WGU Managing-Cloud-Security - WGU Managing Cloud Security (JY02, GZO1)

Under the General Data Protection Regulation (GDPR), an EU citizen must provide specific consent before an organization may process their personal data, unless another lawful basis explicitly applies. Managing Cloud principles explain that consent must be freely given, specific, informed, and unambiguous. This ensures individuals retain control over how their personal information is collected and used.

Consent must clearly state the purpose of processing and cannot be implied or bundled with unrelated terms. Organizations must also be able to demonstrate that consent was obtained and allow individuals to withdraw consent at any time. This requirement strengthens transparency and accountability in data handling practices.

The other options do not satisfy GDPR consent requirements. Legal purpose attestation is an organizational responsibility, data accuracy verification is a data quality obligation, and statements of need do not replace explicit consent. Therefore, specific consent is required before processing personal data.

Physical security is a cloud infrastructure risk that is the responsibility of the cloud provider. Managing Cloud principles explain that providers are responsible for securing data center facilities, including buildings, hardware, power systems, and environmental controls.

This includes access controls, surveillance, guards, and protection against physical threats such as theft, vandalism, and natural disasters. Customers do not have physical access to cloud data centers and therefore rely entirely on the provider to manage these risks.

Data security and application security are typically shared responsibilities, while security governance is largely the customer’s responsibility. Therefore, physical security is the correct answer.

The Planning phase of the software development life cycle (SDLC) includes creating user stories. Managing Cloud principles explain that user stories capture functional requirements from the end user’s perspective and help define application behavior and priorities.

During planning, stakeholders collaborate to identify business needs, define scope, and establish development goals. User stories are used to guide development tasks and ensure alignment with customer expectations.

Designing focuses on architecture, developing involves coding, and defining establishes high-level objectives. Therefore, planning is the correct SDLC phase for creating user stories.

When storing personally identifiable information (PII) in the cloud, the jurisdictional location of the data must be clearly understood. Managing Cloud principles emphasize that data is subject to the laws and regulations of the country or region where it is physically stored.

Different jurisdictions impose varying requirements for data protection, privacy, access, and disclosure. Knowing where data resides allows organizations to assess legal obligations, compliance requirements, and potential risks associated with government access or cross-border data transfers.

The physical location of infrastructure components such as firewalls or load balancers does not determine legal jurisdiction over stored data. Availability zones may exist within a region but do not define jurisdiction independently. Therefore, the jurisdictional location of the data itself is the critical factor.

Reliability in cloud design ensures workloads can recover quickly from disruptions and continue operating as expected. This concept focuses on high availability, fault tolerance, and disaster recovery. Reliability requires implementing redundancy, backup strategies, and robust monitoring.

Security ensures data protection, operational excellence covers continuous improvement, and resource hierarchy refers to organizational structures, but none focus specifically on availability and resilience.

By prioritizing reliability, organizations design cloud architectures capable of withstanding failures at multiple layers—compute, storage, networking, and even regions. This design principle ensures customer trust and compliance with service-level agreements.

Patch management is a core process implemented during the hardening of an operating system and its workloads. Managing Cloud principles explain that OS hardening involves reducing vulnerabilities by applying security patches, updates, and fixes to eliminate known weaknesses.

Patch management ensures that operating systems, applications, and dependencies are kept up to date with vendor-released security patches. This process reduces the attack surface and prevents exploitation of known vulnerabilities. Effective patch management includes testing, deployment, verification, and ongoing monitoring.

Change management governs how changes are approved, incident management handles security events, and security management is a broader governance function. Therefore, patch management is the correct process associated with OS hardening.

A Web Application Firewall (WAF) allows customers to redirect traffic as part of securing cloud-hosted applications. Managing Cloud principles explain that WAFs operate at the application layer and can inspect, filter, allow, block, or redirect HTTP and HTTPS traffic based on defined security rules.

Traffic redirection is commonly used to route suspicious or malicious requests away from protected applications, forward traffic to alternate services, or enforce secure communication paths. WAFs can also integrate with load balancers and content delivery networks to manage traffic flow efficiently while protecting applications from attacks such as SQL injection, cross-site scripting, and denial-of-service attempts.

The other options do not provide traffic redirection. SIEM systems aggregate and analyze logs, intrusion detection and prevention systems focus on detection and blocking, and cryptographic key management handles encryption keys. Therefore, a web application firewall is the correct answer.

Key escrow is the management process that involves multiple key holders, where each party has access to a portion of the cryptographic information. Managing Cloud principles explain that key escrow is designed to ensure availability and recoverability of encrypted data while maintaining security controls.

In this model, encryption keys are stored securely with trusted third parties or divided among multiple custodians. No single individual has full access to the complete key, reducing the risk of misuse or compromise. Key escrow is often used to support compliance, lawful access requirements, and business continuity needs, ensuring that encrypted data can be recovered if the primary key holder is unavailable.

The other options do not fit this definition. Recovery refers to restoring keys or data, revocation disables compromised keys, and distribution focuses on delivering keys to authorized systems. Therefore, escrow is the correct answer.

Infrastructure as a Service (IaaS) delivers fundamental computing resources over the cloud. These include virtual machines, block storage, networking, and load balancers. Customers use these resources to build and manage custom IT solutions, while the provider manages the underlying hardware.

PaaS abstracts infrastructure further, providing a development environment for applications without requiring infrastructure management. SaaS delivers fully functional applications over the internet. NaaS is a narrower category focusing on network delivery.

IaaS is the correct answer because it gives maximum flexibility and control compared to the other models, allowing organizations to build tailored environments. It also requires customers to manage operating systems, middleware, and runtime security, making shared responsibility an essential part of the model.

Before transmitting sensitive financial data to the cloud, the best defense against interception threats like packet capture and man-in-the-middle attacks is encryption. Encryption protects data in transit by converting plain text into cipher text, which can only be deciphered with the correct keys.

Hashing provides integrity verification but does not secure confidentiality. Change tracking monitors modifications but does not prevent interception. Metadata labeling adds context but does not protect against on-path attackers.

Using strong encryption protocols (e.g., TLS) ensures that even if traffic is intercepted, the attacker cannot read the data. Encryption also aligns with compliance requirements such as PCI DSS, which mandates encryption for financial data during transmission. By encrypting before upload, the user ensures end-to-end confidentiality across potentially insecure networks.