WGU D338 | CLOUD PLATFORM SOLUTIONS | 2026–2027
WGU D338 Cloud Platform
Solutions
Comprehensive Study Guide | 2026–2027 | 116 Original Practice Questions
High-Yield Review
Identity and governance: Entra ID handles identities; Azure RBAC authorizes resource actions; Policy
enforces configuration rules; management groups organize subscriptions.
Networking: Choose NSGs for subnet/NIC filtering, VPN Gateway for encrypted internet tunnels,
ExpressRoute for private provider connectivity, and Private Endpoints for private PaaS access.
Compute: VMs provide OS control; App Service hosts web applications; Functions handles events; AKS
orchestrates Kubernetes; scale sets support autoscaling.
Storage: Select Blob, Files, or Managed Disks by access model; understand LRS/ZRS/GZRS, tiers, SAS,
versioning, and soft delete.
Resilience and monitoring: RPO is tolerated data loss; RTO is recovery time; Azure Backup handles
restore points, Site Recovery supports failover, and Azure Monitor collects telemetry.
Independent educational practice material • Page 1
,WGU D338 | CLOUD PLATFORM SOLUTIONS | 2026–2027
116 Practice Questions with Rationales
Question 1. [Identity] A company needs single sign-on for its Azure workforce applications. Which
Azure solution or concept is the best fit?
A. Azure Files
B. Microsoft Entra ID
C. Azure DNS
D. Azure Monitor
Correct Answer: B. Microsoft Entra ID
Detailed Rationale: Entra ID provides cloud identity and authentication for workforce applications.
Why the Other Options Are Incorrect: A — Azure Files addresses a different capability and does not
directly satisfy this requirement. C — Azure DNS addresses a different capability and does not
directly satisfy this requirement. D — Azure Monitor addresses a different capability and does not
directly satisfy this requirement.
Question 2. [Identity] During a design review, an architect must address this requirement: a
company needs single sign-on for its Azure workforce applications. What should the
implementation plan specify?
A. Azure Monitor
B. Azure Files
C. Microsoft Entra ID
D. Azure DNS
Correct Answer: C. Microsoft Entra ID
Detailed Rationale: Entra ID provides cloud identity and authentication for workforce applications.
Why the Other Options Are Incorrect: A — Azure Monitor addresses a different capability and does
not directly satisfy this requirement. B — Azure Files addresses a different capability and does not
Independent educational practice material • Page 2
,WGU D338 | CLOUD PLATFORM SOLUTIONS | 2026–2027
directly satisfy this requirement. D — Azure DNS addresses a different capability and does not
directly satisfy this requirement.
Question 3. [Identity] Administrators must authenticate with an additional factor before privileged
sign-in. Which Azure solution or concept is the best fit?
A. Azure Policy
B. Storage lifecycle management
C. Azure Bastion
D. Microsoft Entra multifactor authentication
Correct Answer: D. Microsoft Entra multifactor authentication
Detailed Rationale: MFA adds an independent verification factor to strengthen sign-in.
Why the Other Options Are Incorrect: A — Azure Policy addresses a different capability and does
not directly satisfy this requirement. B — Storage lifecycle management addresses a different
capability and does not directly satisfy this requirement. C — Azure Bastion addresses a different
capability and does not directly satisfy this requirement.
Question 4. [Identity] During a design review, an architect must address this requirement:
administrators must authenticate with an additional factor before privileged sign-in. What should
the implementation plan specify?
A. Microsoft Entra multifactor authentication
B. Azure Policy
C. Storage lifecycle management
D. Azure Bastion
Correct Answer: A. Microsoft Entra multifactor authentication
Detailed Rationale: MFA adds an independent verification factor to strengthen sign-in.
Why the Other Options Are Incorrect: B — Azure Policy addresses a different capability and does
not directly satisfy this requirement. C — Storage lifecycle management addresses a different
capability and does not directly satisfy this requirement. D — Azure Bastion addresses a different
capability and does not directly satisfy this requirement.
Independent educational practice material • Page 3
, WGU D338 | CLOUD PLATFORM SOLUTIONS | 2026–2027
Question 5. [Identity] Access should require a compliant device and block risky locations. Which
Azure solution or concept is the best fit?
A. Azure Cost Management
B. Conditional Access
C. Azure Backup
D. NSG
Correct Answer: B. Conditional Access
Detailed Rationale: Conditional Access evaluates identity and contextual signals when enforcing
access policies.
Why the Other Options Are Incorrect: A — Azure Cost Management addresses a different capability
and does not directly satisfy this requirement. C — Azure Backup addresses a different capability
and does not directly satisfy this requirement. D — NSG addresses a different capability and does
not directly satisfy this requirement.
Question 6. [Identity] During a design review, an architect must address this requirement: access
should require a compliant device and block risky locations. What should the implementation plan
specify?
A. NSG
B. Azure Cost Management
C. Conditional Access
D. Azure Backup
Correct Answer: C. Conditional Access
Detailed Rationale: Conditional Access evaluates identity and contextual signals when enforcing
access policies.
Why the Other Options Are Incorrect: A — NSG addresses a different capability and does not
directly satisfy this requirement. B — Azure Cost Management addresses a different capability and
does not directly satisfy this requirement. D — Azure Backup addresses a different capability and
does not directly satisfy this requirement.
Question 7. [Identity] An operator needs permission to restart one VM but not administer its
network. Which Azure solution or concept is the best fit?
Independent educational practice material • Page 4
WGU D338 Cloud Platform
Solutions
Comprehensive Study Guide | 2026–2027 | 116 Original Practice Questions
High-Yield Review
Identity and governance: Entra ID handles identities; Azure RBAC authorizes resource actions; Policy
enforces configuration rules; management groups organize subscriptions.
Networking: Choose NSGs for subnet/NIC filtering, VPN Gateway for encrypted internet tunnels,
ExpressRoute for private provider connectivity, and Private Endpoints for private PaaS access.
Compute: VMs provide OS control; App Service hosts web applications; Functions handles events; AKS
orchestrates Kubernetes; scale sets support autoscaling.
Storage: Select Blob, Files, or Managed Disks by access model; understand LRS/ZRS/GZRS, tiers, SAS,
versioning, and soft delete.
Resilience and monitoring: RPO is tolerated data loss; RTO is recovery time; Azure Backup handles
restore points, Site Recovery supports failover, and Azure Monitor collects telemetry.
Independent educational practice material • Page 1
,WGU D338 | CLOUD PLATFORM SOLUTIONS | 2026–2027
116 Practice Questions with Rationales
Question 1. [Identity] A company needs single sign-on for its Azure workforce applications. Which
Azure solution or concept is the best fit?
A. Azure Files
B. Microsoft Entra ID
C. Azure DNS
D. Azure Monitor
Correct Answer: B. Microsoft Entra ID
Detailed Rationale: Entra ID provides cloud identity and authentication for workforce applications.
Why the Other Options Are Incorrect: A — Azure Files addresses a different capability and does not
directly satisfy this requirement. C — Azure DNS addresses a different capability and does not
directly satisfy this requirement. D — Azure Monitor addresses a different capability and does not
directly satisfy this requirement.
Question 2. [Identity] During a design review, an architect must address this requirement: a
company needs single sign-on for its Azure workforce applications. What should the
implementation plan specify?
A. Azure Monitor
B. Azure Files
C. Microsoft Entra ID
D. Azure DNS
Correct Answer: C. Microsoft Entra ID
Detailed Rationale: Entra ID provides cloud identity and authentication for workforce applications.
Why the Other Options Are Incorrect: A — Azure Monitor addresses a different capability and does
not directly satisfy this requirement. B — Azure Files addresses a different capability and does not
Independent educational practice material • Page 2
,WGU D338 | CLOUD PLATFORM SOLUTIONS | 2026–2027
directly satisfy this requirement. D — Azure DNS addresses a different capability and does not
directly satisfy this requirement.
Question 3. [Identity] Administrators must authenticate with an additional factor before privileged
sign-in. Which Azure solution or concept is the best fit?
A. Azure Policy
B. Storage lifecycle management
C. Azure Bastion
D. Microsoft Entra multifactor authentication
Correct Answer: D. Microsoft Entra multifactor authentication
Detailed Rationale: MFA adds an independent verification factor to strengthen sign-in.
Why the Other Options Are Incorrect: A — Azure Policy addresses a different capability and does
not directly satisfy this requirement. B — Storage lifecycle management addresses a different
capability and does not directly satisfy this requirement. C — Azure Bastion addresses a different
capability and does not directly satisfy this requirement.
Question 4. [Identity] During a design review, an architect must address this requirement:
administrators must authenticate with an additional factor before privileged sign-in. What should
the implementation plan specify?
A. Microsoft Entra multifactor authentication
B. Azure Policy
C. Storage lifecycle management
D. Azure Bastion
Correct Answer: A. Microsoft Entra multifactor authentication
Detailed Rationale: MFA adds an independent verification factor to strengthen sign-in.
Why the Other Options Are Incorrect: B — Azure Policy addresses a different capability and does
not directly satisfy this requirement. C — Storage lifecycle management addresses a different
capability and does not directly satisfy this requirement. D — Azure Bastion addresses a different
capability and does not directly satisfy this requirement.
Independent educational practice material • Page 3
, WGU D338 | CLOUD PLATFORM SOLUTIONS | 2026–2027
Question 5. [Identity] Access should require a compliant device and block risky locations. Which
Azure solution or concept is the best fit?
A. Azure Cost Management
B. Conditional Access
C. Azure Backup
D. NSG
Correct Answer: B. Conditional Access
Detailed Rationale: Conditional Access evaluates identity and contextual signals when enforcing
access policies.
Why the Other Options Are Incorrect: A — Azure Cost Management addresses a different capability
and does not directly satisfy this requirement. C — Azure Backup addresses a different capability
and does not directly satisfy this requirement. D — NSG addresses a different capability and does
not directly satisfy this requirement.
Question 6. [Identity] During a design review, an architect must address this requirement: access
should require a compliant device and block risky locations. What should the implementation plan
specify?
A. NSG
B. Azure Cost Management
C. Conditional Access
D. Azure Backup
Correct Answer: C. Conditional Access
Detailed Rationale: Conditional Access evaluates identity and contextual signals when enforcing
access policies.
Why the Other Options Are Incorrect: A — NSG addresses a different capability and does not
directly satisfy this requirement. B — Azure Cost Management addresses a different capability and
does not directly satisfy this requirement. D — Azure Backup addresses a different capability and
does not directly satisfy this requirement.
Question 7. [Identity] An operator needs permission to restart one VM but not administer its
network. Which Azure solution or concept is the best fit?
Independent educational practice material • Page 4
