Page 1 of 75
WGU D485 DGN2 PREP 2026 QUESTIONS WITH VERIFIED ANSWERS
DETAILED RATIONALES GRADED A+
Part I: Cloud Service and Deployment Models
1. Which cloud service model places the maximum amount of operational and
security responsibility on the customer?
A. Software as a Service (SaaS)
B. Platform as a Service (PaaS)
C. Infrastructure as a Service (IaaS)
D. Database as a Service (DBaaS)
Rationale: In IaaS, the provider secures only the physical infrastructure,
virtualization layer, and hardware; the customer is responsible for the operating
system, middleware, runtime, data, and applications.
2. In a Platform as a Service (PaaS) model, which of the following is typically
managed by the cloud service provider?
A. Application code
B. Operating system patching
C. User access credentials
D. Data endpoints
Rationale: PaaS abstracts the underlying operating system and infrastructure,
meaning the provider handles OS security updates, maintenance, and patching.
3. Which deployment model provides exclusive cloud resources to a single
organization but is hosted and managed by a third-party provider off-premises?
A. Public Cloud
B. Hosted Private Cloud
1|Page
,Page 2 of 75
C. Hybrid Cloud
D. Community Cloud
Rationale: A hosted private cloud offers dedicated physical or logical
infrastructure to one specific organization while being physically located and
maintained within a provider’s data center.
4. What is the primary benefit of deploying workloads in Azure Government
compared to standard Azure commercial regions?
A. Lower subscription and compute costs
B. Dedicated physical isolation and strict US citizen screening requirements
C. Faster deployment of cutting-edge preview features
D. Global geographic availability across all continents
Rationale: Azure Government is physically isolated from commercial Azure
networks and enforces strict background checks on personnel to meet stringent
federal security requirements.
5. When a customer shifts an application from on-premises to a SaaS solution,
what responsibility transfers entirely to the cloud provider?
A. Application security vulnerabilities and patching
B. Data classification and governance
C. User identity lifecycle management
D. Regulatory compliance attestation
Rationale: In SaaS, the provider assumes responsibility for application-level
security, including patching vulnerabilities in the application, while the customer
retains responsibility for data governance and user access.
6. A multinational corporation is migrating a legacy on-premises data center to a
hybrid cloud architecture and must maintain compliance with GDPR and PCI DSS.
Which of the following represents the MOST accurate division of security
responsibilities?
A. The cloud provider is responsible for securing the customer’s data and access
management, while the customer secures the underlying infrastructure.
2|Page
,Page 3 of 75
B. The customer is responsible for securing the physical data center, while the
provider manages all logical access controls.
C. The provider secures the physical infrastructure and hypervisor, while the
customer secures their data, applications, and identity management.
D. The customer is responsible for securing the network and physical servers,
while the provider secures the operating systems and applications.
Rationale: The shared responsibility model dictates that the cloud provider
secures the underlying infrastructure (physical data centers, network, hypervisor)
while the customer secures their data, applications, and identity management.
7. Which cloud deployment model combines on-premises infrastructure with
public cloud services to support workloads that require both environments?
A. Public cloud
B. Private cloud
C. Hybrid cloud
D. Community cloud
Rationale: A hybrid cloud integrates on-premises or private cloud infrastructure
with public cloud services, allowing data and applications to move between
environments based on business or security requirements.
8. In a community cloud deployment, which of the following best describes the
sharing arrangement?
A. Resources are shared among unrelated organizations with no common
interests.
B. Resources are shared among organizations with common concerns such as
compliance or mission.
C. Resources are dedicated to a single organization only.
D. Resources are managed entirely by a third-party auditor.
Rationale: A community cloud is shared by several organizations that have similar
security, compliance, or operational requirements, and it may be managed by the
organizations or a third party.
3|Page
, Page 4 of 75
9. Which of the following is a primary security advantage of using a private cloud
over a public cloud?
A. Lower capital expenditure
B. Greater control over data residency and isolation
C. Unlimited scalability without configuration
D. Automatic compliance with all regulations
Rationale: Private clouds offer dedicated infrastructure and greater control over
data location, access, and isolation, which can help meet stringent regulatory and
security requirements.
10. A company wants to avoid managing any servers or operating systems while
deploying a custom application. Which cloud service model is most appropriate?
A. IaaS
B. PaaS
C. SaaS
D. On-premises
Rationale: PaaS provides a managed platform for application deployment,
abstracting the underlying servers and operating systems so the customer can
focus on code and configuration.
Part II: Shared Responsibility Model
11. Under the shared responsibility model, who is responsible for data governance
and classification in a public cloud environment?
A. The cloud service provider completely
B. The customer completely
C. The third-party auditor
D. Shared equally between provider and customer
4|Page
WGU D485 DGN2 PREP 2026 QUESTIONS WITH VERIFIED ANSWERS
DETAILED RATIONALES GRADED A+
Part I: Cloud Service and Deployment Models
1. Which cloud service model places the maximum amount of operational and
security responsibility on the customer?
A. Software as a Service (SaaS)
B. Platform as a Service (PaaS)
C. Infrastructure as a Service (IaaS)
D. Database as a Service (DBaaS)
Rationale: In IaaS, the provider secures only the physical infrastructure,
virtualization layer, and hardware; the customer is responsible for the operating
system, middleware, runtime, data, and applications.
2. In a Platform as a Service (PaaS) model, which of the following is typically
managed by the cloud service provider?
A. Application code
B. Operating system patching
C. User access credentials
D. Data endpoints
Rationale: PaaS abstracts the underlying operating system and infrastructure,
meaning the provider handles OS security updates, maintenance, and patching.
3. Which deployment model provides exclusive cloud resources to a single
organization but is hosted and managed by a third-party provider off-premises?
A. Public Cloud
B. Hosted Private Cloud
1|Page
,Page 2 of 75
C. Hybrid Cloud
D. Community Cloud
Rationale: A hosted private cloud offers dedicated physical or logical
infrastructure to one specific organization while being physically located and
maintained within a provider’s data center.
4. What is the primary benefit of deploying workloads in Azure Government
compared to standard Azure commercial regions?
A. Lower subscription and compute costs
B. Dedicated physical isolation and strict US citizen screening requirements
C. Faster deployment of cutting-edge preview features
D. Global geographic availability across all continents
Rationale: Azure Government is physically isolated from commercial Azure
networks and enforces strict background checks on personnel to meet stringent
federal security requirements.
5. When a customer shifts an application from on-premises to a SaaS solution,
what responsibility transfers entirely to the cloud provider?
A. Application security vulnerabilities and patching
B. Data classification and governance
C. User identity lifecycle management
D. Regulatory compliance attestation
Rationale: In SaaS, the provider assumes responsibility for application-level
security, including patching vulnerabilities in the application, while the customer
retains responsibility for data governance and user access.
6. A multinational corporation is migrating a legacy on-premises data center to a
hybrid cloud architecture and must maintain compliance with GDPR and PCI DSS.
Which of the following represents the MOST accurate division of security
responsibilities?
A. The cloud provider is responsible for securing the customer’s data and access
management, while the customer secures the underlying infrastructure.
2|Page
,Page 3 of 75
B. The customer is responsible for securing the physical data center, while the
provider manages all logical access controls.
C. The provider secures the physical infrastructure and hypervisor, while the
customer secures their data, applications, and identity management.
D. The customer is responsible for securing the network and physical servers,
while the provider secures the operating systems and applications.
Rationale: The shared responsibility model dictates that the cloud provider
secures the underlying infrastructure (physical data centers, network, hypervisor)
while the customer secures their data, applications, and identity management.
7. Which cloud deployment model combines on-premises infrastructure with
public cloud services to support workloads that require both environments?
A. Public cloud
B. Private cloud
C. Hybrid cloud
D. Community cloud
Rationale: A hybrid cloud integrates on-premises or private cloud infrastructure
with public cloud services, allowing data and applications to move between
environments based on business or security requirements.
8. In a community cloud deployment, which of the following best describes the
sharing arrangement?
A. Resources are shared among unrelated organizations with no common
interests.
B. Resources are shared among organizations with common concerns such as
compliance or mission.
C. Resources are dedicated to a single organization only.
D. Resources are managed entirely by a third-party auditor.
Rationale: A community cloud is shared by several organizations that have similar
security, compliance, or operational requirements, and it may be managed by the
organizations or a third party.
3|Page
, Page 4 of 75
9. Which of the following is a primary security advantage of using a private cloud
over a public cloud?
A. Lower capital expenditure
B. Greater control over data residency and isolation
C. Unlimited scalability without configuration
D. Automatic compliance with all regulations
Rationale: Private clouds offer dedicated infrastructure and greater control over
data location, access, and isolation, which can help meet stringent regulatory and
security requirements.
10. A company wants to avoid managing any servers or operating systems while
deploying a custom application. Which cloud service model is most appropriate?
A. IaaS
B. PaaS
C. SaaS
D. On-premises
Rationale: PaaS provides a managed platform for application deployment,
abstracting the underlying servers and operating systems so the customer can
focus on code and configuration.
Part II: Shared Responsibility Model
11. Under the shared responsibility model, who is responsible for data governance
and classification in a public cloud environment?
A. The cloud service provider completely
B. The customer completely
C. The third-party auditor
D. Shared equally between provider and customer
4|Page
