WGU Managing Cloud Security (D320) Exam Questions

Answer : A

The lack of physical access to cloud infrastructure significantly affects the audit process for cloud customers. Managing Cloud guidance explains that customers do not have direct access to cloud data centers, servers, or networking equipment, which limits their ability to perform traditional on-site audits.

As a result, customers must rely on third-party audit reports, certifications, and attestations provided by the cloud service provider. This changes how evidence is collected and verified during audits and requires auditors to assess assurance reports instead of physical inspections.

Bandwidth constraints, uptime limits, and storage options impact performance and architecture decisions but do not directly affect audit methodology. Therefore, the absence of physical access is the primary audit-related characteristic.

Answer : A

Object storage architecture enhances the opportunity for enforcing data policies such as data loss prevention (DLP). Managing Cloud principles explain that object storage supports extensive metadata tagging, which allows organizations to classify data, apply sensitivity labels, and enforce security policies directly at the storage level.

By leveraging metadata, DLP solutions can identify sensitive information, apply access restrictions, trigger alerts, or prevent unauthorized data movement. Policies can be consistently enforced across large-scale cloud environments without relying on application-level controls. This makes object storage particularly effective for managing unstructured data such as documents, media files, and backups.

The other options do not provide the same level of policy enforcement. Flash storage focuses on performance, databases rely on structured schemas, and ephemeral storage is temporary and unsuitable for persistent policy enforcement. Therefore, object storage is the most effective architecture for enabling strong data governance and DLP controls in cloud environments.

Answer : A

Infrastructure as a Service (IaaS) allows an organization to maximize control over its information. Managing Cloud principles explain that in the IaaS model, customers manage operating systems, applications, data, access controls, and security configurations.

This high level of control enables organizations to implement customized security policies, encryption mechanisms, and compliance controls tailored to their specific requirements. Customers retain direct responsibility for data protection, system hardening, and monitoring.

In contrast, PaaS and SaaS abstract more control to the provider, limiting customization. DaaS focuses on user desktops rather than data governance. Therefore, IaaS provides the greatest control over information assets.

Answer : C

Video surveillance capability is a key security control used as part of a layered physical defense at a cloud hosting site. Managing Cloud principles explain that physical security relies on multiple overlapping controls to deter, detect, and respond to unauthorized physical access.

Video surveillance provides continuous monitoring of data center facilities, including entrances, exits, server rooms, and perimeter boundaries. It acts as both a deterrent and a detection mechanism, enabling real-time observation and post-incident investigation. Surveillance footage supports incident response, forensic analysis, and compliance requirements.

Access control enforcement and multifactor authentication are primarily logical or administrative controls, while background checks are personnel security measures. Although important, they are not physical perimeter controls. Therefore, video surveillance capability is the correct answer.

Answer : C

Platform as a Service (PaaS) is the recommended option for organizations seeking to simplify application development and management. Managing Cloud guidance explains that PaaS provides a complete development environment, including operating systems, runtime environments, middleware, databases, and development tools.

By abstracting infrastructure and platform management, PaaS allows developers to focus exclusively on building, testing, and deploying applications. Tasks such as patching, scaling, load balancing, and environment configuration are handled by the cloud provider, reducing complexity and administrative effort.

DaaS focuses on delivering virtual desktops, IaaS requires customers to manage operating systems and applications, and SaaS provides fully developed applications rather than development platforms. Therefore, PaaS best meets the requirement of simplifying development and management.

Answer : C

Platform as a Service (PaaS) provides application development services in cloud environments. Managing Cloud documentation explains that PaaS delivers development frameworks, programming languages, libraries, databases, and testing tools required to build and deploy applications.

This model eliminates the need to manage infrastructure and operating systems, allowing developers to rapidly create, test, and deploy applications. PaaS also supports scalability and integration with other cloud services.

SaaS delivers completed applications, IaaS provides raw infrastructure, and SECaaS focuses on security services. Therefore, PaaS is the correct model for application development services.

Answer : D

During the create phase of the cloud data life cycle, data is first generated or collected by an organization. At this stage, it is essential to apply security controls before the data is transferred to the cloud environment. The most effective control during this phase is encryption. Encrypting data ensures that the information is transformed into an unreadable format, protecting it from unauthorized access while it is being transmitted and stored in the cloud.

Managing Cloud principles emphasize that security must be applied as early as possible in the data life cycle to minimize exposure and reduce risk. If data is encrypted prior to upload, even if interception or unauthorized access occurs, the data remains protected and unusable without the appropriate decryption keys. This approach also supports data confidentiality requirements and aligns with security best practices for handling sensitive and regulated information.

The other options do not provide adequate protection during the create phase. Storing or archiving data refers to later life cycle stages, while sharing data increases exposure rather than securing it. Therefore, encrypting data before uploading it to the cloud is a critical safeguard that ensures data confidentiality, supports compliance requirements, and strengthens overall cloud security posture.