WGU Managing Cloud Security (JY02) Exam Questions

Answer : C

A bastion host is a hardened system placed at the boundary between different security zones. It acts as a gateway, controlling access from a less secure network (such as the internet or a lower-trust zone) into a higher-security zone (such as an internal cloud environment).

Secure Shell (SSH) provides secure communication but does not create a boundary. Virtual clients and host isolation are endpoint measures, not boundary defenses.

By placing a bastion host at the perimeter, organizations centralize monitoring, apply strict access controls, and reduce attack surfaces. These hosts are typically stripped down to essential services, patched frequently, and monitored closely. In cloud environments, bastion hosts are essential for controlling administrative access while enforcing strong authentication and logging.

Answer : B

In Agile development, user stories are the standard way to capture requirements for new features or improvements. A user story describes the functionality from the perspective of the end user, ensuring that development aligns with business needs.

''Cases'' might refer to test cases, which validate requirements, but they are not used to describe them. Cookies are technical elements for web sessions, and notes are informal documentation.

User stories typically follow a format such as: ''As a [role], I want [goal] so that [benefit].'' This provides clarity, fosters communication between developers and stakeholders, and ensures that acceptance criteria can be defined and tested. Using stories as a requirement tool aligns with iterative, customer-focused release cycles.

Answer : B

The categories mentioned---relational, nonrelational, key-value, and document-oriented---refer to different types of databases. Relational databases (SQL) organize data into tables with rows and columns, nonrelational databases (NoSQL) provide flexibility for unstructured data, key-value stores map identifiers to values, and document-oriented databases manage data in formats such as JSON or BSON.

Object-based storage and volumes are alternative storage architectures but are not described by these categories. XML is a data format, not a storage type.

In the cloud, database services are offered as managed solutions, reducing the administrative burden on organizations. Properly managing database storage is critical for data governance, confidentiality, and compliance. Databases are also central to security strategies, where access control, encryption, and auditing are applied.

Thus, the correct answer is database storage, which encompasses multiple architectures that address different performance, scalability, and data management needs.

Answer : D

Outside the United States, ISAE 3402 (International Standard on Assurance Engagements 3402) is the standard used for audits equivalent to SOC reports. It ensures that service organizations demonstrate adequate internal controls over financial reporting and operational processes.

SSAE 18 is the U.S. standard governing SOC audits. ISRE 2400 and SSARS 25 focus on accounting and review services, not assurance over service organizations.

ISAE 3402 provides assurance to international customers that cloud providers or service organizations meet rigorous standards for security, availability, processing integrity, confidentiality, and privacy. This builds global trust and interoperability in compliance frameworks.

Answer : C

The correct approach for sanitizing a USB thumb drive while preserving its usability is overwriting. Overwriting involves replacing the existing data on the device with random data or specific patterns to ensure that the original information cannot be recovered. This process leaves the physical device intact, allowing it to be reused securely.

Physical destruction, such as shredding, renders the device unusable. Degaussing only works on magnetic media like hard disks or tapes, not on solid-state or flash-based USB drives. Key revocation applies to cryptographic keys and not to physical devices.

By using overwriting, organizations comply with data sanitization standards while balancing operational efficiency. Many tools exist that perform multi-pass overwrites to meet regulatory requirements such as those from NIST or ISO. This ensures that sensitive data is removed while allowing the device to remain in circulation for continued use.

Answer : C

The STRIDE threat model identifies six categories: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. In this scenario, the accountant modified data they were not authorized to change. This is an act of Tampering, which refers to unauthorized alteration of data or systems.

Spoofing would involve impersonating another identity, denial of service would block availability, and elevation of privilege would involve gaining higher access rights. The accountant already had legitimate access but misused it to alter data outside their scope of responsibility.

Tampering compromises data integrity, one of the pillars of the CIA triad. In cloud and enterprise systems, safeguards against tampering include role-based access control, least privilege, and auditing to detect unauthorized changes. Recognizing this as tampering helps in identifying insider misuse and implementing compensating controls.

Answer : D

Without a clear understanding of infrastructure and software, the leadership team must first conduct an inventory of assets. An asset inventory provides a comprehensive list of hardware, software, and services that support business operations.

Creating checklists, defining criteria, and assigning roles are important, but they rely on knowing what assets exist. Without an inventory, the disaster recovery plan would miss critical dependencies, making recovery incomplete or impossible.

Performing an inventory supports business impact analysis, risk assessments, and recovery prioritization. It ensures that all critical systems are accounted for and appropriate recovery strategies can be designed. Asset inventories are a foundational best practice for disaster recovery and continuity planning.