WGU D485 DGN2 TASK 1: Cloud Security
Implementation Plan Latest Update with
complete solution
Course
Cloud Security
1. SWBTL LLC is migrating to Microsoft Azure after experiencing high costs, service
interruptions, and cybersecurity concerns. What should be the primary objective of the cloud
security implementation plan?
A. Give all employees administrative access
B. Protect confidentiality, integrity, and availability while meeting business requirements
C. Eliminate all user accounts
D. Move all systems into one shared resource group
Answer: B
Solution: The implementation plan should support the CIA triad—confidentiality, integrity, and
availability—while enabling the organization's operational and compliance requirements.
2. Marketing, Accounting, and IT each require separate cloud resources. Which design best
supports resource isolation?
A. Place all resources in one unrestricted group
B. Use separate Azure resource groups with appropriately scoped access
C. Give every employee Owner permissions
D. Use one shared administrator account
Answer: B
Solution: Separate resource groups combined with properly scoped permissions help isolate
resources and reduce unnecessary cross-department access.
3. An Accounting employee can modify IT resources despite having no business need. What is
the best remediation?
A. Increase the employee's privileges
B. Apply Azure RBAC according to job responsibilities and least privilege
,C. Remove all authentication requirements
D. Create additional shared accounts
Answer: B
Solution: Role-Based Access Control should grant only the permissions required for a user's
assigned responsibilities.
4. What security principle requires users to receive only the minimum access necessary?
A. Separation of duties
B. Least privilege
C. High availability
D. Data redundancy
Answer: B
Solution: Least privilege reduces the attack surface and limits the potential damage from
compromised or misused accounts.
5. Which control provides stronger protection than a password alone?
A. Shared credentials
B. Multifactor authentication
C. Longer usernames
D. Anonymous access
Answer: B
Solution: MFA requires an additional authentication factor, reducing the risk that a stolen
password alone can compromise an account.
6. What is the best approach for privileged administrator accounts?
A. Use the same account for email and administration
B. Provide permanent unrestricted privileges
C. Use separate privileged accounts with tightly controlled access
D. Share one administrator password among the IT team
Answer: C
,Solution: Administrative privileges should be separated from routine user activity and granted
according to least-privilege principles.
7. What is the primary purpose of encryption at rest?
A. Protect data while stored
B. Increase internet speed
C. Replace authentication
D. Eliminate the need for backups
Answer: A
Solution: Encryption at rest protects stored data from unauthorized access if physical storage or
underlying systems are compromised.
8. What is encryption in transit primarily designed to protect?
A. Data moving between systems
B. Data stored on a disconnected hard drive only
C. Employee job descriptions
D. Physical building access
Answer: A
Solution: Encryption in transit helps protect data from interception or unauthorized observation
while it travels across networks.
9. Why is centralized key management preferable to storing encryption keys alongside the
protected data?
A. It makes encryption unnecessary
B. It improves control, protection, rotation, and auditing of cryptographic keys
C. It allows everyone to access the keys
D. It eliminates access controls
Answer: B
Solution: Centralized key management supports stronger lifecycle management, access control,
rotation, and auditing.
, 10. A cloud administrator discovers several inactive accounts still have access to sensitive
resources. What should be implemented?
A. Permanent account access
B. Identity lifecycle management and periodic access reviews
C. Additional shared accounts
D. Removal of audit logs
Answer: B
Solution: Access should be reviewed regularly, and accounts should be disabled or removed
when users no longer require access.
11. What is the primary benefit of network segmentation?
A. It allows unrestricted communication between all systems
B. It limits unnecessary communication and can reduce lateral movement
C. It eliminates the need for authentication
D. It makes all resources public
Answer: B
Solution: Segmentation divides resources into logical boundaries and restricts traffic to what is
necessary.
12. Which architecture is most appropriate for a database containing sensitive information?
A. Public internet access with no restrictions
B. Placement in a protected network segment with restricted access
C. Anonymous access
D. One shared network with every department
Answer: B
Solution: Sensitive databases should be protected using restricted network access, identity
controls, encryption, and monitoring.
13. What is the primary purpose of a network security group or similar firewall control?
A. Control permitted network traffic
B. Encrypt every file automatically
Implementation Plan Latest Update with
complete solution
Course
Cloud Security
1. SWBTL LLC is migrating to Microsoft Azure after experiencing high costs, service
interruptions, and cybersecurity concerns. What should be the primary objective of the cloud
security implementation plan?
A. Give all employees administrative access
B. Protect confidentiality, integrity, and availability while meeting business requirements
C. Eliminate all user accounts
D. Move all systems into one shared resource group
Answer: B
Solution: The implementation plan should support the CIA triad—confidentiality, integrity, and
availability—while enabling the organization's operational and compliance requirements.
2. Marketing, Accounting, and IT each require separate cloud resources. Which design best
supports resource isolation?
A. Place all resources in one unrestricted group
B. Use separate Azure resource groups with appropriately scoped access
C. Give every employee Owner permissions
D. Use one shared administrator account
Answer: B
Solution: Separate resource groups combined with properly scoped permissions help isolate
resources and reduce unnecessary cross-department access.
3. An Accounting employee can modify IT resources despite having no business need. What is
the best remediation?
A. Increase the employee's privileges
B. Apply Azure RBAC according to job responsibilities and least privilege
,C. Remove all authentication requirements
D. Create additional shared accounts
Answer: B
Solution: Role-Based Access Control should grant only the permissions required for a user's
assigned responsibilities.
4. What security principle requires users to receive only the minimum access necessary?
A. Separation of duties
B. Least privilege
C. High availability
D. Data redundancy
Answer: B
Solution: Least privilege reduces the attack surface and limits the potential damage from
compromised or misused accounts.
5. Which control provides stronger protection than a password alone?
A. Shared credentials
B. Multifactor authentication
C. Longer usernames
D. Anonymous access
Answer: B
Solution: MFA requires an additional authentication factor, reducing the risk that a stolen
password alone can compromise an account.
6. What is the best approach for privileged administrator accounts?
A. Use the same account for email and administration
B. Provide permanent unrestricted privileges
C. Use separate privileged accounts with tightly controlled access
D. Share one administrator password among the IT team
Answer: C
,Solution: Administrative privileges should be separated from routine user activity and granted
according to least-privilege principles.
7. What is the primary purpose of encryption at rest?
A. Protect data while stored
B. Increase internet speed
C. Replace authentication
D. Eliminate the need for backups
Answer: A
Solution: Encryption at rest protects stored data from unauthorized access if physical storage or
underlying systems are compromised.
8. What is encryption in transit primarily designed to protect?
A. Data moving between systems
B. Data stored on a disconnected hard drive only
C. Employee job descriptions
D. Physical building access
Answer: A
Solution: Encryption in transit helps protect data from interception or unauthorized observation
while it travels across networks.
9. Why is centralized key management preferable to storing encryption keys alongside the
protected data?
A. It makes encryption unnecessary
B. It improves control, protection, rotation, and auditing of cryptographic keys
C. It allows everyone to access the keys
D. It eliminates access controls
Answer: B
Solution: Centralized key management supports stronger lifecycle management, access control,
rotation, and auditing.
, 10. A cloud administrator discovers several inactive accounts still have access to sensitive
resources. What should be implemented?
A. Permanent account access
B. Identity lifecycle management and periodic access reviews
C. Additional shared accounts
D. Removal of audit logs
Answer: B
Solution: Access should be reviewed regularly, and accounts should be disabled or removed
when users no longer require access.
11. What is the primary benefit of network segmentation?
A. It allows unrestricted communication between all systems
B. It limits unnecessary communication and can reduce lateral movement
C. It eliminates the need for authentication
D. It makes all resources public
Answer: B
Solution: Segmentation divides resources into logical boundaries and restricts traffic to what is
necessary.
12. Which architecture is most appropriate for a database containing sensitive information?
A. Public internet access with no restrictions
B. Placement in a protected network segment with restricted access
C. Anonymous access
D. One shared network with every department
Answer: B
Solution: Sensitive databases should be protected using restricted network access, identity
controls, encryption, and monitoring.
13. What is the primary purpose of a network security group or similar firewall control?
A. Control permitted network traffic
B. Encrypt every file automatically
