
variants.
◉ Zero Trust
Answer: Never trust, always verify. No implicit trust based on
network location. Every request is authenticated and authorized
regardless of source.
◉ NIC (Network Interface Card) Teaming
Answer: Combining multiple physical NICs into one logical
interface. Provides redundancy (failover) and increased
bandwidth (load balancing).
◉ VLAN (Virtual Local Area Network)
,Answer: Logically segments a physical network into separate
broadcast domains without additional hardware. Isolates
sensitive systems on shared infrastructure.
◉ NACL (Network Access Control List)
Answer: Stateless firewall at the subnet level. Evaluates each
packet independently against numbered allow/deny rules. In
AWS, protects entire subnets.
◉ NSG (Network Security Group)
Answer: Stateful firewall at the resource/instance level. Tracks
connection state — return traffic automatically permitted.
Common in Azure.
◉ Hub and Spoke Network
Answer: Central hub (transit VPC or service provider) connects to
multiple spoke networks. Traffic flows through hub for
centralized security inspection.
◉ Defense in Depth
Answer: Multiple layers of security controls so if one fails, others
still protect. No single point of failure in security posture.
◉ Air Gap
Answer: Complete physical/logical isolation from other networks.
Highest security for classified or critical systems.
, ◉ Egress Monitoring
Answer: Monitors outbound traffic for data exfiltration, C2
(Command and Control) beaconing, and policy violations.
◉ Authentication vs Authorization
Answer: Authentication = proving who you are. Authorization =
what you are allowed to do. These are separate and sequential
steps.
◉ MFA (Multi-Factor Authentication)
Answer: Requires two or more factors: something you know
(password), something you have (token), something you are
(biometric).
◉ SAML (Security Assertion Markup Language)
Answer: XML-based standard for exchanging authentication and
authorization data between an IdP (Identity Provider) and SP
(Service Provider). Common for enterprise SSO.
◉ OAuth 2.0
Answer: Authorization framework allowing third-party apps to
access resources on behalf of a user without exposing credentials.
Issues access tokens.
◉ OpenID Connect (OIDC)
