Free WGU Managing-Cloud-Security Practice Exam with Questions & Answers | Set: 4

A Type 1 hypervisor provides the most secure foundation and smallest attack footprint for virtual servers. Managing Cloud documentation explains that Type 1 hypervisors run directly on the host hardware without an underlying operating system.

By eliminating the host OS layer, Type 1 hypervisors reduce attack surface and improve isolation between virtual machines. This architecture enhances performance, stability, and security, making it the preferred choice for enterprise and cloud environments.

Type 2 hypervisors run on top of a host operating system, increasing complexity and vulnerability exposure. Application isolation and virtualization do not provide the same foundational security. Therefore, a Type 1 hypervisor is the correct choice.

Moving all services to the cloud provides the highest overall cost savings for organizations implementing BCDR. Managing Cloud guidance explains that cloud-based services reduce capital expenditures, eliminate the need for secondary physical data centers, and leverage on-demand scalability.

Cloud platforms offer built-in redundancy, geographic distribution, and automated recovery capabilities that significantly lower the cost of maintaining separate disaster recovery infrastructure. Pay-as-you-go pricing ensures organizations only pay for resources when needed, further reducing operational expenses.

Hot sites and cross-site replication incur ongoing costs, while tape backups offer lower cost but do not support rapid recovery. Therefore, migrating services to the cloud delivers the most comprehensive cost savings.

Risk is the foundational factor upon which a business continuity plan (BCP) should be based. Managing Cloud principles explain that BCP development begins with identifying and analyzing risks that could disrupt critical business operations.

Risk assessment evaluates threats, vulnerabilities, and potential impacts, allowing organizations to prioritize resources and define recovery strategies. By focusing on risk, organizations ensure that continuity planning addresses the most significant threats to operations, data, and services.

Costs, customers, and locations are important considerations but are secondary to risk analysis. Therefore, risks form the correct basis for a business continuity plan.

Patch management is a core process implemented during the hardening of an operating system and its workloads. Managing Cloud principles explain that OS hardening involves reducing vulnerabilities by applying security patches, updates, and fixes to eliminate known weaknesses.

Patch management ensures that operating systems, applications, and dependencies are kept up to date with vendor-released security patches. This process reduces the attack surface and prevents exploitation of known vulnerabilities. Effective patch management includes testing, deployment, verification, and ongoing monitoring.

Change management governs how changes are approved, incident management handles security events, and security management is a broader governance function. Therefore, patch management is the correct process associated with OS hardening.

Key escrow is the management process that involves multiple key holders, where each party has access to a portion of the cryptographic information. Managing Cloud principles explain that key escrow is designed to ensure availability and recoverability of encrypted data while maintaining security controls.

In this model, encryption keys are stored securely with trusted third parties or divided among multiple custodians. No single individual has full access to the complete key, reducing the risk of misuse or compromise. Key escrow is often used to support compliance, lawful access requirements, and business continuity needs, ensuring that encrypted data can be recovered if the primary key holder is unavailable.

The other options do not fit this definition. Recovery refers to restoring keys or data, revocation disables compromised keys, and distribution focuses on delivering keys to authorized systems. Therefore, escrow is the correct answer.

The software agent management plane must support auto-scaling and elasticity because traditional security tools are not designed for the speed and scale of cloud environments. Managing Cloud guidance explains that cloud workloads can be created, scaled, and terminated rapidly, often within minutes or seconds.

If security management systems cannot scale at the same pace, workloads may operate without protection or monitoring. Elastic security management ensures that agents are deployed, configured, and decommissioned automatically as workloads scale up or down.

The other options do not directly explain the need for elasticity. Network isolation, reduced services, and firewall port usage are not the primary drivers. Therefore, the need to match cloud velocity makes option C correct.

The phase of software design that integrates individual code components and verifies their interoperability is Testing, specifically integration testing. After developers write and unit-test individual modules, those modules must be combined into a complete system. The testing phase ensures that these modules communicate properly, data flows correctly, and overall functionality meets requirements.

Planning establishes project goals, coding builds individual components, and training prepares users. None of these directly verify interoperability. Testing is critical because even well-functioning components may fail when combined, due to interface mismatches, unexpected data structures, or dependency issues.

Cloud-based systems often integrate microservices, APIs, and third-party services. Testing validates that these distributed components interact seamlessly. Proper testing reduces defects, supports reliability, and ensures a consistent end-user experience. It also aligns with DevOps practices, where continuous integration and automated testing pipelines quickly identify and remediate interoperability issues.

Outside the United States, ISAE 3402 (International Standard on Assurance Engagements 3402) is the standard used for audits equivalent to SOC reports. It ensures that service organizations demonstrate adequate internal controls over financial reporting and operational processes.

SSAE 18 is the U.S. standard governing SOC audits. ISRE 2400 and SSARS 25 focus on accounting and review services, not assurance over service organizations.

ISAE 3402 provides assurance to international customers that cloud providers or service organizations meet rigorous standards for security, availability, processing integrity, confidentiality, and privacy. This builds global trust and interoperability in compliance frameworks.

A compensating control should be implemented to address the loss of physical control when moving data to the cloud. Managing Cloud guidance explains that compensating controls are alternative safeguards used when direct controls are not feasible.

Since customers cannot physically secure cloud data centers, compensating controls such as strong encryption, key management, access controls, and monitoring are used to mitigate the risk. These controls provide equivalent or greater protection despite the lack of physical access.

The other options are not recognized control types in cloud security governance. Therefore, compensating control is the correct answer.

The Assurance section of a contract specifies the customer’s rights to verify that the vendor is meeting contractual and compliance obligations. This often includes the right to audit, request independent certifications, or require compliance reports such as SOC 2 or ISO 27001.

Indemnification deals with liability coverage, termination outlines exit conditions, and litigation describes dispute resolution mechanisms. None of these provide the customer with ongoing oversight rights.

Audit rights are critical in cloud contracts to maintain transparency, enforce accountability, and verify that shared responsibility is being upheld. Assurance provisions give customers confidence in the provider’s security and operational practices, ensuring compliance with industry regulations.