Managing-Cloud-Security Exam Dumps - WGU Courses and Certificates Questions and Answers

Agile is an iterative software development methodology designed to prioritize customer satisfaction, adaptability, and incremental delivery. Agile teams deliver small, working pieces of software frequently, ensuring feedback is incorporated throughout the process. This flexibility allows late-stage requirement changes to be accommodated without derailing the project.

Waterfall is a sequential approach with limited flexibility. Spiral combines iterative development with risk analysis, but it is not as customer-focused as Agile. Lean emphasizes efficiency and waste reduction but does not center on continuous delivery and adaptability.

Agile frameworks such as Scrum and Kanban embody this philosophy, supporting faster innovation, better collaboration, and responsiveness to evolving business needs.

The STRIDE threat model identifies six categories: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. In this scenario, the accountant modified data they were not authorized to change. This is an act of Tampering, which refers to unauthorized alteration of data or systems.

Spoofing would involve impersonating another identity, denial of service would block availability, and elevation of privilege would involve gaining higher access rights. The accountant already had legitimate access but misused it to alter data outside their scope of responsibility.

Tampering compromises data integrity, one of the pillars of the CIA triad. In cloud and enterprise systems, safeguards against tampering include role-based access control, least privilege, and auditing to detect unauthorized changes. Recognizing this as tampering helps in identifying insider misuse and implementing compensating controls.

Lightweight Directory Access Protocol (LDAP) provides common directory services. Managing Cloud principles explain that LDAP is used to store and retrieve information about users, groups, roles, and permissions in a centralized directory.

LDAP supports authentication, authorization, and identity management by enabling systems to query user attributes and access rights. It is widely used in enterprise and cloud environments to integrate applications with centralized identity services.

RADIUS and TACACS+ are authentication protocols, and DNS resolves domain names to IP addresses. Therefore, LDAP is the correct entity for directory services.

In a Software as a Service (SaaS) environment, the cloud service provider (CSP) is responsible for securing the platform. Managing Cloud principles explain that SaaS places the majority of security responsibilities on the provider, including infrastructure, operating systems, middleware, and application security.

Customers primarily manage user access, data usage, and configuration settings, while the provider ensures availability, patching, vulnerability management, and platform protection. This division of responsibility simplifies security management for consumers.

The other options misrepresent shared responsibility boundaries. In IaaS, customers secure the platform, and in PaaS, providers manage infrastructure. Therefore, option D accurately characterizes application movement to the cloud.

Dedicated memory allocation ensures isolation between virtual machines in a shared environment. Without memory isolation, remnants of one VM’s operations might remain in physical memory and be accessible to another VM, leading to cross-tenant data leakage. Assigning dedicated memory prevents attackers from exploiting memory-sharing vulnerabilities.

Encrypted network protocols protect data in transit, not memory. Encrypted file systems safeguard storage, not volatile memory. A dedicated processor helps with performance and isolation of compute tasks but does not secure temporary memory contents.

Cloud environments are multi-tenant, which makes memory isolation a critical safeguard. By dedicating memory or enforcing strict hypervisor-level isolation, providers prevent data exposure between customers. This aligns with best practices for virtualization security and the “resource pooling” characteristic of cloud computing, ensuring that shared infrastructure does not compromise confidentiality.

When a required PCI DSS control cannot be implemented due to technical limitations, the organization must apply a compensating control. A compensating control is an alternative safeguard that meets the intent and rigor of the original requirement.

Risk acceptance is insufficient under PCI DSS, as compliance demands enforceable safeguards. Privacy controls and protection levels may enhance data security but do not formally replace mandatory encryption requirements.

For example, a provider may use strict access controls, network segmentation, or monitoring to mitigate risks from unencrypted cardholder data. Documenting these compensating controls is essential during audits, ensuring compliance despite system limitations.

When sharing personal data with a trusted third party, organizations must ensure that the recipient understands and adheres to the organization’s privacy policy and handling practices. This ensures consistent treatment of personal information across entities and aligns with consent provided by individuals.

Audit results and contractual notices are internal matters, while federal laws define obligations but do not substitute for organizational policies. By explicitly sharing policies and practices, organizations reinforce accountability and ensure compliance with privacy regulations such as GDPR, HIPAA, or CCPA.

This communication sets expectations for data use, retention, and disclosure. It also provides a defensible framework in case of regulatory inquiries, showing that due diligence was performed when transferring data to third parties.

The Private cloud model provides the greatest retention of governance controls for large organizations with legacy systems. Managing Cloud guidance explains that private clouds are dedicated environments operated solely for one organization, either on-premises or hosted by a third party.

This model allows companies to maintain strict control over security policies, compliance requirements, data governance, and system configurations. Legacy systems that require specific architectures, custom integrations, or regulatory oversight can be more easily accommodated in a private cloud environment.

Public clouds offer limited control, community clouds share governance across organizations, and hybrid clouds introduce additional complexity. Therefore, private cloud is the most appropriate model for retaining governance controls with legacy systems.

Under the General Data Protection Regulation (GDPR), an EU citizen must provide specific consent before an organization may process their personal data, unless another lawful basis explicitly applies. Managing Cloud principles explain that consent must be freely given, specific, informed, and unambiguous. This ensures individuals retain control over how their personal information is collected and used.

Consent must clearly state the purpose of processing and cannot be implied or bundled with unrelated terms. Organizations must also be able to demonstrate that consent was obtained and allow individuals to withdraw consent at any time. This requirement strengthens transparency and accountability in data handling practices.

The other options do not satisfy GDPR consent requirements. Legal purpose attestation is an organizational responsibility, data accuracy verification is a data quality obligation, and statements of need do not replace explicit consent. Therefore, specific consent is required before processing personal data.

Threat modeling is the approach that helps developers prepare for common application vulnerabilities in cloud environments. Managing Cloud principles explain that threat modeling is a proactive security activity performed during the design and development phases of an application.

This approach involves identifying potential threats, attack vectors, and weaknesses based on application architecture, data flows, trust boundaries, and usage patterns. By anticipating how attackers may exploit cloud-specific characteristics—such as exposed APIs, shared resources, and identity-based access—developers can design controls to mitigate risks early in the lifecycle.

Sandboxing and application virtualization are isolation techniques rather than preparation methods, and multitenancy describes a cloud architecture characteristic. Threat modeling directly supports secure design by aligning security controls with known vulnerability patterns. Therefore, threat modeling is the correct answer.