WESTERN GOVERNORS UNIVERSITY | D782 / HKN1
WGU D782 | HKN1 TASK 2
Network Security
CloudCampusIQ: application, deployment architecture, cloud security and evidence register
Figure 1. Original AWS architecture proposal; not a deployment screenshot.
Prepared: 23 October 2026 | Provider: AWS | Deliverables: report + runnable Flask source + configuration
template + unit tests
DOCUMENT STATUS: Research-informed implementation exemplar. Task 2 assessment instructions and full official
rubric were unavailable. No AWS resources were created; no performance, spending, certificate or security
outcome is asserted as tested.
Task 2 Network Security • Research-informed technical exemplar | 1
, WESTERN GOVERNORS UNIVERSITY | D782 / HKN1
Executive summary and evidence boundary
CloudCampusIQ is an online-course startup. The supplied Task 1 assessment describes secure course-material
storage, high availability, scalability, and a target of up to 10,000 concurrent users. Task 2 student reports describe
deploying a working application, configuring network protections and HTTPS, observing metrics, and documenting
infrastructure. The exact Task 2 rubric was not provided. This original technical exemplar translates those
available signals into a reproducible AWS design and companion code; it is not an official rubric reproduction.
Evidence classification What is established What is not established
WGU Task 1 PDF (Dec 4, 2025) CloudCampusIQ startup, online courses, Task 2 lettered grading criteria
protected files and 10,000-concurrent-
user target
Student statements (2025–2026) Practical deployment, HTTPS, load Every report is required; all reports
balancing, access configuration, reflect the same version
monitoring/billing appear relevant
AWS documentation Service capabilities, security An AWS account/environment has been
constraints, provisioning patterns configured or passed WGU evaluation
This implementation Source code, architecture, controls, Real screenshots, cost records, test-load
deployment and verification capacity or an awarded grade
instructions
Practical acceptance targets proposed for the exemplar
A real HTTP-serving Flask course catalogue is accessible behind an Application Load Balancer; /health returns
HTTP 200.
HTTPS is configured with certificate trust status recorded accurately; no custom domain is assumed.
Private app instances do not allow direct internet ingress; only the load balancer security group can reach
application traffic.
A request for private course material requires a valid Cognito access token and an active course enrollment.
Private S3 materials are not anonymously retrievable; the app issues time-limited object URLs after
authorization.
CloudWatch and budget evidence is collected from the real account; resources are destroyed afterward when
appropriate.
SCOPE These are technical quality targets, not quoted WGU Task 2 criterion identifiers.
1. Scenario, assumptions and design rationale
1.1 Assumptions
The Task 1 CloudCampusIQ scenario carries forward for continuity. The Task 2 instructions could instead
specify a distinct scenario; no such source has been supplied.
AWS Elastic Beanstalk Standard is selected (not Elastic Beanstalk Cluster), with EC2 instances, ALB and Python
Flask.
The proposed 10,000 concurrent users is a capacity goal. It is not 10,000 requests per second, and cannot be
asserted without realistic load and failover testing.
The demo catalogue is publicly readable, but file access requires Cognito authentication and a DynamoDB
course-enrollment record.
No production traffic, personally identifiable student data, passwords, account IDs, or confidential courses are
required for this exemplar.
Task 2 Network Security • Research-informed technical exemplar | 2
WGU D782 | HKN1 TASK 2
Network Security
CloudCampusIQ: application, deployment architecture, cloud security and evidence register
Figure 1. Original AWS architecture proposal; not a deployment screenshot.
Prepared: 23 October 2026 | Provider: AWS | Deliverables: report + runnable Flask source + configuration
template + unit tests
DOCUMENT STATUS: Research-informed implementation exemplar. Task 2 assessment instructions and full official
rubric were unavailable. No AWS resources were created; no performance, spending, certificate or security
outcome is asserted as tested.
Task 2 Network Security • Research-informed technical exemplar | 1
, WESTERN GOVERNORS UNIVERSITY | D782 / HKN1
Executive summary and evidence boundary
CloudCampusIQ is an online-course startup. The supplied Task 1 assessment describes secure course-material
storage, high availability, scalability, and a target of up to 10,000 concurrent users. Task 2 student reports describe
deploying a working application, configuring network protections and HTTPS, observing metrics, and documenting
infrastructure. The exact Task 2 rubric was not provided. This original technical exemplar translates those
available signals into a reproducible AWS design and companion code; it is not an official rubric reproduction.
Evidence classification What is established What is not established
WGU Task 1 PDF (Dec 4, 2025) CloudCampusIQ startup, online courses, Task 2 lettered grading criteria
protected files and 10,000-concurrent-
user target
Student statements (2025–2026) Practical deployment, HTTPS, load Every report is required; all reports
balancing, access configuration, reflect the same version
monitoring/billing appear relevant
AWS documentation Service capabilities, security An AWS account/environment has been
constraints, provisioning patterns configured or passed WGU evaluation
This implementation Source code, architecture, controls, Real screenshots, cost records, test-load
deployment and verification capacity or an awarded grade
instructions
Practical acceptance targets proposed for the exemplar
A real HTTP-serving Flask course catalogue is accessible behind an Application Load Balancer; /health returns
HTTP 200.
HTTPS is configured with certificate trust status recorded accurately; no custom domain is assumed.
Private app instances do not allow direct internet ingress; only the load balancer security group can reach
application traffic.
A request for private course material requires a valid Cognito access token and an active course enrollment.
Private S3 materials are not anonymously retrievable; the app issues time-limited object URLs after
authorization.
CloudWatch and budget evidence is collected from the real account; resources are destroyed afterward when
appropriate.
SCOPE These are technical quality targets, not quoted WGU Task 2 criterion identifiers.
1. Scenario, assumptions and design rationale
1.1 Assumptions
The Task 1 CloudCampusIQ scenario carries forward for continuity. The Task 2 instructions could instead
specify a distinct scenario; no such source has been supplied.
AWS Elastic Beanstalk Standard is selected (not Elastic Beanstalk Cluster), with EC2 instances, ALB and Python
Flask.
The proposed 10,000 concurrent users is a capacity goal. It is not 10,000 requests per second, and cannot be
asserted without realistic load and failover testing.
The demo catalogue is publicly readable, but file access requires Cognito authentication and a DynamoDB
course-enrollment record.
No production traffic, personally identifiable student data, passwords, account IDs, or confidential courses are
required for this exemplar.
Task 2 Network Security • Research-informed technical exemplar | 2
