Which concept focuses on operating highly available workloads in the cloud?
Answer(s): D
Reliability in cloud design ensures workloads can recover quickly from disruptions and continue operating as expected. This concept focuses on high availability, fault tolerance, and disaster recovery. Reliability requires implementing redundancy, backup strategies, and robust monitoring.Security ensures data protection, operational excellence covers continuous improvement, and resource hierarchy refers to organizational structures, but none focus specifically on availability and resilience.By prioritizing reliability, organizations design cloud architectures capable of withstanding failures at multiple layers--compute, storage, networking, and even regions. This design principle ensures customer trust and compliance with service-level agreements.
A cloud provider that processes third-party credit card payments is unable to encrypt its customers' cardholder data because of constraints on a legacy payment processing system. What should it implement to maintain Payment Card Industry Data Security Standard (PCI DSS) compliance?
When a required PCI DSS control cannot be implemented due to technical limitations, the organization must apply a compensating control. A compensating control is an alternative safeguard that meets the intent and rigor of the original requirement.Risk acceptance is insufficient under PCI DSS, as compliance demands enforceable safeguards. Privacy controls and protection levels may enhance data security but do not formally replace mandatory encryption requirements.For example, a provider may use strict access controls, network segmentation, or monitoring to mitigate risks from unencrypted cardholder data. Documenting these compensating controls is essential during audits, ensuring compliance despite system limitations.
A customer requests that a cloud provider physically destroys any drives storing their personal dat
Answer(s): C
Cloud providers typically manage multi-tenant infrastructure, where physical hardware is shared among customers. Therefore, drives are not destroyed for each customer unless explicitly required in the contract. If the customer's agreement specifies dedicated hardware disposal, then the provider must comply by physically destroying the drives.Cryptographic erasure and degaussing are valid sanitization methods, but they may not meet the specific contractual requirement of physical destruction. Insurance clauses are unrelated to disposal.This question underscores the importance of negotiating contractual terms in cloud agreements. Customers handling highly sensitive or regulated data may require physical destruction, while others may accept logical erasure. Clear agreements ensure both compliance and alignment of security responsibilities.
When should a cloud service provider delete customer data?
The correct time for data deletion is after the specified retention period defined by contractual agreements, regulatory frameworks, or internal policies. Retention policies ensure that data is kept for as long as necessary for business, legal, or compliance reasons but not longer than required.Oversubscription, inactivity, or review cycles are not valid triggers because they may conflict with compliance mandates such as GDPR, HIPAA, or PCI DSS. Deleting data prematurely could result in legal penalties or business risks, while keeping it longer than necessary could increase exposure.By deleting data only after the retention period, providers demonstrate adherence to data governance principles and protect customer rights while minimizing storage costs and liability.
Which device is used to create and manage encryption keys used for data transmission in a cloud- based environment?
Answer(s): A
A Hardware Security Module (HSM) is a dedicated, tamper-resistant device designed for creating, managing, and storing encryption keys. In cloud environments, HSMs are essential for securing cryptographic operations, such as SSL/TLS key management, digital signatures, and secure data transmission.TPMs are hardware chips used to secure local devices, such as laptops. Memory controllers and RAID controllers manage system performance and storage but are not cryptographic devices.HSMs provide strong protection against key theft or misuse by isolating cryptographic functions from general-purpose computing resources. They are often certified under standards like FIPS 140-2, ensuring compliance with stringent security requirements. In cloud services, customers can use provider-managed HSMs or deploy dedicated virtual HSM instances for secure key management.
Post your Comments and Discuss WGU Managing-Cloud-Security exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the Managing-Cloud-Security content, but please register or login to continue.