WGU E025 – Cloud and Network Security Models exam
EXAM COVERAGE
1. Cloud security models and shared responsibility — public, private, hybrid, and multicloud
environments, provider responsibilities, customer responsibilities, and security boundaries.
2. Network security architecture — segmentation, security zones, defense in depth, secure
network design, trust boundaries, and protection of cloud-connected resources.
3. Identity and access management — authentication, authorization, federation, SSO, MFA,
RBAC, least privilege, privileged access, and lifecycle management.
4. Network controls — firewalls, security groups, network ACLs, proxies, web application
firewalls, intrusion detection, intrusion prevention, and secure gateways.
5. Cloud networking — virtual networks, subnets, routing, gateways, VPNs, dedicated
connectivity, DNS, load balancing, ingress, egress, and private endpoints.
6. Data security and encryption — encryption at rest and in transit, key management, secrets,
certificates, tokenization, data classification, and secure storage.
7. Threats and attack models — malware, phishing, credential attacks, denial of service, lateral
movement, data exfiltration, misconfiguration, and cloud-specific risks.
8. Security monitoring and incident response — centralized logging, SIEM, alerting, threat
detection, investigation, containment, eradication, recovery, and evidence preservation.
9. Governance, compliance, and risk — security policies, standards, risk assessment, audits,
regulatory requirements, security baselines, vulnerability management, and continuous
,compliance.
10. Zero Trust and secure operations — continuous verification, device and workload trust,
microsegmentation, secure configuration, vulnerability management, resilience, backup, and
disaster recovery.
1. A security analyst is investigating an environment where firewall is important. Which
action best addresses the stated security requirement? Consider identity, network
exposure, data protection, monitoring, and operational impact when selecting the best
answer.
• Disable security controls whenever possible and depend on network location as the
primary source of trust.
• Give all users broad administrative permissions so security operations can be completed
without access restrictions.
✓ Apply it so that the environment can inspect and control network traffic according
to security policy.
• Treat successful authentication as permanent trust and avoid reassessing access when
context or risk changes.
Rationale: The correct choice is appropriate because inspect and control network traffic
according to security policy. Effective cloud and network security uses layered, controlled,
and continuously evaluated protections.
,2. A security analyst is investigating an environment where data loss prevention is
important. Which action best addresses the stated security requirement? Consider
identity, network exposure, data protection, monitoring, and operational impact when
selecting the best answer.
• Disable security controls whenever possible and depend on network location as the
primary source of trust.
✓ Apply it so that the environment can identify and prevent unauthorized movement
or disclosure of sensitive information.
• Give all users broad administrative permissions so security operations can be completed
without access restrictions.
• Treat successful authentication as permanent trust and avoid reassessing access when
context or risk changes.
Rationale: The correct choice is appropriate because identify and prevent unauthorized
movement or disclosure of sensitive information. Effective cloud and network security uses
layered, controlled, and continuously evaluated protections.
3. A company is designing a secure cloud network involving least privilege. Which choice
best reduces security risk while supporting normal operations? Consider identity,
network exposure, data protection, monitoring, and operational impact when selecting
the best answer.
• Disable security controls whenever possible and depend on network location as the
primary source of trust.
, • Give all users broad administrative permissions so security operations can be completed
without access restrictions.
• Treat successful authentication as permanent trust and avoid reassessing access when
context or risk changes.
✓ Apply it so that the environment can grant users and workloads only the
permissions required for authorized activities.
Rationale: The correct choice is appropriate because grant users and workloads only the
permissions required for authorized activities. Effective cloud and network security uses
layered, controlled, and continuously evaluated protections.
4. A cloud security architect is evaluating security baseline for an enterprise
environment. Which approach best reflects sound security practice? Consider identity,
network exposure, data protection, monitoring, and operational impact when selecting
the best answer.
• Disable security controls whenever possible and depend on network location as the
primary source of trust.
• Give all users broad administrative permissions so security operations can be completed
without access restrictions.
✓ Apply it so that the environment can define approved secure configurations
against which systems can be evaluated.
• Treat successful authentication as permanent trust and avoid reassessing access when
context or risk changes.
EXAM COVERAGE
1. Cloud security models and shared responsibility — public, private, hybrid, and multicloud
environments, provider responsibilities, customer responsibilities, and security boundaries.
2. Network security architecture — segmentation, security zones, defense in depth, secure
network design, trust boundaries, and protection of cloud-connected resources.
3. Identity and access management — authentication, authorization, federation, SSO, MFA,
RBAC, least privilege, privileged access, and lifecycle management.
4. Network controls — firewalls, security groups, network ACLs, proxies, web application
firewalls, intrusion detection, intrusion prevention, and secure gateways.
5. Cloud networking — virtual networks, subnets, routing, gateways, VPNs, dedicated
connectivity, DNS, load balancing, ingress, egress, and private endpoints.
6. Data security and encryption — encryption at rest and in transit, key management, secrets,
certificates, tokenization, data classification, and secure storage.
7. Threats and attack models — malware, phishing, credential attacks, denial of service, lateral
movement, data exfiltration, misconfiguration, and cloud-specific risks.
8. Security monitoring and incident response — centralized logging, SIEM, alerting, threat
detection, investigation, containment, eradication, recovery, and evidence preservation.
9. Governance, compliance, and risk — security policies, standards, risk assessment, audits,
regulatory requirements, security baselines, vulnerability management, and continuous
,compliance.
10. Zero Trust and secure operations — continuous verification, device and workload trust,
microsegmentation, secure configuration, vulnerability management, resilience, backup, and
disaster recovery.
1. A security analyst is investigating an environment where firewall is important. Which
action best addresses the stated security requirement? Consider identity, network
exposure, data protection, monitoring, and operational impact when selecting the best
answer.
• Disable security controls whenever possible and depend on network location as the
primary source of trust.
• Give all users broad administrative permissions so security operations can be completed
without access restrictions.
✓ Apply it so that the environment can inspect and control network traffic according
to security policy.
• Treat successful authentication as permanent trust and avoid reassessing access when
context or risk changes.
Rationale: The correct choice is appropriate because inspect and control network traffic
according to security policy. Effective cloud and network security uses layered, controlled,
and continuously evaluated protections.
,2. A security analyst is investigating an environment where data loss prevention is
important. Which action best addresses the stated security requirement? Consider
identity, network exposure, data protection, monitoring, and operational impact when
selecting the best answer.
• Disable security controls whenever possible and depend on network location as the
primary source of trust.
✓ Apply it so that the environment can identify and prevent unauthorized movement
or disclosure of sensitive information.
• Give all users broad administrative permissions so security operations can be completed
without access restrictions.
• Treat successful authentication as permanent trust and avoid reassessing access when
context or risk changes.
Rationale: The correct choice is appropriate because identify and prevent unauthorized
movement or disclosure of sensitive information. Effective cloud and network security uses
layered, controlled, and continuously evaluated protections.
3. A company is designing a secure cloud network involving least privilege. Which choice
best reduces security risk while supporting normal operations? Consider identity,
network exposure, data protection, monitoring, and operational impact when selecting
the best answer.
• Disable security controls whenever possible and depend on network location as the
primary source of trust.
, • Give all users broad administrative permissions so security operations can be completed
without access restrictions.
• Treat successful authentication as permanent trust and avoid reassessing access when
context or risk changes.
✓ Apply it so that the environment can grant users and workloads only the
permissions required for authorized activities.
Rationale: The correct choice is appropriate because grant users and workloads only the
permissions required for authorized activities. Effective cloud and network security uses
layered, controlled, and continuously evaluated protections.
4. A cloud security architect is evaluating security baseline for an enterprise
environment. Which approach best reflects sound security practice? Consider identity,
network exposure, data protection, monitoring, and operational impact when selecting
the best answer.
• Disable security controls whenever possible and depend on network location as the
primary source of trust.
• Give all users broad administrative permissions so security operations can be completed
without access restrictions.
✓ Apply it so that the environment can define approved secure configurations
against which systems can be evaluated.
• Treat successful authentication as permanent trust and avoid reassessing access when
context or risk changes.
