WGU Managing-Cloud-Security - WGU Managing Cloud Security (JY02)

By analyzing natural events that could impact data centers and assessing the risks associated with each, the leadership team isdefining the disaster criteria. This step determines what conditions or events qualify as disasters requiring activation of the recovery plan.

An asset inventory identifies systems, but here the focus is on external events. A disaster declaration process occurs during an actual event, and identifying actions comes later when response strategies are created.

Defining disaster criteria is essential to avoid ambiguity during crises. It establishes thresholds such as “category 4 hurricanes,” “regional power outages exceeding 12 hours,” or “seismic events over a set magnitude.” Clear criteria ensure consistent decision-making and timely activation of recovery procedures.

In a cloud environment, responsibility forhardware managementshifts primarily to the cloud provider. Customers no longer manage servers, storage devices, or physical networks directly. As a result, hardware management policies are less critical for customer audits compared to data classification, procurement, or acceptable use.

Data classification remains essential to secure sensitive information. Software procurement policies are important to control licensing and compliance. Acceptable use policies govern employee behavior in cloud environments.

While organizations may still need high-level oversight of hardware through contracts and SLAs, detailed hardware policies have a reduced role. Instead, emphasis shifts to managing the shared responsibility model, ensuring cloud provider controls complement customer governance.

Apipelinerefers to the structured process of moving code from development to production, encompassing implementation, review, automated testing, and deployment. In DevOps, this is known as a CI/CD pipeline (Continuous Integration/Continuous Deployment).

An iteration refers to a development cycle, a baseline represents a stable reference configuration, and a framework provides structure but not a deployment sequence. Only pipeline accurately captures the sequential, automated flow of code into production.

Pipelines enhance efficiency, consistency, and quality assurance by automating repetitive tasks, reducing human error, and ensuring that code changes are validated before reaching production. They are essential for modern cloud-native applications where rapid deployment is expected.

TheProcess for Attack Simulation and Threat Analysis (PASTA)is a risk-centric threat modeling methodology that explicitly focuses on simulating real-world attacks from an adversary’s perspective. Unlike STRIDE or DREAD, which classify threats and rate severity, PASTA evaluates how an attacker would exploit vulnerabilities step by step.

PASTA has seven stages, including defining objectives, decomposing applications, and simulating attacks. This methodology helps organizations understand both technical and business risks by looking at the application as an attacker would.

STRIDE categorizes threats, DREAD provides scoring, and ATASM emphasizes architecture and mitigation. While valuable, they are not primarily attack-simulation frameworks. PASTA enables proactive testing of defenses against realistic adversary behaviors, making it especially relevant in modern cloud and DevSecOps environments.

The phase of software design that integrates individual code components and verifies their interoperability isTesting, specifically integration testing. After developers write and unit-test individual modules, those modules must be combined into a complete system. The testing phase ensures that these modules communicate properly, data flows correctly, and overall functionality meets requirements.

Planning establishes project goals, coding builds individual components, and training prepares users. None of these directly verify interoperability. Testing is critical because even well-functioning components may fail when combined, due to interface mismatches, unexpected data structures, or dependency issues.

Cloud-based systems often integrate microservices, APIs, and third-party services. Testing validates that these distributed components interact seamlessly. Proper testing reduces defects, supports reliability, and ensures a consistent end-user experience. It also aligns with DevOps practices, where continuous integration and automated testing pipelines quickly identify and remediate interoperability issues.

Bollardsare physical barriers designed to prevent vehicles from ramming into or breaching secure facilities. They are often placed at entrances, around perimeters, or in front of critical infrastructure like data centers.

Locks, cameras, and fences provide important physical security, but they cannot stop a high-speed vehicle from causing damage. Cameras record activity, fences create boundaries, and locks secure access points, but only bollards physically block or mitigate vehicle attacks.

Governmental and critical infrastructure sites commonly deploy bollards to protect against both accidental collisions and deliberate vehicle-borne attacks. Combined with layered security measures—such as surveillance and fencing—they enhance resilience against physical threats to sensitive data centers.

In Agile development,user storiesare the standard way to capture requirements for new features or improvements. A user story describes the functionality from the perspective of the end user, ensuring that development aligns with business needs.

“Cases” might refer to test cases, which validate requirements, but they are not used to describe them. Cookies are technical elements for web sessions, and notes are informal documentation.

User stories typically follow a format such as:“As a [role], I want [goal] so that [benefit].”This provides clarity, fosters communication between developers and stakeholders, and ensures that acceptance criteria can be defined and tested. Using stories as a requirement tool aligns with iterative, customer-focused release cycles.

Platform as a Service (PaaS) allows customers to focus on writing and deploying code without managing the underlying infrastructure. The provider manages the operating system, runtime, and middleware, enabling faster development cycles and reduced administrative overhead.

IaaS would require the customer to configure servers and operating systems, SaaS provides ready-to-use applications, and DSaaS is a specialized category for analytics.

By abstracting the infrastructure, PaaS accelerates innovation and reduces operational burden but also limits flexibility in some cases. Security responsibilities under PaaS focus on application-level controls, while the provider handles infrastructure-level protections.

The described scenario is aninjection attack. Injection occurs when unvalidated input—such as SQL commands, script code, or OS instructions—is sent to an application through API forms or parameters. If the application fails to sanitize input, the attacker’s code may be executed with full system privileges.

On-path attacks intercept communication, credential attacks target authentication, and denial-of-service floods services. None involve code execution via unvalidated input.

Injection is a top risk in OWASP API Security Top 10. Developers must implement input validation, parameterized queries, and least privilege principles to mitigate this risk. API gateways and WAFs provide additional layers of protection but cannot replace secure coding practices.