WGU Managing-Cloud-Security - WGU Managing Cloud Security (JY02, GZO1)

A core goal of OS baseline compliance and monitoring is to ensure that virtual images and operating systems adhere to approved baseline configuration requirements. Managing Cloud documentation explains that baseline configurations define secure settings for operating systems, including disabled services, patch levels, access controls, and logging configurations.

Compliance monitoring continuously verifies that systems remain aligned with these baselines over time. This helps detect unauthorized changes, configuration drift, or misconfigurations that could introduce vulnerabilities. Ensuring that virtual images meet baseline standards before deployment also reduces risk across scaled cloud environments.

The other options relate to availability, network isolation, or data separation, which are addressed by different controls. Therefore, ensuring baseline configuration compliance is the primary goal of OS baseline monitoring.

Baselining is the process of establishing a reference point for the standard configuration of systems, networks, or applications. This baseline represents the approved, secure state. By continuously comparing the current environment to the baseline, organizations can detect deviations, unauthorized changes, or misconfigurations.

Patch management involves updating systems, deployment refers to installing new systems, and capacity management focuses on resource planning. While important, these do not establish a standard state for comparison.

Baselining is essential for change management and security auditing. It supports configuration management databases (CMDBs), intrusion detection, and compliance requirements. When deviations are detected, they can be escalated for remediation or formally approved through change control processes.

The described control is authorization, which occurs after authentication. Authorization determines what resources a user can access based on their role, attributes, or policies stored in an access control database.

Authentication confirms identity, but authorization validates permissions. WAFs protect applications from malicious traffic, and antispyware tools detect malware. Neither applies to access decisions.

By checking users against a database of permissions, the organization enforces the principle of least privilege, ensuring employees only access the resources necessary for their role. This strengthens data protection, reduces insider threats, and aligns with compliance requirements for access governance.

A pipeline refers to the structured process of moving code from development to production, encompassing implementation, review, automated testing, and deployment. In DevOps, this is known as a CI/CD pipeline (Continuous Integration/Continuous Deployment).

An iteration refers to a development cycle, a baseline represents a stable reference configuration, and a framework provides structure but not a deployment sequence. Only pipeline accurately captures the sequential, automated flow of code into production.

Pipelines enhance efficiency, consistency, and quality assurance by automating repetitive tasks, reducing human error, and ensuring that code changes are validated before reaching production. They are essential for modern cloud-native applications where rapid deployment is expected.

The correct contractual safeguard is an escrow agreement. Data escrow involves storing critical data or software with a neutral third party, which can release it to the customer if the provider fails to meet obligations, such as bankruptcy or service discontinuation.

Indemnification covers liability, offboarding manages termination processes, and encryption secures data but does not ensure availability if the provider disappears.

Escrow provisions protect business continuity by guaranteeing customer access to data regardless of provider viability. They are especially important for organizations handling mission-critical workloads or long-term regulatory obligations in the cloud.

NIST SP 800-37 provides a detailed guide for implementing the Risk Management Framework (RMF). Managing Cloud documentation explains that this framework offers a structured process for integrating security and risk management into system development and operational activities.

NIST SP 800-37 outlines steps such as categorizing systems, selecting and implementing security controls, assessing effectiveness, authorizing systems, and continuous monitoring. This lifecycle-based approach helps organizations manage risk in cloud and traditional environments consistently.

ISO 31000 provides general risk management principles, ISO 27001 focuses on information security management systems, and PCI DSS is a compliance standard. Therefore, NIST SP 800-37 is the correct guide for implementing the RMF.

The General Data Protection Regulation (GDPR) is the legal framework concerned with the privacy of data belonging to citizens of the European Union and the European Economic Area (EU/EEA). Managing Cloud principles explain that GDPR establishes comprehensive rules governing the collection, processing, storage, and transfer of personal data.

GDPR applies to organizations both within and outside the EU/EEA if they process personal data of EU residents. It enforces strict requirements related to data protection, consent, breach notification, and individual rights. Cloud service providers and consumers must ensure compliance when handling EU personal data.

The other options apply to different jurisdictions or data types. HIPAA governs healthcare data in the United States, COPPA protects children’s online privacy in the U.S., and APPI applies to Japan. Therefore, GDPR is the correct framework.

Platform as a Service (PaaS) is the recommended option for organizations seeking to simplify application development and management. Managing Cloud guidance explains that PaaS provides a complete development environment, including operating systems, runtime environments, middleware, databases, and development tools.

By abstracting infrastructure and platform management, PaaS allows developers to focus exclusively on building, testing, and deploying applications. Tasks such as patching, scaling, load balancing, and environment configuration are handled by the cloud provider, reducing complexity and administrative effort.

DaaS focuses on delivering virtual desktops, IaaS requires customers to manage operating systems and applications, and SaaS provides fully developed applications rather than development platforms. Therefore, PaaS best meets the requirement of simplifying development and management.

Outages are the primary cloud risk associated with dependency on legacy internal servers for application delivery. Managing Cloud guidance explains that legacy systems often lack redundancy, scalability, and resilience compared to cloud-native architectures.

When applications rely on aging internal infrastructure, failures in hardware, power, or connectivity can interrupt service delivery to end users. These outages can disrupt supply chains, delay transactions, and impact business continuity.

Natural disasters are external events, fast run time is not a risk, and homomorphic encryption is a cryptographic technique. Therefore, outages represent the correct risk in this context.

A third-party attestation should be used by consumers to determine whether a cloud service provider meets regulatory and legal compliance requirements. Managing Cloud principles explain that independent audits and attestations provide objective evidence of compliance.

Third-party attestations validate that a provider has implemented required controls and follows recognized standards. These reports reduce the need for customers to perform direct audits and increase trust in the provider’s security and compliance posture.

Warrants relate to law enforcement, regulatory obligations define requirements but do not prove compliance, and contracts outline responsibilities but do not independently verify adherence. Therefore, third-party attestation is the correct answer.