WGU Managing Cloud Security (JY02) WGU (JY02) Managing Cloud Security Exam Practice Test

Answer : D

Federal agencies in the U.S. rely on NIST SP 800-37, Risk Management Framework (RMF), to manage enterprise risk. RMF provides a structured process for categorizing systems, selecting controls, implementing safeguards, assessing effectiveness, authorizing operations, and continuous monitoring.

ISO 37500 deals with outsourcing governance, SSAE 18 governs service provider audits, and COSO is a corporate governance framework but not specific to federal agencies.

NIST RMF is integrated with the Federal Information Security Modernization Act (FISMA) requirements, ensuring agencies manage cybersecurity risks consistently. Its adoption is expanding beyond government into industries seeking comprehensive, repeatable risk management processes.

Answer : C

The capability to rapidly create and destroy virtual systems as demand fluctuates is known as ephemeral computing. These short-lived resources are provisioned automatically when needed and decommissioned when demand subsides.

Resource scheduling helps allocate resources but does not imply temporary lifespans. High availability ensures continuous service, and maintenance mode is used for administrative tasks.

Ephemeral computing is central to elasticity in cloud environments, reducing costs and improving scalability. For example, containers or serverless functions may run only while needed and then disappear. This model optimizes utilization, lowers expenses, and supports modern application architectures that demand agility.

Answer : C

The engineers are concerned about portability. Vendor-specific APIs and tools create a dependency on a single provider, leading to vendor lock-in. This limits the ability to migrate services or workloads to another provider without significant rework.

Reliability and availability refer to service uptime and continuity, while scalability addresses performance under demand. Although important, none of these directly relate to cross-platform flexibility. Portability ensures that services, data, and applications can be easily moved or integrated across environments.

By adopting portable solutions---such as open standards, containerization, and multi-cloud strategies---organizations reduce long-term risks, increase negotiation power with providers, and enhance resilience.

Answer : D

The cloud data life cycle defines distinct stages that data goes through from its origin until its disposal. The Create phase is the very first stage, and this is where data is generated or captured by systems, applications, or users. At this point, data does not yet have context for storage or use, so it must be appropriately categorized and classified. Activities like labeling, marking, tagging, and assigning metadata are critical because they establish the foundation for enforcing controls throughout the rest of the life cycle.

Classification ensures that data is aligned with sensitivity levels, regulatory requirements, and business value. For example, financial records may be labeled ''confidential'' while general marketing content may be marked ''public.'' These distinctions guide how encryption, access controls, and monitoring will be applied in subsequent phases such as storage, sharing, or use.

According to industry frameworks, starting security at the Create phase ensures that controls ''follow the data'' across environments. Without proper classification at creation, organizations risk mismanaging sensitive data downstream.

Answer : B

Procedures are detailed, step-by-step instructions that guide personnel on how to perform specific tasks in alignment with higher-level policies. In an investigation, when uncertainty arises about handling a dataset, procedures provide the exact operational guidance required.

Policies establish high-level rules (e.g., ''financial data must be protected''), while procedures explain how to achieve compliance with those policies (e.g., ''verify encryption, label dataset, log access, and escalate to compliance officer''). Legal rulings and definitions are external references but do not provide operational steps.

By following documented procedures, investigators ensure consistency, compliance, and defensibility in legal contexts. This also ensures that evidence is handled properly, supporting admissibility in court and protecting the organization against legal or regulatory challenges.

Answer : B

In cloud environments, the provider's role in the chain of custody primarily involves collecting and preserving digital evidence when incidents or investigations occur. Because providers manage the infrastructure, they have direct access to logs, storage systems, and virtual machines necessary for evidence collection.

Backup policies and incident response may involve collaboration, but they remain customer responsibilities in many service models. Data classification and analysis are business-driven tasks, which customers must handle.

Providers must ensure that evidence collection is forensically sound and documented properly to maintain legal admissibility. This responsibility is critical in maintaining trust and ensuring compliance with laws and contractual obligations. It reinforces the shared responsibility model by clearly defining which aspects of digital forensics belong to the provider.

Answer : C

The unplanned event described is a disruption of service. In IT service management frameworks like ITIL, disruptions occur when an incident prevents normal service delivery. The goal of incident management is to restore service quickly and minimize impact on customers.

A bug refers to a software defect, which may cause disruptions but is not synonymous with the event itself. An error represents a fault, while change refers to deliberate modifications. Only disruption captures the unplanned nature of service unavailability.

Recognizing incidents as disruptions helps organizations apply structured processes such as escalation, root-cause analysis, and communication. It ensures resilience in cloud-based environments where uptime is a key performance indicator and customer trust is closely tied to availability.