Free Practice Questions for the WGU Courses and Certificates Managing-Cloud-Security Exam (2026 Updated)

The Stored Communications Act (SCA) is a United States jurisdictional data protection law enacted to limit and regulate forced disclosure of electronic communications by internet service providers. Managing Cloud principles describe the SCA as a legal framework that governs how stored electronic communications and customer data may be accessed by government entities.

The act establishes requirements for warrants, subpoenas, and court orders before service providers can disclose stored data. This protection is particularly relevant in cloud environments, where service providers store large volumes of customer data on behalf of organizations.

The other options are incorrect. APP8 and APP11.1 are Australian Privacy Principles, and GDPR applies to the European Union. Therefore, the Stored Communications Act is the correct U.S. jurisdictional protection.

The General Data Protection Regulation (GDPR) applies under the jurisdiction of the European Union . Managing Cloud documentation explains that GDPR governs the collection, processing, storage, and transfer of personal data belonging to individuals within EU member states.

GDPR applies not only to organizations physically located in the European Union but also to organizations outside the EU that process or control EU residents’ personal data. This broad scope makes GDPR one of the most influential data protection regulations affecting cloud services globally.

The regulation mandates strict requirements related to consent, data minimization, breach notification, and data subject rights. Organizations using cloud services must ensure that their providers support GDPR compliance requirements.

The other jurisdictions listed have their own privacy regulations but are not governed by GDPR. Therefore, the correct jurisdiction is the European Union.

Pausing the virtual machine is the correct action to preserve forensic evidence for collection. Managing Cloud guidance explains that pausing a VM maintains its current memory and disk state, preventing changes that could alter or destroy evidence.

This approach allows investigators to capture volatile data, analyze system state, and perform forensic imaging without introducing new activity. Preserving the environment is critical for maintaining chain of custody and ensuring the integrity of evidence.

The other options do not preserve evidence. Serverless architectures reduce server management, threat modeling is a design activity, and mutable servers increase configuration changes. Therefore, pausing the virtual machine is the correct answer.

The Destroy phase of the cloud data life cycle is where information is permanently removed from systems. A common technique in cloud environments for this phase is crypto-shredding (or cryptographic erasure). Rather than physically destroying the media, crypto-shredding involves deleting or revoking encryption keys used to protect the data. Once those keys are destroyed, the encrypted data becomes mathematically unrecoverable, even if the underlying storage media remains intact.

This method is particularly useful in cloud environments where storage is virtualized and hardware cannot easily be physically destroyed. Crypto-shredding provides compliance-friendly assurance that sensitive data such as personally identifiable information (PII), financial data, or healthcare records cannot be accessed after retention periods expire or contractual obligations end.

By incorporating crypto-shredding into the Destroy phase, organizations align with standards for secure data sanitization. This ensures legal defensibility during audits and e-discovery and demonstrates proper lifecycle governance. The emphasis is on making data inaccessible while still maintaining operational efficiency and environmental responsibility.

The phase of software design that integrates individual code components and verifies their interoperability is Testing , specifically integration testing. After developers write and unit-test individual modules, those modules must be combined into a complete system. The testing phase ensures that these modules communicate properly, data flows correctly, and overall functionality meets requirements.

Planning establishes project goals, coding builds individual components, and training prepares users. None of these directly verify interoperability. Testing is critical because even well-functioning components may fail when combined, due to interface mismatches, unexpected data structures, or dependency issues.

Cloud-based systems often integrate microservices, APIs, and third-party services. Testing validates that these distributed components interact seamlessly. Proper testing reduces defects, supports reliability, and ensures a consistent end-user experience. It also aligns with DevOps practices, where continuous integration and automated testing pipelines quickly identify and remediate interoperability issues.

Threat modeling is performed during the Design phase of secure application development. Managing Cloud guidance explains that threat modeling evaluates application architecture, data flows, trust boundaries, and attack surfaces before development begins.

By identifying threats early, security controls can be built directly into the application design rather than added later. This reduces vulnerabilities and lowers remediation costs.

The define phase establishes requirements, training builds skills, and development focuses on coding. Therefore, the design phase is the correct answer.

A cloud-based DDoS protection strategy helps mitigate attacks by rerouting traffic to specialized mitigation services . Managing Cloud guidance explains that cloud providers leverage large-scale, distributed infrastructures capable of absorbing and filtering massive volumes of malicious traffic.

When an attack is detected, traffic is redirected to scrubbing centers or mitigation platforms that analyze and filter malicious packets before forwarding legitimate traffic to the target application. This prevents backend systems from becoming overwhelmed and ensures service availability.

The other options provide limited protection. Load balancing and multiple endpoints distribute traffic but do not filter attacks, and scaling applications may still fail under volumetric attacks. Therefore, rerouting traffic to mitigation services is the most effective strategy.

The Public cloud model is owned and operated by a vendor and offered to customers through sale, lease, or rental arrangements. Managing Cloud principles describe public cloud providers as entities that deliver shared infrastructure, platforms, or applications to multiple customers over the internet.

In this model, the cloud service provider manages the infrastructure, maintenance, and security of the environment, while customers consume services on a pay-as-you-go or subscription basis. Public clouds offer scalability, flexibility, and cost efficiency but provide less control over underlying systems.

Private clouds are dedicated to a single organization, hybrid clouds combine multiple models, and community clouds serve specific groups. Therefore, the public cloud model best fits the description.

The Hybrid key management option typically requires key management infrastructure to remain on-premises while securely delivering cryptographic keys to the cloud through a dedicated and protected connection. Managing Cloud guidance explains that hybrid key management models are designed for organizations that require maximum control over encryption keys while still leveraging cloud-based storage and processing.

In this model, encryption keys are generated, stored, and managed within the organization’s own secure environment, reducing the risk of unauthorized access by external entities. Keys are provided to cloud services only when needed and often through secure channels such as private network connections. This approach supports strict compliance, regulatory, and data sovereignty requirements.

Other options do not meet this requirement. A hardware security appliance may be used on-premises but does not inherently define a hybrid cloud delivery model. Virtual appliances are typically cloud-resident, and cloud provider services manage keys entirely within the provider’s infrastructure. Therefore, the hybrid option best aligns with on-premises key control combined with secure cloud integration.

Risk mitigation reduces the impact of risk within BCDR planning. Managing Cloud principles explain that mitigation involves implementing controls and safeguards to lessen the likelihood or severity of adverse events.

Examples include redundancy, backups, failover mechanisms, and monitoring. These measures do not eliminate risk but significantly reduce operational disruption and data loss when incidents occur.

Insurance transfers financial risk, avoidance eliminates activities, and acceptance acknowledges risk without action. Therefore, mitigation is the correct strategy for reducing impact.

The jurisdiction of the cloud provider and users is a primary consideration when analyzing legal and privacy implications of cloud technologies. Managing Cloud guidance explains that data is subject to the laws and regulations of the jurisdiction in which it is stored, processed, or accessed.

Different countries impose varying legal requirements for data privacy, disclosure, and access by authorities. Understanding jurisdiction helps organizations evaluate compliance obligations, cross-border data transfer restrictions, and potential risks related to government access or conflicting regulations.

While encryption, contract configuration, and service level agreements are important, they do not override jurisdictional legal authority. Therefore, jurisdiction is the most critical factor in legal and privacy analysis.

A Database Activity Monitor (DAM) is specifically designed to identify and stop attack-based commands from executing on a SQL server. Managing Cloud documentation explains that DAM solutions monitor database traffic in real time, inspecting queries and commands for malicious patterns such as SQL injection, privilege escalation, and unauthorized data access attempts.

Unlike traditional firewalls, which primarily filter network traffic, a DAM understands database-specific protocols and SQL command structures. This allows it to detect abnormal or unauthorized queries that may bypass perimeter defenses. When a suspicious command is identified, the DAM can alert administrators, block the execution, or log the activity for forensic analysis.

The other options do not provide this level of database-specific protection. A host-based firewall controls traffic to and from a server but does not analyze SQL commands. A hardware security module focuses on key management and cryptographic operations. A cloud access and security broker enforces security policies between cloud consumers and providers but does not inspect SQL commands directly. Therefore, the database activity monitor is the correct device for stopping attack-based SQL commands.

The engineers are concerned about portability . Vendor-specific APIs and tools create a dependency on a single provider, leading to vendor lock-in. This limits the ability to migrate services or workloads to another provider without significant rework.

Reliability and availability refer to service uptime and continuity, while scalability addresses performance under demand. Although important, none of these directly relate to cross-platform flexibility. Portability ensures that services, data, and applications can be easily moved or integrated across environments.

By adopting portable solutions—such as open standards, containerization, and multi-cloud strategies—organizations reduce long-term risks, increase negotiation power with providers, and enhance resilience.

Cloud providers typically manage multi-tenant infrastructure, where physical hardware is shared among customers. Therefore, drives are not destroyed for each customer unless explicitly required in the contract . If the customer’s agreement specifies dedicated hardware disposal, then the provider must comply by physically destroying the drives.

Cryptographic erasure and degaussing are valid sanitization methods, but they may not meet the specific contractual requirement of physical destruction. Insurance clauses are unrelated to disposal.

This question underscores the importance of negotiating contractual terms in cloud agreements. Customers handling highly sensitive or regulated data may require physical destruction, while others may accept logical erasure. Clear agreements ensure both compliance and alignment of security responsibilities.

The Operational Excellence pillar emphasizes practices that allow organizations to develop, deploy, and operate workloads effectively. It includes monitoring operations, responding to incidents, and continuously improving processes. By embedding feedback loops, organizations enhance agility and ensure that technology supports business value.

Performance efficiency deals with using computing resources efficiently, reliability ensures system availability, and sustainability focuses on environmental responsibility. While important, these do not encompass the process-driven improvements at the heart of operational excellence.

Operational excellence ensures that organizations can adapt quickly to changes, implement automation, and drive consistent improvements across cloud workloads. It is a key principle in cloud frameworks like AWS Well-Architected, Microsoft CAF, and Google’s Reliability Engineering practices.

Outages are the primary cloud risk associated with dependency on legacy internal servers for application delivery. Managing Cloud guidance explains that legacy systems often lack redundancy, scalability, and resilience compared to cloud-native architectures.

When applications rely on aging internal infrastructure, failures in hardware, power, or connectivity can interrupt service delivery to end users. These outages can disrupt supply chains, delay transactions, and impact business continuity.

Natural disasters are external events, fast run time is not a risk, and homomorphic encryption is a cryptographic technique. Therefore, outages represent the correct risk in this context.

With SaaS , applications are delivered entirely by the provider, and customers have little to no control over the underlying platform or data portability. This creates a higher risk of vendor lock-in , as migrating away from one SaaS provider to another may require reworking applications or losing features.

In contrast, PaaS gives customers more flexibility by allowing them to build, deploy, and manage their own applications while relying on standardized frameworks and platforms. Because applications are customer-managed, switching providers or migrating workloads can be easier compared to SaaS.

Vendor lock-out, personnel threats, and natural disasters are risks in any service model. The key differentiator here is portability and flexibility. Choosing PaaS reduces dependence on a single provider’s application features, thereby lowering vendor lock-in risk while still offloading infrastructure management.

In cloud contract design, transportable means that data, applications, or services are able to be moved to another vendor . Managing Cloud principles explain that transportability supports exit strategies, reduces vendor lock-in risk, and enables business continuity.

Transportable solutions rely on standardized data formats, documented APIs, and interoperable architectures. Contracts often include provisions ensuring customers can retrieve data in usable formats and migrate workloads if needed.

Access by mobile devices, proprietary formats, or rapid archiving do not address vendor independence. Therefore, the correct definition of transportable is the ability to move to another vendor.

The Health Insurance Portability and Accountability Act (HIPAA) defines requirements for the electronic transfer of healthcare data to a cloud service provider. Managing Cloud documentation explains that HIPAA governs the protection, transmission, and storage of protected health information (PHI).

HIPAA establishes administrative, technical, and physical safeguards to ensure confidentiality, integrity, and availability of healthcare data. When healthcare organizations use cloud services, both the organization and the cloud provider must ensure compliance with HIPAA requirements.

The other regulations do not apply to healthcare data transfer. Stark Law addresses physician self-referral, the Healthcare Quality Improvement Law focuses on peer review, and GLBA applies to financial institutions. Therefore, HIPAA is the correct answer.

The capability to rapidly create and destroy virtual systems as demand fluctuates is known as ephemeral computing . These short-lived resources are provisioned automatically when needed and decommissioned when demand subsides.

Resource scheduling helps allocate resources but does not imply temporary lifespans. High availability ensures continuous service, and maintenance mode is used for administrative tasks.

Ephemeral computing is central to elasticity in cloud environments, reducing costs and improving scalability. For example, containers or serverless functions may run only while needed and then disappear. This model optimizes utilization, lowers expenses, and supports modern application architectures that demand agility.

Persistent protection is the security strategy most closely associated with data rights management (DRM) solutions. Managing Cloud principles explain that DRM is designed to ensure that data remains protected throughout its entire lifecycle, regardless of where it is stored, shared, or accessed.

Persistent protection means that security controls such as access restrictions, usage limitations, and expiration rules stay attached to the data itself. Even if the data is copied, transferred, or moved outside the original system, DRM policies continue to enforce protection. This approach is critical in cloud environments where data frequently moves across platforms, users, and geographic regions.

The other options do not represent DRM strategies. Multilevel aggregation and enhanced detail relate to data processing or analytics concepts, while unexpired digital content describes a content state rather than a security strategy. Therefore, persistent protection correctly represents the security approach used by data rights management solutions.

Architecting for failure is a fundamental business continuity and disaster recovery consideration in cloud application architecture. Managing Cloud principles emphasize that cloud systems must be designed with the assumption that components will fail.

Architecting for failure involves implementing redundancy, fault tolerance, automated recovery, and failover mechanisms. Applications should be resilient to infrastructure outages and capable of continuing operation despite component failures. This approach reduces downtime and ensures service availability during incidents.

Health status pages provide visibility, compliance addresses regulatory needs, and message queues support communication but do not fully address BC/DR requirements. Therefore, architecting for failure is the correct answer.

Retention periods define how long data must be stored to meet regulatory and compliance requirements. Managing Cloud guidance explains that laws and regulations often mandate minimum or maximum retention durations for specific types of data, such as financial records, health information, or audit logs.

A retention period policy ensures that data is kept for the required timeframe and securely disposed of once it is no longer needed. This helps organizations avoid legal penalties, reduce storage costs, and minimize risk exposure from retaining data longer than necessary.

The other options address different aspects of data management. Formats define how data is stored, classification categorizes data sensitivity, and retrieval focuses on access methods. None specify duration. Therefore, retention periods are the correct policy element.

Rapid elasticity is the cloud computing characteristic that allows consumers to automatically expand or contract resources based on demand. Managing Cloud documentation explains that rapid elasticity enables scaling of computing resources in near real time.

This capability allows organizations to handle variable workloads efficiently without manual intervention. Resources can be provisioned when demand increases and released when demand decreases, optimizing performance and cost.

Measured service focuses on usage tracking, resource pooling shares infrastructure, and on-demand self-service enables user provisioning. Therefore, rapid elasticity is the correct answer.

To provide a comprehensive report of system usage, the most important elements are user identifications (IDs) and access timestamps. These data points record who accessed the system, at what time, and for how long. Together, they allow the analyst to determine frequency and duration of use, which is essential for both operational auditing and security oversight.

Other options, such as informational logs or error logs, may provide context but do not directly answer the requirement of identifying users and usage patterns. For instance, 802.1x logs are related to network authentication, while commands or error timestamps reveal activity details but not the overall access history.

Collecting and analyzing IDs and timestamps supports compliance with regulatory frameworks like ISO 27001 and SOC 2, which require clear audit trails. It also provides accountability and supports investigations in case of unauthorized access or misuse. By including these elements, the analyst ensures the report meets internal and external requirements for system monitoring.

In the Software as a Service (SaaS) model, data security is a shared responsibility between the cloud provider and the enterprise. Managing Cloud principles explain that while the cloud service provider is responsible for securing the infrastructure, platform, and application itself, the customer retains responsibility for how data is used, classified, accessed, and governed.

The provider ensures data is protected through encryption mechanisms, availability controls, and secure storage, while the enterprise is responsible for data ownership, access permissions, identity management, and compliance with regulatory requirements. This shared ownership requires close coordination to ensure confidentiality, integrity, and availability of data.

Application, platform, and physical security are primarily the provider’s responsibility in SaaS. Therefore, data is the correct answer.

Dedicated memory allocation ensures isolation between virtual machines in a shared environment. Without memory isolation, remnants of one VM’s operations might remain in physical memory and be accessible to another VM, leading to cross-tenant data leakage. Assigning dedicated memory prevents attackers from exploiting memory-sharing vulnerabilities.

Encrypted network protocols protect data in transit, not memory. Encrypted file systems safeguard storage, not volatile memory. A dedicated processor helps with performance and isolation of compute tasks but does not secure temporary memory contents.

Cloud environments are multi-tenant, which makes memory isolation a critical safeguard. By dedicating memory or enforcing strict hypervisor-level isolation, providers prevent data exposure between customers. This aligns with best practices for virtualization security and the “resource pooling” characteristic of cloud computing, ensuring that shared infrastructure does not compromise confidentiality.

Continuous monitoring is the control that allows organizations to actively verify that a cloud provider is fulfilling contractual and compliance obligations. This involves automated collection and analysis of operational, security, and performance data. It enables organizations to ensure that service-level agreements (SLAs) are being honored and that compliance requirements are being met in real time.

While regulatory oversight is provided by external authorities and incident management is reactive in nature, continuous monitoring is a proactive approach. It allows customers to maintain visibility into provider operations. Confidential computing focuses on data protection but does not verify contract adherence.

By employing continuous monitoring, organizations establish transparency and accountability. It also supports audit processes by providing evidence that controls remain effective over time. This reduces risk associated with outsourcing critical functions to a cloud provider and ensures resilience against potential provider-side failures.

A sandbox is a controlled, isolated environment used to safely run, observe, and analyze potentially malicious code. In cybersecurity, sandboxes allow analysts to execute malware samples without risking contamination of production systems. This enables identification of malware behavior, persistence techniques, and indicators of compromise.

Encryption protects confidentiality, but does not allow safe execution. Gateways control traffic flow, and controllers manage devices or workloads. Only a sandbox provides the dedicated containment required for malware analysis.

In cloud environments, sandboxing is often implemented at scale to analyze suspicious files or traffic automatically. This practice enhances defenses against zero-day exploits, advanced persistent threats, and polymorphic malware. By preventing malware from escaping, sandboxes provide essential forensic and detection insights without endangering the wider environment.

Tier IV is the highest level in the Uptime Institute’s Data Center Site Infrastructure Tier Standards and is considered the most secure, reliable, and redundant. Managing Cloud documentation explains that Tier IV data centers provide fault tolerance with multiple independent systems.

This tier includes fully redundant components, multiple active power and cooling distribution paths, and continuous operation even during maintenance or failure events. Tier IV environments are designed for mission-critical systems requiring maximum uptime.

Tier I through Tier III offer increasing levels of redundancy but do not provide full fault tolerance. Therefore, Tier IV is the correct answer.

Archiving and retrieval procedures are the data retention method used for business continuity and disaster recovery (BC/DR) backups. Managing Cloud principles describe BC/DR as a critical operational function that ensures data can be restored following system failures, cyber incidents, or natural disasters.

Archiving involves securely storing backup data in a manner that preserves integrity and availability over time. Retrieval procedures define how quickly and effectively data can be accessed and restored when needed. Together, these procedures ensure that organizations can resume operations with minimal disruption.

The other options do not support BC/DR directly. Data classification categorizes data by sensitivity, local agent checks focus on endpoint health, and monitoring and enforcement apply to security oversight rather than retention. Therefore, archiving and retrieval procedures are essential for BC/DR backups.

Before transmitting sensitive financial data to the cloud, the best defense against interception threats like packet capture and man-in-the-middle attacks is encryption . Encryption protects data in transit by converting plain text into cipher text, which can only be deciphered with the correct keys.

Hashing provides integrity verification but does not secure confidentiality. Change tracking monitors modifications but does not prevent interception. Metadata labeling adds context but does not protect against on-path attackers.

Using strong encryption protocols (e.g., TLS) ensures that even if traffic is intercepted, the attacker cannot read the data. Encryption also aligns with compliance requirements such as PCI DSS, which mandates encryption for financial data during transmission. By encrypting before upload, the user ensures end-to-end confidentiality across potentially insecure networks.

The correct approach for sanitizing a USB thumb drive while preserving its usability is overwriting . Overwriting involves replacing the existing data on the device with random data or specific patterns to ensure that the original information cannot be recovered. This process leaves the physical device intact, allowing it to be reused securely.

Physical destruction, such as shredding, renders the device unusable. Degaussing only works on magnetic media like hard disks or tapes, not on solid-state or flash-based USB drives. Key revocation applies to cryptographic keys and not to physical devices.

By using overwriting, organizations comply with data sanitization standards while balancing operational efficiency. Many tools exist that perform multi-pass overwrites to meet regulatory requirements such as those from NIST or ISO. This ensures that sensitive data is removed while allowing the device to remain in circulation for continued use.

Data seizure is the risk associated with legal authorities removing or accessing a person’s information stored in a public cloud. Managing Cloud guidance explains that cloud data is subject to the laws and legal processes of the jurisdiction in which it resides.

In some cases, government agencies may compel cloud service providers to disclose or seize data as part of legal investigations. This can occur without the data owner’s direct involvement and may affect confidentiality, privacy, and business operations. Public cloud environments increase this risk because infrastructure is shared and often spans multiple jurisdictions.

Remote wiping is a data destruction technique, vendor lock-in relates to dependency on providers, and data masking protects sensitive data. Therefore, data seizure is the correct risk.

Simple Object Access Protocol (SOAP) is an API format that provides a framework for exchanging structured information using web services . Managing Cloud principles explain that SOAP is a protocol-based messaging standard that relies on XML for message formatting.

SOAP defines strict standards for message structure, communication protocols, and error handling, making it suitable for enterprise environments that require reliability, security, and formal contracts. It supports features such as authentication, encryption, and transaction integrity.

The other options describe characteristics of RESTful APIs. SOAP is XML-based and does not support multiple data formats. Therefore, the correct description is the structured web service framework.

Bollards are physical barriers designed to prevent vehicles from ramming into or breaching secure facilities. They are often placed at entrances, around perimeters, or in front of critical infrastructure like data centers.

Locks, cameras, and fences provide important physical security, but they cannot stop a high-speed vehicle from causing damage. Cameras record activity, fences create boundaries, and locks secure access points, but only bollards physically block or mitigate vehicle attacks.

Governmental and critical infrastructure sites commonly deploy bollards to protect against both accidental collisions and deliberate vehicle-borne attacks. Combined with layered security measures—such as surveillance and fencing—they enhance resilience against physical threats to sensitive data centers.

In the event of a civil lawsuit resulting from inadequate security management, the organization must communicate with the board of directors . Managing Cloud guidance explains that the board of directors holds ultimate responsibility for governance, oversight, and risk management within an organization.

The board ensures that appropriate policies, controls, and management structures are in place to protect organizational assets and comply with legal obligations. In legal matters, the board must be informed to oversee response strategies, legal counsel engagement, and corrective actions.

The IT department manages technical controls but does not provide organizational oversight. High-level government agencies are regulators, not internal oversight bodies. Therefore, board members are the correct entity to contact.

Information bleed is a risk associated with the Platform as a Service (PaaS) cloud model. Managing Cloud principles explain that PaaS environments are inherently multi-tenant, with multiple customers sharing the same underlying platform components such as runtimes, databases, and middleware.

If isolation controls are weak or misconfigured, data from one tenant may inadvertently become accessible to another. This unintended exposure is referred to as information bleed and represents a significant confidentiality risk in shared environments.

Guest escape is primarily related to virtualization at the infrastructure layer, software interoperability is a functional concern, and web application security applies across all service models. Therefore, information bleed is the most relevant PaaS-specific risk.

By analyzing natural events that could impact data centers and assessing the risks associated with each, the leadership team is defining the disaster criteria . This step determines what conditions or events qualify as disasters requiring activation of the recovery plan.

An asset inventory identifies systems, but here the focus is on external events. A disaster declaration process occurs during an actual event, and identifying actions comes later when response strategies are created.

Defining disaster criteria is essential to avoid ambiguity during crises. It establishes thresholds such as “category 4 hurricanes,” “regional power outages exceeding 12 hours,” or “seismic events over a set magnitude.” Clear criteria ensure consistent decision-making and timely activation of recovery procedures.

The Hybrid cloud model allows an on-premises data center to use cloud bursting . Managing Cloud principles explain that cloud bursting enables organizations to handle spikes in workload demand by temporarily using public cloud resources while maintaining normal operations on private, on-premises infrastructure.

In a hybrid model, private and public cloud environments are integrated, allowing workloads to move seamlessly between them. When on-premises capacity is exceeded, additional processing power or storage is obtained from the public cloud and released once demand returns to normal. This approach provides flexibility, scalability, and cost efficiency without requiring permanent over-provisioning of on-premises resources.

Public, private, and community clouds do not independently support cloud bursting from on-premises environments without hybrid integration. Therefore, the hybrid cloud model is the correct answer.

Rapid elasticity is the design principle that ensures cloud resources can grow or shrink dynamically based on user demand. Managing Cloud principles explain that rapid elasticity allows cloud systems to automatically scale resources such as compute, storage, and bandwidth in near real time.

This capability ensures that users experience consistent performance even during sudden increases in workload. Resources are provisioned when needed and released when demand decreases, enabling efficient utilization and cost control. From a security perspective, elasticity also supports resilience and availability by preventing resource exhaustion.

Resource pooling enables shared infrastructure, virtualization enables abstraction, and collaboration is not a cloud design principle. Therefore, rapid elasticity is the correct answer.

A compensating control should be implemented to address the loss of physical control when moving data to the cloud. Managing Cloud guidance explains that compensating controls are alternative safeguards used when direct controls are not feasible.

Since customers cannot physically secure cloud data centers, compensating controls such as strong encryption, key management, access controls, and monitoring are used to mitigate the risk. These controls provide equivalent or greater protection despite the lack of physical access.

The other options are not recognized control types in cloud security governance. Therefore, compensating control is the correct answer.

The Change Management Board (CMB) , also called the Change Advisory Board (CAB), is the formal authority responsible for reviewing, assessing, and approving planned modifications to IT environments. This group ensures that proposed changes align with business objectives, do not introduce unnecessary risks, and comply with security and regulatory requirements.

Event management teams focus on monitoring events, problem management teams handle root-cause analysis, and executive boards provide strategic direction but are not operational approval authorities. Only the CMB has the explicit role of validating technical and security implications before implementation.

By involving the CMB, organizations enforce structured governance, minimize disruptions, and establish accountability. This practice is central in ITIL and ISO/IEC 20000 standards, ensuring that operational integrity and security are preserved during change cycles.

This is an example of social engineering , where attackers manipulate individuals into divulging confidential information or performing actions that compromise security. In this case, the fraudulent caller convinced the help desk to disclose sensitive employee data.

Man-in-the-middle attacks involve intercepting communication between parties, escalation of privilege involves gaining higher access rights, and internal threats come from legitimate insiders. None of these fit the situation as accurately as social engineering.

Social engineering exploits human trust rather than technical vulnerabilities. Common tactics include phishing, pretexting, and phone-based fraud (vishing). Preventing such threats requires strong identity verification processes, employee awareness training, and layered authentication mechanisms. By recognizing the human element as a weak point, organizations can better prepare staff to resist manipulative tactics.

In cloud environments, the provider’s role in the chain of custody primarily involves collecting and preserving digital evidence when incidents or investigations occur. Because providers manage the infrastructure, they have direct access to logs, storage systems, and virtual machines necessary for evidence collection.

Backup policies and incident response may involve collaboration, but they remain customer responsibilities in many service models. Data classification and analysis are business-driven tasks, which customers must handle.

Providers must ensure that evidence collection is forensically sound and documented properly to maintain legal admissibility. This responsibility is critical in maintaining trust and ensuring compliance with laws and contractual obligations. It reinforces the shared responsibility model by clearly defining which aspects of digital forensics belong to the provider.

During the preparation phase of the incident response lifecycle, organizations focus on establishing readiness before any incident occurs. Managing Cloud principles explain that preparation includes identifying potential threats, evaluating vulnerabilities, and assessing risks that could impact cloud operations.

Risk assessments are a core activity in this phase because they help organizations understand which assets are most critical, what threats are likely, and where controls must be strengthened. Performing risk assessments allows security teams to define incident response procedures, allocate resources, establish escalation paths, and ensure tools and personnel are prepared.

The other options occur in later phases. Taking systems offline is part of containment, estimating the scope of the incident occurs during detection and analysis, and building a timeline of attack supports post-incident analysis. Therefore, performing risk assessments is the correct countermeasure during the preparation phase.

Business Impact Analysis (BIA) is the process that involves identifying and valuing assets to determine their potential effect on cloud operations. Managing Cloud documentation explains that BIA assesses how disruptions to systems, applications, or data impact business functions.

The process evaluates asset criticality, financial loss, operational downtime, and reputational damage. This information helps prioritize recovery strategies, define recovery time objectives, and guide risk management decisions in cloud environments.

Risk transfer shifts risk to third parties, vulnerability assessment identifies weaknesses, and out-of-band validation verifies controls independently. Therefore, business impact analysis is the correct answer.

The Payment Card Industry Data Security Standard (PCI DSS) governs credit card transactions in cloud operations. Managing Cloud principles explain that PCI DSS establishes security requirements for organizations that store, process, or transmit cardholder data.

PCI DSS applies to cloud service providers and cloud customers involved in payment processing. It mandates controls such as encryption, access restrictions, monitoring, vulnerability management, and secure system configurations to protect cardholder information.

GLBA applies to financial institutions, SOX governs financial reporting controls, and HIPAA protects healthcare data. Therefore, PCI DSS is the correct regulation for credit card transactions.

The Planning phase of the software development life cycle (SDLC) includes creating user stories . Managing Cloud principles explain that user stories capture functional requirements from the end user’s perspective and help define application behavior and priorities.

During planning, stakeholders collaborate to identify business needs, define scope, and establish development goals. User stories are used to guide development tasks and ensure alignment with customer expectations.

Designing focuses on architecture, developing involves coding, and defining establishes high-level objectives. Therefore, planning is the correct SDLC phase for creating user stories.

Agile is an iterative software development methodology designed to prioritize customer satisfaction, adaptability, and incremental delivery. Agile teams deliver small, working pieces of software frequently, ensuring feedback is incorporated throughout the process. This flexibility allows late-stage requirement changes to be accommodated without derailing the project.

Waterfall is a sequential approach with limited flexibility. Spiral combines iterative development with risk analysis, but it is not as customer-focused as Agile. Lean emphasizes efficiency and waste reduction but does not center on continuous delivery and adaptability.

Agile frameworks such as Scrum and Kanban embody this philosophy, supporting faster innovation, better collaboration, and responsiveness to evolving business needs.

Infrastructure as a Service (IaaS) requires the greatest level of consumer responsibility for security. Managing Cloud documentation explains that in the shared responsibility model, IaaS providers supply virtualized infrastructure components such as compute, storage, and networking, while consumers manage everything above that layer.

Customers are responsible for securing operating systems, applications, data, access controls, patching, and configuration management. This includes vulnerability management, endpoint security, identity management, and monitoring. While this model provides flexibility and control, it also demands strong security expertise and governance.

In contrast, PaaS and SaaS shift more security responsibilities to the provider, and DBaaS abstracts database management. Therefore, IaaS places the highest security responsibility on the consumer.

Platform as a Service (PaaS) allows customers to focus on writing and deploying code without managing the underlying infrastructure. The provider manages the operating system, runtime, and middleware, enabling faster development cycles and reduced administrative overhead.

IaaS would require the customer to configure servers and operating systems, SaaS provides ready-to-use applications, and DSaaS is a specialized category for analytics.

By abstracting the infrastructure, PaaS accelerates innovation and reduces operational burden but also limits flexibility in some cases. Security responsibilities under PaaS focus on application-level controls, while the provider handles infrastructure-level protections.

Key escrow is the management process that involves multiple key holders, where each party has access to a portion of the cryptographic information. Managing Cloud principles explain that key escrow is designed to ensure availability and recoverability of encrypted data while maintaining security controls.

In this model, encryption keys are stored securely with trusted third parties or divided among multiple custodians. No single individual has full access to the complete key, reducing the risk of misuse or compromise. Key escrow is often used to support compliance, lawful access requirements, and business continuity needs, ensuring that encrypted data can be recovered if the primary key holder is unavailable.

The other options do not fit this definition. Recovery refers to restoring keys or data, revocation disables compromised keys, and distribution focuses on delivering keys to authorized systems. Therefore, escrow is the correct answer.

The Gramm-Leach-Bliley Act (GLBA) requires cloud service providers to protect customer data for banks and insurance companies. Managing Cloud principles explain that GLBA applies to financial institutions and mandates safeguards to protect consumers’ nonpublic personal information.

Cloud service providers supporting financial organizations must implement security controls that align with GLBA requirements, including data protection, risk management, and access controls. This ensures confidentiality and integrity of financial data stored or processed in the cloud.

IDEA governs education services, DMCA addresses digital copyright, and FERPA protects student education records. Therefore, GLBA is the correct compliance requirement.

Before performing a vulnerability assessment on a cloud service, the cloud service provider (CSP) must be notified. Managing Cloud principles explain that CSPs own and operate the underlying infrastructure and define acceptable use and security testing conditions through their terms of service.

Notifying the CSP ensures that testing activities are authorized and do not violate contractual agreements or trigger security alerts. Unauthorized testing could be mistaken for malicious activity and lead to service disruption or legal consequences. CSP notification also allows coordination to minimize operational impact.

Although the service was procured through a broker, the CSP ultimately controls the environment being tested. Therefore, the cloud service provider is the correct entity to notify.

Patch management is a core process implemented during the hardening of an operating system and its workloads. Managing Cloud principles explain that OS hardening involves reducing vulnerabilities by applying security patches, updates, and fixes to eliminate known weaknesses.

Patch management ensures that operating systems, applications, and dependencies are kept up to date with vendor-released security patches. This process reduces the attack surface and prevents exploitation of known vulnerabilities. Effective patch management includes testing, deployment, verification, and ongoing monitoring.

Change management governs how changes are approved, incident management handles security events, and security management is a broader governance function. Therefore, patch management is the correct process associated with OS hardening.

A vulnerability assessment requires compliance with the cloud service provider’s terms of service. Managing Cloud documentation explains that vulnerability scanning and testing can affect cloud infrastructure and other tenants if not properly authorized.

CSPs define acceptable testing activities to protect shared environments. Customers must follow these guidelines to avoid violating contracts or causing service disruptions. Many CSPs require prior notification or explicit permission before conducting vulnerability assessments.

The other methods involve internal development processes and do not impact cloud infrastructure directly. Therefore, vulnerability assessment is the correct answer.

Video surveillance capability is a key security control used as part of a layered physical defense at a cloud hosting site. Managing Cloud principles explain that physical security relies on multiple overlapping controls to deter, detect, and respond to unauthorized physical access.

Video surveillance provides continuous monitoring of data center facilities, including entrances, exits, server rooms, and perimeter boundaries. It acts as both a deterrent and a detection mechanism, enabling real-time observation and post-incident investigation. Surveillance footage supports incident response, forensic analysis, and compliance requirements.

Access control enforcement and multifactor authentication are primarily logical or administrative controls, while background checks are personnel security measures. Although important, they are not physical perimeter controls. Therefore, video surveillance capability is the correct answer.