Free WGU Managing-Cloud-Security Practice Exam with Questions & Answers

TheCLOUD Actaddresses conflicts that arise when law enforcement in one jurisdiction seeks access to data stored in another country. It clarifies how U.S. authorities can compel cloud providers to produce data, even if stored overseas, and establishes a framework for resolving jurisdictional conflicts through bilateral agreements.

The Act does not regulate genetic data, breach notifications, or employer surveillance. Its central purpose is to handle the challenge of cross-border data access in the era of globalized cloud computing.

For organizations, this means carefully evaluating how and where data is stored, and ensuring contracts and compliance strategies account for potential conflicts between U.S. law and foreign privacy regulations like GDPR. Awareness of CLOUD Act obligations is crucial in multinational cloud deployments.

WithSaaS, applications are delivered entirely by the provider, and customers have little to no control over the underlying platform or data portability. This creates a higher risk ofvendor lock-in, as migrating away from one SaaS provider to another may require reworking applications or losing features.

In contrast,PaaSgives customers more flexibility by allowing them to build, deploy, and manage their own applications while relying on standardized frameworks and platforms. Because applications are customer-managed, switching providers or migrating workloads can be easier compared to SaaS.

Vendor lock-out, personnel threats, and natural disasters are risks in any service model. The key differentiator here is portability and flexibility. Choosing PaaS reduces dependence on a single provider’s application features, thereby lowering vendor lock-in risk while still offloading infrastructure management.

To provide a comprehensive report of system usage, the most important elements are user identifications (IDs) and access timestamps. These data points record who accessed the system, at what time, and for how long. Together, they allow the analyst to determine frequency and duration of use, which is essential for both operational auditing and security oversight.

Other options, such as informational logs or error logs, may provide context but do not directly answer the requirement of identifying users and usage patterns. For instance, 802.1x logs are related to network authentication, while commands or error timestamps reveal activity details but not the overall access history.

Collecting and analyzing IDs and timestamps supports compliance with regulatory frameworks like ISO 27001 and SOC 2, which require clear audit trails. It also provides accountability and supports investigations in case of unauthorized access or misuse. By including these elements, the analyst ensures the report meets internal and external requirements for system monitoring.

In a cloud environment, responsibility forhardware managementshifts primarily to the cloud provider. Customers no longer manage servers, storage devices, or physical networks directly. As a result, hardware management policies are less critical for customer audits compared to data classification, procurement, or acceptable use.

Data classification remains essential to secure sensitive information. Software procurement policies are important to control licensing and compliance. Acceptable use policies govern employee behavior in cloud environments.

While organizations may still need high-level oversight of hardware through contracts and SLAs, detailed hardware policies have a reduced role. Instead, emphasis shifts to managing the shared responsibility model, ensuring cloud provider controls complement customer governance.

Backups are only valuable if they can be successfully restored when needed. Testing backups on a periodic basis is the only reliable way to validate their viability. Simply storing backups without testing may create a false sense of security, because corruption, misconfiguration, or incomplete backup sets can go unnoticed until a disaster occurs.

Industry best practices, such as those recommended by NIST and ISO 27031, emphasize regular backup testing as part of disaster recovery and business continuity planning. Testing involves restoring data to a test environment, verifying its integrity, and ensuring that applications can use the restored data as expected.

Deleting, comparing, or replacing backups might help in managing storage efficiency, but these actions do not confirm whether the backups are usable. Periodic testing ensures alignment with company policy, regulatory requirements, and internal risk management controls. It also provides confidence to management that recovery objectives, such as RTO (Recovery Time Objective) and RPO (Recovery Point Objective), can be met.

Bollardsare physical barriers designed to prevent vehicles from ramming into or breaching secure facilities. They are often placed at entrances, around perimeters, or in front of critical infrastructure like data centers.

Locks, cameras, and fences provide important physical security, but they cannot stop a high-speed vehicle from causing damage. Cameras record activity, fences create boundaries, and locks secure access points, but only bollards physically block or mitigate vehicle attacks.

Governmental and critical infrastructure sites commonly deploy bollards to protect against both accidental collisions and deliberate vehicle-borne attacks. Combined with layered security measures—such as surveillance and fencing—they enhance resilience against physical threats to sensitive data centers.

Cloudsecurity groupstypically filter traffic based onports and protocols. By allowing or denying specific port/protocol combinations, engineers can control communication between deployments. For example, permitting HTTPS (TCP port 443) while blocking other ports enforces segmentation.

MAC addresses are not used in cloud-level segmentation because they apply to physical networks. Unique identifiers and definitions are not practical mechanisms for traffic filtering.

Using ports and protocols aligns with the principle of least privilege by ensuring that only necessary communication pathways exist. In multi-deployment or hybrid cloud setups, this reduces the attack surface and prevents lateral movement by malicious actors. Security groups thereby provide logical network segmentation without requiring physical infrastructure changes.

Without a clear understanding of infrastructure and software, the leadership team must first conduct aninventory of assets. An asset inventory provides a comprehensive list of hardware, software, and services that support business operations.

Creating checklists, defining criteria, and assigning roles are important, but they rely on knowing what assets exist. Without an inventory, the disaster recovery plan would miss critical dependencies, making recovery incomplete or impossible.

Performing an inventory supports business impact analysis, risk assessments, and recovery prioritization. It ensures that all critical systems are accounted for and appropriate recovery strategies can be designed. Asset inventories are a foundational best practice for disaster recovery and continuity planning.

TheAssurancesection of a contract specifies the customer’s rights to verify that the vendor is meeting contractual and compliance obligations. This often includes the right to audit, request independent certifications, or require compliance reports such as SOC 2 or ISO 27001.

Indemnification deals with liability coverage, termination outlines exit conditions, and litigation describes dispute resolution mechanisms. None of these provide the customer with ongoing oversight rights.

Audit rights are critical in cloud contracts to maintain transparency, enforce accountability, and verify that shared responsibility is being upheld. Assurance provisions give customers confidence in the provider’s security and operational practices, ensuring compliance with industry regulations.

Once a vendor has been chosen, the onboarding phase requires confirmingcontractual details and arranging technical agreements. This includes specifying encryption standards, data transfer methods, SLAs, and compliance responsibilities. These discussions establish a clear foundation for the partnership.

Auditing and monitoring occur later, during ongoing vendor management. Evaluating requirements and policies occurs earlier, during vendor selection. Terminating a relationship is an offboarding activity, not onboarding.

Clarifying technical and contractual details at onboarding ensures a secure, compliant, and efficient partnership. It reduces risks of miscommunication and enforces accountability from the beginning.