WGU D485 Task 1: SWBTL Cloud Security
Implementation Plan Questions and Well
Graded Solutions with Rationales Updated
2026-2027
Pass your WGU D485 Task 1 assignment on the first attempt with this comprehensive SWBTL
LLC Cloud Security Implementation Plan. This guide features expert-vetted configurations for
Azure Government migration, including Hub-and-Spoke network topology, Microsoft Entra ID
Privileged Identity Management (PIM) architecture, Azure Policy enforcement, and detailed
technical controls for FISMA and PCI DSS compliance mapping. Perfect for scoring high on
your DGN2 evaluation with zero revisions
Identity and Access Management (IAM)
1. Which Azure service should SWBTL LLC implement to enforce the principle of least
privilege by providing temporary, time-bound administrative access that
automatically expires?
A) Azure Active Directory Identity Protection
B) Microsoft Entra ID Conditional Access
C) Microsoft Entra ID Privileged Identity Management (PIM)
D) Azure Role-Based Access Control (RBAC) permanent assignments
Rationale: Microsoft Entra ID PIM provides "just-in-time" (JIT) privileged access,
allowing administrative roles to be active only when needed. This directly satisfies
the least-privilege security goal by preventing permanent administrative permissions
on accounts.
2. To protect administrative accounts from phishing attacks, which authentication
configuration should SWBTL LLC mandate?
A) Standard password with security questions
B) SMS-based one-time passcodes
C) Voice-call verification codes
D) Phishing-resistant Multi-Factor Authentication using FIDO2 security keys
Rationale: Phishing-resistant MFA using FIDO2 or certificate-based authentication
prevents attackers from intercepting tokens through proxy sites, fulfilling strict federal
and PCI DSS access control requirements.
3. SWBTL LLC needs to restrict cloud management portal access to corporate-
managed, compliant laptops only. Which Entra ID feature enforces this capability?
A) Conditional Access Policies
B) Entra ID Connect
C) Azure App Registrations
D) Management Group RBAC
Rationale: Conditional Access Policies act as an explicit policy engine that evaluates
signals (device state, user location, risk profile) before granting access to cloud
resources.
4. When auditing user provisioning lifecycles under FISMA guidelines, what process
must SWBTL LLC implement to verify that former employees do not retain access?
1|Page
, A) Manual monthly spreadsheet reviews
B) Automated Identity Governance Access Reviews
C) Self-attestation emails from users
D) Standard password reset schedules
Rationale: Automated Entra ID Access Reviews provide documented, systemic
attestation of access necessity, ensuring compliance with federal auditing and
access control lifecycle standards.
5. To isolate administrative duties, a cloud architect should ensure that a user assigned
to manage virtual networks cannot view or alter database logs. This concept is
known as:
A) Defense-in-depth
B) Separation of Duties
C) Absolute Authorization
D) Perimeter Securing
Rationale: Separation of duties splits critical responsibilities among different roles to
mitigate internal risks and prevent single-user system compromises.
6. What type of authorization mechanism is applied when assigning a user the built-in
"Storage Blob Data Contributor" role in Azure?
A) Attribute-Based Access Control (ABAC)
B) Role-Based Access Control (RBAC)
C) Discretionary Access Control (DAC)
D) Mandatory Access Control (MAC)
Rationale: Azure RBAC grants specific operational permissions over cloud resources
by mapping identities to pre-defined or custom security roles.
7. SWBTL LLC intends to use a hybrid identity model to sync its on-premises directory
to Azure Government. Which tool should be deployed?
A) Azure Bastion
B) Microsoft Entra Connect Cloud Sync
C) Azure Application Gateway
D) Azure Data Box
Rationale: Entra Connect Cloud Sync bridges on-premises Active Directory Domain
Services (AD DS) with cloud-based Entra ID, simplifying user onboarding.
8. Which feature allows SWBTL LLC to group multiple Azure subscriptions together to
enforce unified RBAC and policy boundaries at an organizational level?
A) Resource Groups
B) Management Groups
C) Resource Tags
D) Availability Zones
Rationale: Management Groups sit above subscriptions in the Azure hierarchy,
providing a scalable container to apply governance, RBAC, and cloud policies.
9. Under the least privilege principle, what role should be assigned to an external
auditor who only needs to verify configurations without making changes?
A) Contributor
B) Owner
C) Reader
D) Security Administrator
Rationale: The Reader role allows users to view all resources but explicitly restricts
them from modifying configurations or deleting infrastructure.
10. To prevent credential stuffing attacks on standard employee accounts, which feature
evaluates login patterns for suspicious signs like "impossible travel"?
2|Page
, A) Azure Policy
B) Microsoft Entra ID Protection
C) Azure Disk Encryption
D) Azure Service Health
Rationale: Entra ID Protection utilizes machine learning to flag risk detections such
as leaked credentials, anonymous IP addresses, or impossible travel anomalies.
Cloud Hardening Strategy
11. How should SWBTL LLC handle virtual machine (VM) baseline configurations to
ensure its cloud hardening strategy meets CIS Benchmarks Level 1 security
requirements?
A) Allow standard employees to provision any public VM image from their personal
devices.
B) Use unpatched, older OS versions to minimize licensing expenses.
C) Mandate the use of hardened Azure Marketplace images and configure Just-
In-Time (JIT) VM access.
D) Permanently leave management ports 22 and 3389 open to the public internet for
remote management.
Rationale: Using pre-hardened baseline images from the marketplace ensures that
standard security controls are baked into the OS. Activating JIT VM access
minimizes the attack surface by shutting down standard management ports
(RDP/SSH) when they are not actively in use.
12. To prevent brute-force external attacks against management ports on Azure virtual
machines, which service dynamically restricts inbound RDP and SSH traffic?
A) Azure Application Gateway
B) Just-In-Time (JIT) VM Access via Microsoft Defender for Cloud
C) Azure Route Server
D) Azure Public IP standard SKU
Rationale: JIT VM access locks down inbound management ports, requiring an
explicit, approved request through Defender for Cloud to open the port for a short,
temporary window.
13. Which automated management tool allows SWBTL LLC to ensure all deployed
virtual machines receive critical operating system security patches every month?
A) Azure Blueprint
B) Azure Update Manager
C) Azure Service Bus
D) Azure Content Delivery Network
Rationale: Azure Update Manager streamlines patch compliance for hybrid and
cloud-native virtual machines, showing clear dashboards required for FISMA audits.
14. During an infrastructure audit, you notice that multiple virtual machines have public
IP addresses attached directly to their network interfaces. What security control
should be implemented to eliminate this public surface risk while retaining remote
access?
A) Azure Front Door
3|Page
, B) Azure Bastion
C) Local hosts files
D) Standard public load balancers
Rationale: Azure Bastion provides secure, seamless RDP/SSH connectivity to virtual
machines directly over TLS within the Azure portal, removing the need for public IP
addresses on individual VMs.
15. What is the standard configuration applied to Network Security Groups (NSGs) to
enforce strict micro-segmentation between application layers?
A) Allow All inbound and outbound traffic
B) An explicit "Deny All" inbound rule override with narrow exceptions for
specific source ports and IPs
C) Relying entirely on the host operating system's software firewall without NSGs
D) Configuring NSGs to allow any traffic from any internet source
Rationale: Strict micro-segmentation demands a zero-trust posture, starting with a
default deny posture and explicitly permitting only validated communication paths.
16. To secure an Azure Storage Account containing sensitive transaction files, which
network configuration must be applied?
A) Expose the storage account publicly to simplify connection strings.
B) Disable public endpoint access and route traffic through an Azure Private
Endpoint.
C) Rely solely on user passwords while keeping the public internet route open.
D) Use basic unencrypted HTTP for data queries.
Rationale: Azure Private Endpoints leverage private IP addresses from a Virtual
Network, keeping all traffic traversing between resources completely within the
Microsoft backbone network.
17. Which protocol version should be enforced as a bare minimum across all SWBTL
cloud endpoints to prevent intercepting or degrading data-in-transit?
A) SSL 3.0
B) TLS 1.0
C) TLS 1.1
D) TLS 1.2 or higher
Rationale: Older encryption protocols like SSL and early TLS versions contain known
vulnerabilities. Regulatory frameworks like PCI DSS v4.0 mandate TLS 1.2 or higher.
18. To harden an Azure environment against unauthorized infrastructure modifications,
how should infrastructure deployments be managed?
A) Manually modifying configurations via the Azure Portal by various administrators
B) Enforcing Infrastructure as Code (IaC) via automated CI/CD pipelines with
manual approval gates
C) Disabling all deployment logs to speed up infrastructure creation
D) Allowing standard users to execute arbitrary PowerShell scripts
Rationale: Managing deployments via IaC (such as Bicep or Terraform) through
automated pipelines introduces reviewable code commits, repeatable baselines, and
mitigates human configuration errors.
19. Which tool can automatically evaluate compliance with hardening guides across all
Azure SQL databases simultaneously?
A) Azure Advisor
B) Microsoft Defender for Cloud Vulnerability Assessment
C) Azure Monitor Metrics
D) Azure ExpressRoute
Rationale: Defender for Cloud's vulnerability assessment engine continuously scans
4|Page
Implementation Plan Questions and Well
Graded Solutions with Rationales Updated
2026-2027
Pass your WGU D485 Task 1 assignment on the first attempt with this comprehensive SWBTL
LLC Cloud Security Implementation Plan. This guide features expert-vetted configurations for
Azure Government migration, including Hub-and-Spoke network topology, Microsoft Entra ID
Privileged Identity Management (PIM) architecture, Azure Policy enforcement, and detailed
technical controls for FISMA and PCI DSS compliance mapping. Perfect for scoring high on
your DGN2 evaluation with zero revisions
Identity and Access Management (IAM)
1. Which Azure service should SWBTL LLC implement to enforce the principle of least
privilege by providing temporary, time-bound administrative access that
automatically expires?
A) Azure Active Directory Identity Protection
B) Microsoft Entra ID Conditional Access
C) Microsoft Entra ID Privileged Identity Management (PIM)
D) Azure Role-Based Access Control (RBAC) permanent assignments
Rationale: Microsoft Entra ID PIM provides "just-in-time" (JIT) privileged access,
allowing administrative roles to be active only when needed. This directly satisfies
the least-privilege security goal by preventing permanent administrative permissions
on accounts.
2. To protect administrative accounts from phishing attacks, which authentication
configuration should SWBTL LLC mandate?
A) Standard password with security questions
B) SMS-based one-time passcodes
C) Voice-call verification codes
D) Phishing-resistant Multi-Factor Authentication using FIDO2 security keys
Rationale: Phishing-resistant MFA using FIDO2 or certificate-based authentication
prevents attackers from intercepting tokens through proxy sites, fulfilling strict federal
and PCI DSS access control requirements.
3. SWBTL LLC needs to restrict cloud management portal access to corporate-
managed, compliant laptops only. Which Entra ID feature enforces this capability?
A) Conditional Access Policies
B) Entra ID Connect
C) Azure App Registrations
D) Management Group RBAC
Rationale: Conditional Access Policies act as an explicit policy engine that evaluates
signals (device state, user location, risk profile) before granting access to cloud
resources.
4. When auditing user provisioning lifecycles under FISMA guidelines, what process
must SWBTL LLC implement to verify that former employees do not retain access?
1|Page
, A) Manual monthly spreadsheet reviews
B) Automated Identity Governance Access Reviews
C) Self-attestation emails from users
D) Standard password reset schedules
Rationale: Automated Entra ID Access Reviews provide documented, systemic
attestation of access necessity, ensuring compliance with federal auditing and
access control lifecycle standards.
5. To isolate administrative duties, a cloud architect should ensure that a user assigned
to manage virtual networks cannot view or alter database logs. This concept is
known as:
A) Defense-in-depth
B) Separation of Duties
C) Absolute Authorization
D) Perimeter Securing
Rationale: Separation of duties splits critical responsibilities among different roles to
mitigate internal risks and prevent single-user system compromises.
6. What type of authorization mechanism is applied when assigning a user the built-in
"Storage Blob Data Contributor" role in Azure?
A) Attribute-Based Access Control (ABAC)
B) Role-Based Access Control (RBAC)
C) Discretionary Access Control (DAC)
D) Mandatory Access Control (MAC)
Rationale: Azure RBAC grants specific operational permissions over cloud resources
by mapping identities to pre-defined or custom security roles.
7. SWBTL LLC intends to use a hybrid identity model to sync its on-premises directory
to Azure Government. Which tool should be deployed?
A) Azure Bastion
B) Microsoft Entra Connect Cloud Sync
C) Azure Application Gateway
D) Azure Data Box
Rationale: Entra Connect Cloud Sync bridges on-premises Active Directory Domain
Services (AD DS) with cloud-based Entra ID, simplifying user onboarding.
8. Which feature allows SWBTL LLC to group multiple Azure subscriptions together to
enforce unified RBAC and policy boundaries at an organizational level?
A) Resource Groups
B) Management Groups
C) Resource Tags
D) Availability Zones
Rationale: Management Groups sit above subscriptions in the Azure hierarchy,
providing a scalable container to apply governance, RBAC, and cloud policies.
9. Under the least privilege principle, what role should be assigned to an external
auditor who only needs to verify configurations without making changes?
A) Contributor
B) Owner
C) Reader
D) Security Administrator
Rationale: The Reader role allows users to view all resources but explicitly restricts
them from modifying configurations or deleting infrastructure.
10. To prevent credential stuffing attacks on standard employee accounts, which feature
evaluates login patterns for suspicious signs like "impossible travel"?
2|Page
, A) Azure Policy
B) Microsoft Entra ID Protection
C) Azure Disk Encryption
D) Azure Service Health
Rationale: Entra ID Protection utilizes machine learning to flag risk detections such
as leaked credentials, anonymous IP addresses, or impossible travel anomalies.
Cloud Hardening Strategy
11. How should SWBTL LLC handle virtual machine (VM) baseline configurations to
ensure its cloud hardening strategy meets CIS Benchmarks Level 1 security
requirements?
A) Allow standard employees to provision any public VM image from their personal
devices.
B) Use unpatched, older OS versions to minimize licensing expenses.
C) Mandate the use of hardened Azure Marketplace images and configure Just-
In-Time (JIT) VM access.
D) Permanently leave management ports 22 and 3389 open to the public internet for
remote management.
Rationale: Using pre-hardened baseline images from the marketplace ensures that
standard security controls are baked into the OS. Activating JIT VM access
minimizes the attack surface by shutting down standard management ports
(RDP/SSH) when they are not actively in use.
12. To prevent brute-force external attacks against management ports on Azure virtual
machines, which service dynamically restricts inbound RDP and SSH traffic?
A) Azure Application Gateway
B) Just-In-Time (JIT) VM Access via Microsoft Defender for Cloud
C) Azure Route Server
D) Azure Public IP standard SKU
Rationale: JIT VM access locks down inbound management ports, requiring an
explicit, approved request through Defender for Cloud to open the port for a short,
temporary window.
13. Which automated management tool allows SWBTL LLC to ensure all deployed
virtual machines receive critical operating system security patches every month?
A) Azure Blueprint
B) Azure Update Manager
C) Azure Service Bus
D) Azure Content Delivery Network
Rationale: Azure Update Manager streamlines patch compliance for hybrid and
cloud-native virtual machines, showing clear dashboards required for FISMA audits.
14. During an infrastructure audit, you notice that multiple virtual machines have public
IP addresses attached directly to their network interfaces. What security control
should be implemented to eliminate this public surface risk while retaining remote
access?
A) Azure Front Door
3|Page
, B) Azure Bastion
C) Local hosts files
D) Standard public load balancers
Rationale: Azure Bastion provides secure, seamless RDP/SSH connectivity to virtual
machines directly over TLS within the Azure portal, removing the need for public IP
addresses on individual VMs.
15. What is the standard configuration applied to Network Security Groups (NSGs) to
enforce strict micro-segmentation between application layers?
A) Allow All inbound and outbound traffic
B) An explicit "Deny All" inbound rule override with narrow exceptions for
specific source ports and IPs
C) Relying entirely on the host operating system's software firewall without NSGs
D) Configuring NSGs to allow any traffic from any internet source
Rationale: Strict micro-segmentation demands a zero-trust posture, starting with a
default deny posture and explicitly permitting only validated communication paths.
16. To secure an Azure Storage Account containing sensitive transaction files, which
network configuration must be applied?
A) Expose the storage account publicly to simplify connection strings.
B) Disable public endpoint access and route traffic through an Azure Private
Endpoint.
C) Rely solely on user passwords while keeping the public internet route open.
D) Use basic unencrypted HTTP for data queries.
Rationale: Azure Private Endpoints leverage private IP addresses from a Virtual
Network, keeping all traffic traversing between resources completely within the
Microsoft backbone network.
17. Which protocol version should be enforced as a bare minimum across all SWBTL
cloud endpoints to prevent intercepting or degrading data-in-transit?
A) SSL 3.0
B) TLS 1.0
C) TLS 1.1
D) TLS 1.2 or higher
Rationale: Older encryption protocols like SSL and early TLS versions contain known
vulnerabilities. Regulatory frameworks like PCI DSS v4.0 mandate TLS 1.2 or higher.
18. To harden an Azure environment against unauthorized infrastructure modifications,
how should infrastructure deployments be managed?
A) Manually modifying configurations via the Azure Portal by various administrators
B) Enforcing Infrastructure as Code (IaC) via automated CI/CD pipelines with
manual approval gates
C) Disabling all deployment logs to speed up infrastructure creation
D) Allowing standard users to execute arbitrary PowerShell scripts
Rationale: Managing deployments via IaC (such as Bicep or Terraform) through
automated pipelines introduces reviewable code commits, repeatable baselines, and
mitigates human configuration errors.
19. Which tool can automatically evaluate compliance with hardening guides across all
Azure SQL databases simultaneously?
A) Azure Advisor
B) Microsoft Defender for Cloud Vulnerability Assessment
C) Azure Monitor Metrics
D) Azure ExpressRoute
Rationale: Defender for Cloud's vulnerability assessment engine continuously scans
4|Page
