WGU D485 DGN2 TASK 1 PROFESSIONAL
EXAM REVIEW WITH TESTED QUESTIONS
AND EXPERT SOLUTIONS
◉ VM Escape
Answer: Attack where a VM breaks out of its isolated environment
and accesses the hypervisor or other VMs on the same physical
host. Critical cloud threat.
◉ VM Sprawl
Answer: Uncontrolled proliferation of unused VMs still running.
Increases attack surface and resource waste.
◉ Ephemeral Computing
Answer: Infrastructure temporary by design — spun up for a task
and destroyed when done. Security must be baked into the image
before deployment.
◉ SAST (Static Application Security Testing)
Answer: Analyzes source code or binaries without executing the
application. White-box testing. Used before deployment during
development. Finds issues early.
◉ DAST (Dynamic Application Security Testing)
,Answer: Tests the running application from the outside. Black-box
— no source code needed. Used during or after deployment at
runtime.
◉ IAST (Interactive Application Security Testing)
Answer: Agents inside the application monitor behavior during
execution. Combines SAST and DAST. Used during
testing/runtime.
◉ SCA (Software Composition Analysis)
Answer: Scans third-party and open-source dependencies for
known CVEs. Used during development. Tools: Snyk, Dependabot.
◉ High Availability (HA)
Answer: Designing systems to remain operational with minimal
downtime through redundancy and failover. 99.9% = ~8.7 hrs
downtime/year. 99.99% = ~52 min/year.
◉ RTO (Recovery Time Objective)
Answer: Maximum acceptable time to restore a system after a
disruption. How fast you need to recover.
◉ RPO (Recovery Point Objective)
Answer: Maximum acceptable amount of data loss measured in
time. How much data you can afford to lose.
, ◉ Distributed Resource Scheduling
Answer: Automatically balances workloads across physical hosts
based on CPU/memory utilization. VMware DRS is the classic
example.
◉ Distinct Physical Paths
Answer: Separate independent physical network routes
eliminating single points of failure. Essential for HA and DR.
◉ Cloud Data Lifecycle — Create Phase
Answer: Data classification and categorization happen here —
data owner's responsibility. Encrypt before uploading via IPSec or
TLS VPN.
◉ Cloud Data Lifecycle — Store Phase
Answer: Never store crypto keys with the cloud provider. Use
CASB or dedicated KMS. Enforce encryption at rest (AES-256).
◉ Cloud Data Lifecycle — Use Phase
Answer: Access controls, DRM, activity monitoring, and DLP
enforcement. Data is actively processed here.
◉ Cloud Data Lifecycle — Share Phase
Answer: Adhere to EAR and Wassenaar Arrangement for cross-
border transfers. Apply DLP policies.
EXAM REVIEW WITH TESTED QUESTIONS
AND EXPERT SOLUTIONS
◉ VM Escape
Answer: Attack where a VM breaks out of its isolated environment
and accesses the hypervisor or other VMs on the same physical
host. Critical cloud threat.
◉ VM Sprawl
Answer: Uncontrolled proliferation of unused VMs still running.
Increases attack surface and resource waste.
◉ Ephemeral Computing
Answer: Infrastructure temporary by design — spun up for a task
and destroyed when done. Security must be baked into the image
before deployment.
◉ SAST (Static Application Security Testing)
Answer: Analyzes source code or binaries without executing the
application. White-box testing. Used before deployment during
development. Finds issues early.
◉ DAST (Dynamic Application Security Testing)
,Answer: Tests the running application from the outside. Black-box
— no source code needed. Used during or after deployment at
runtime.
◉ IAST (Interactive Application Security Testing)
Answer: Agents inside the application monitor behavior during
execution. Combines SAST and DAST. Used during
testing/runtime.
◉ SCA (Software Composition Analysis)
Answer: Scans third-party and open-source dependencies for
known CVEs. Used during development. Tools: Snyk, Dependabot.
◉ High Availability (HA)
Answer: Designing systems to remain operational with minimal
downtime through redundancy and failover. 99.9% = ~8.7 hrs
downtime/year. 99.99% = ~52 min/year.
◉ RTO (Recovery Time Objective)
Answer: Maximum acceptable time to restore a system after a
disruption. How fast you need to recover.
◉ RPO (Recovery Point Objective)
Answer: Maximum acceptable amount of data loss measured in
time. How much data you can afford to lose.
, ◉ Distributed Resource Scheduling
Answer: Automatically balances workloads across physical hosts
based on CPU/memory utilization. VMware DRS is the classic
example.
◉ Distinct Physical Paths
Answer: Separate independent physical network routes
eliminating single points of failure. Essential for HA and DR.
◉ Cloud Data Lifecycle — Create Phase
Answer: Data classification and categorization happen here —
data owner's responsibility. Encrypt before uploading via IPSec or
TLS VPN.
◉ Cloud Data Lifecycle — Store Phase
Answer: Never store crypto keys with the cloud provider. Use
CASB or dedicated KMS. Enforce encryption at rest (AES-256).
◉ Cloud Data Lifecycle — Use Phase
Answer: Access controls, DRM, activity monitoring, and DLP
enforcement. Data is actively processed here.
◉ Cloud Data Lifecycle — Share Phase
Answer: Adhere to EAR and Wassenaar Arrangement for cross-
border transfers. Apply DLP policies.
