WGU D320 - MANAGING CLOUD SECURITY | QUESTIONS AND
ANSWERS | 2026 UPDATE | WITH COMPLETE SOLUTIONS
• Firewall -✓✓ Filters traffic based on ACL rules. Stateful tracks connection state;
stateless matches packet headers only. NGFW adds application awareness and IPS
capability.
• WAF (Web Application Firewall) -✓✓ Protects web applications by filtering
HTTP/HTTPS traffic. Blocks OWASP Top 10 attacks (SQLi, XSS, etc.). Sits in
front of web servers.
• IDS (Intrusion Detection System) -✓✓ Detects and ALERTS on malicious
traffic. Passive — does not block. Can be network-based (NIDS) or host-based
(HIDS).
• IPS (Intrusion Prevention System) -✓✓ Detects and STOPS malicious traffic.
Inline and active. Upgrade from IDS in terms of response capability.
• DMZ (Demilitarized Zone) -✓✓ Network segment between the internet and
internal network. Hosts public-facing services (web, email) while protecting
internal resources.
• Microsegmentation -✓✓ Divides the network into small isolated zones. Limits
lateral movement after a breach. Core component of Zero Trust architectures.
• Bastion Host -✓✓ Hardened server that is the sole controlled entry point from a
lower-security zone into a higher-security zone.
,• VPN (Virtual Private Network) -✓✓ Encrypts traffic over public networks. IPSec
VPN preferred for cloud uploads. Site-to-site vs. remote access variants.
• Zero Trust -✓✓ Never trust, always verify. No implicit trust based on network
location. Every request is authenticated and authorized regardless of source.
• NIC (Network Interface Card) Teaming -✓✓ Combining multiple physical NICs
into one logical interface. Provides redundancy (failover) and increased bandwidth
(load balancing).
• VLAN (Virtual Local Area Network) -✓✓ Logically segments a physical
network into separate broadcast domains without additional hardware. Isolates
sensitive systems on shared infrastructure.
• NACL (Network Access Control List) -✓✓ Stateless firewall at the subnet level.
Evaluates each packet independently against numbered allow/deny rules. In AWS,
protects entire subnets.
• NSG (Network Security Group) -✓✓ Stateful firewall at the resource/instance
level. Tracks connection state — return traffic automatically permitted. Common
in Azure.
• Hub and Spoke Network -✓✓ Central hub (transit VPC or service provider)
connects to multiple spoke networks. Traffic flows through hub for centralized
security inspection.
• Defense in Depth -✓✓ Multiple layers of security controls so if one fails, others
still protect. No single point of failure in security posture.
, • Air Gap -✓✓ Complete physical/logical isolation from other networks. Highest
security for classified or critical systems.
• Egress Monitoring -✓✓ Monitors outbound traffic for data exfiltration, C2
(Command and Control) beaconing, and policy violations.
• Authentication vs Authorization -✓✓ Authentication = proving who you are.
Authorization = what you are allowed to do. These are separate and sequential
steps.
• MFA (Multi-Factor Authentication) -✓✓ Requires two or more factors:
something you know (password), something you have (token), something you are
(biometric).
• SAML (Security Assertion Markup Language) -✓✓ XML-based standard for
exchanging authentication and authorization data between an IdP (Identity
Provider) and SP (Service Provider). Common for enterprise SSO.
• OAuth 2.0 -✓✓ Authorization framework allowing third-party apps to access
resources on behalf of a user without exposing credentials. Issues access tokens.
• OpenID Connect (OIDC) -✓✓ Identity layer built on OAuth 2.0. Adds
authentication (who you are) to OAuth's authorization (what you can access).
• Federation (Identity) -✓✓ Linking identity systems across organizations so users
authenticate once and access resources in multiple domains (cross-org SSO).
ANSWERS | 2026 UPDATE | WITH COMPLETE SOLUTIONS
• Firewall -✓✓ Filters traffic based on ACL rules. Stateful tracks connection state;
stateless matches packet headers only. NGFW adds application awareness and IPS
capability.
• WAF (Web Application Firewall) -✓✓ Protects web applications by filtering
HTTP/HTTPS traffic. Blocks OWASP Top 10 attacks (SQLi, XSS, etc.). Sits in
front of web servers.
• IDS (Intrusion Detection System) -✓✓ Detects and ALERTS on malicious
traffic. Passive — does not block. Can be network-based (NIDS) or host-based
(HIDS).
• IPS (Intrusion Prevention System) -✓✓ Detects and STOPS malicious traffic.
Inline and active. Upgrade from IDS in terms of response capability.
• DMZ (Demilitarized Zone) -✓✓ Network segment between the internet and
internal network. Hosts public-facing services (web, email) while protecting
internal resources.
• Microsegmentation -✓✓ Divides the network into small isolated zones. Limits
lateral movement after a breach. Core component of Zero Trust architectures.
• Bastion Host -✓✓ Hardened server that is the sole controlled entry point from a
lower-security zone into a higher-security zone.
,• VPN (Virtual Private Network) -✓✓ Encrypts traffic over public networks. IPSec
VPN preferred for cloud uploads. Site-to-site vs. remote access variants.
• Zero Trust -✓✓ Never trust, always verify. No implicit trust based on network
location. Every request is authenticated and authorized regardless of source.
• NIC (Network Interface Card) Teaming -✓✓ Combining multiple physical NICs
into one logical interface. Provides redundancy (failover) and increased bandwidth
(load balancing).
• VLAN (Virtual Local Area Network) -✓✓ Logically segments a physical
network into separate broadcast domains without additional hardware. Isolates
sensitive systems on shared infrastructure.
• NACL (Network Access Control List) -✓✓ Stateless firewall at the subnet level.
Evaluates each packet independently against numbered allow/deny rules. In AWS,
protects entire subnets.
• NSG (Network Security Group) -✓✓ Stateful firewall at the resource/instance
level. Tracks connection state — return traffic automatically permitted. Common
in Azure.
• Hub and Spoke Network -✓✓ Central hub (transit VPC or service provider)
connects to multiple spoke networks. Traffic flows through hub for centralized
security inspection.
• Defense in Depth -✓✓ Multiple layers of security controls so if one fails, others
still protect. No single point of failure in security posture.
, • Air Gap -✓✓ Complete physical/logical isolation from other networks. Highest
security for classified or critical systems.
• Egress Monitoring -✓✓ Monitors outbound traffic for data exfiltration, C2
(Command and Control) beaconing, and policy violations.
• Authentication vs Authorization -✓✓ Authentication = proving who you are.
Authorization = what you are allowed to do. These are separate and sequential
steps.
• MFA (Multi-Factor Authentication) -✓✓ Requires two or more factors:
something you know (password), something you have (token), something you are
(biometric).
• SAML (Security Assertion Markup Language) -✓✓ XML-based standard for
exchanging authentication and authorization data between an IdP (Identity
Provider) and SP (Service Provider). Common for enterprise SSO.
• OAuth 2.0 -✓✓ Authorization framework allowing third-party apps to access
resources on behalf of a user without exposing credentials. Issues access tokens.
• OpenID Connect (OIDC) -✓✓ Identity layer built on OAuth 2.0. Adds
authentication (who you are) to OAuth's authorization (what you can access).
• Federation (Identity) -✓✓ Linking identity systems across organizations so users
authenticate once and access resources in multiple domains (cross-org SSO).
