売れ筋トップクラスのManaging-Cloud-Security最新試験問題2026年最新のWGU試験練習
Courses and Certificates問題集でManaging-Cloud-Security試験は完全版問題で試験学習ガイド
質問 # 38
Which security concept requires continuous identity and authorization checks to allow access to data?
- A. Zero trust
- B. Secret management
- C. Intrusion prevention
- D. Traffic inspection
正解：A
解説：
TheZero Trustsecurity model assumes that no user, device, or application should be trusted by default, whether inside or outside the network perimeter. Every access request must be continuously verified using strict identity, authorization, and context-based checks.
Unlike traditional perimeter security, Zero Trust emphasizes the principle of "never trust, always verify." Traffic inspection looks at data packets, intrusion prevention identifies malicious activity, and secret management safeguards sensitive keys and credentials. None of these approaches enforce constant, adaptive identity verification the way Zero Trust does.
By adopting Zero Trust, organizations ensure that access is not granted simply because a user is "inside" the network. Instead, continuous checks evaluate credentials, device posture, location, and other risk factors. This significantly reduces the risk of insider threats, credential theft, and lateral movement within cloud environments.
質問 # 39
Which legal framework is concerned with the privacy of data of EU/EEA citizens?
- A. HIPAA
- B. GDPR
- C. COPPA
- D. APPI
正解：B
解説：
The General Data Protection Regulation (GDPR) is the legal framework concerned with the privacy of data belonging to citizens of the European Union and the European Economic Area (EU/EEA). Managing Cloud principles explain that GDPR establishes comprehensive rules governing the collection, processing, storage, and transfer of personal data.
GDPR applies to organizations both within and outside the EU/EEA if they process personal data of EU residents. It enforces strict requirements related to data protection, consent, breach notification, and individual rights. Cloud service providers and consumers must ensure compliance when handling EU personal data.
The other options apply to different jurisdictions or data types. HIPAA governs healthcare data in the United States, COPPA protects children's online privacy in the U.S., and APPI applies to Japan. Therefore, GDPR is the correct framework.
質問 # 40
Which type of service allows an organization to maximize control of its information?
- A. Desktop as a Service (DaaS)
- B. Software as a Service (SaaS)
- C. Platform as a Service (PaaS)
- D. Infrastructure as a Service (IaaS)
正解：D
解説：
Infrastructure as a Service (IaaS) allows an organization to maximize control over its information.
Managing Cloud principles explain that in the IaaS model, customers manage operating systems, applications, data, access controls, and security configurations.
This high level of control enables organizations to implement customized security policies, encryption mechanisms, and compliance controls tailored to their specific requirements. Customers retain direct responsibility for data protection, system hardening, and monitoring.
In contrast, PaaS and SaaS abstract more control to the provider, limiting customization. DaaS focuses on user desktops rather than data governance. Therefore, IaaS provides the greatest control over information assets.
質問 # 41
An organization is conducting an external audit of the IT policies governing its production environment after moving all of its production systems to the cloud. Which IT policy will have a low priority in this environment?
- A. Hardware management
- B. Software procurement
- C. Data classification
- D. Acceptable use
正解：A
解説：
In a cloud environment, responsibility forhardware managementshifts primarily to the cloud provider.
Customers no longer manage servers, storage devices, or physical networks directly. As a result, hardware management policies are less critical for customer audits compared to data classification, procurement, or acceptable use.
Data classification remains essential to secure sensitive information. Software procurement policies are important to control licensing and compliance. Acceptable use policies govern employee behavior in cloud environments.
While organizations may still need high-level oversight of hardware through contracts and SLAs, detailed hardware policies have a reduced role. Instead, emphasis shifts to managing the shared responsibility model, ensuring cloud provider controls complement customer governance.
質問 # 42
Which cloud model allows an on-premises data center to use cloud bursting?
- A. Hybrid
- B. Private
- C. Community
- D. Public
正解：A
解説：
The Hybrid cloud model allows an on-premises data center to use cloud bursting. Managing Cloud principles explain that cloud bursting enables organizations to handle spikes in workload demand by temporarily using public cloud resources while maintaining normal operations on private, on-premises infrastructure.
In a hybrid model, private and public cloud environments are integrated, allowing workloads to move seamlessly between them. When on-premises capacity is exceeded, additional processing power or storage is obtained from the public cloud and released once demand returns to normal. This approach provides flexibility, scalability, and cost efficiency without requiring permanent over-provisioning of on-premises resources.
Public, private, and community clouds do not independently support cloud bursting from on-premises environments without hybrid integration. Therefore, the hybrid cloud model is the correct answer.
質問 # 43
An engineer has been given the task of ensuring all of the keys used to encrypt archival data are securely stored according to industry standards. Which location is a secure option for the engineer to store encryption keys for decrypting data?
- A. An escrow that is kept separate from the data it is tied to
- B. A repository that is made private
- C. A repository that is made public
- D. An escrow that is kept local to the data it is tied to
正解：A
解説：
Industry best practice requires that encryption keys arestored separately from the data they protect. This ensures that if the data storage system is compromised, attackers cannot immediately decrypt sensitive information. The use of a secure escrow system is a recognized approach.
An escrow provides controlled storage for encryption keys, ensuring they are only accessible by authorized processes and not co-located with the protected data. Keeping keys "local" to the data creates a single point of failure. A public or private repository without specialized protection mechanisms would also be insufficient due to risks of insider threats or misconfiguration.
By placing keys in an independent escrow system, the organization enforces separation of duties, strengthens defense-in-depth, and aligns with cryptographic standards from NIST and ISO. This practice is vital when dealing with archival data, where long-term confidentiality must be preserved even as systems evolve.
質問 # 44
Developers need to be aware of a common application programming interface (API) threat that occurs when attackers send malicious code through a form input to a web application so that it may then be executed.
Which type of attack represents this API threat?
- A. On-path
- B. Credential
- C. Denial-of-service
- D. Injection
正解：D
解説：
The described scenario is aninjection attack. Injection occurs when unvalidated input-such as SQL commands, script code, or OS instructions-is sent to an application through API forms or parameters. If the application fails to sanitize input, the attacker's code may be executed with full system privileges.
On-path attacks intercept communication, credential attacks target authentication, and denial-of-service floods services. None involve code execution via unvalidated input.
Injection is a top risk in OWASP API Security Top 10. Developers must implement input validation, parameterized queries, and least privilege principles to mitigate this risk. API gateways and WAFs provide additional layers of protection but cannot replace secure coding practices.
質問 # 45
An organization is reviewing a contract from a cloud service provider and wants to ensure that all aspects of the contract are adhered to by the cloud service provider. Which control will allow the organization to verify that the cloud provider is meeting its obligations?
- A. Confidential computing
- B. Continuous monitoring
- C. Regulatory oversight
- D. Incident management
正解：B
解説：
Continuous monitoring is the control that allows organizations to actively verify that a cloud provider is fulfilling contractual and compliance obligations. This involves automated collection and analysis of operational, security, and performance data. It enables organizations to ensure that service-level agreements (SLAs) are being honored and that compliance requirements are being met in real time.
While regulatory oversight is provided by external authorities and incident management is reactive in nature, continuous monitoring is a proactive approach. It allows customers to maintain visibility into provider operations. Confidential computing focuses on data protection but does not verify contract adherence.
By employing continuous monitoring, organizations establish transparency and accountability. It also supports audit processes by providing evidence that controls remain effective over time. This reduces risk associated with outsourcing critical functions to a cloud provider and ensures resilience against potential provider-side failures.
質問 # 46
Which security control could be implemented as part of a layered physical defense at a cloud hosting site?
- A. Multifactor authentication
- B. Background checks
- C. Video surveillance capability
- D. Access control enforcement
正解：C
解説：
Video surveillance capability is a key security control used as part of a layered physical defense at a cloud hosting site. Managing Cloud principles explain that physical security relies on multiple overlapping controls to deter, detect, and respond to unauthorized physical access.
Video surveillance provides continuous monitoring of data center facilities, including entrances, exits, server rooms, and perimeter boundaries. It acts as both a deterrent and a detection mechanism, enabling real-time observation and post-incident investigation. Surveillance footage supports incident response, forensic analysis, and compliance requirements.
Access control enforcement and multifactor authentication are primarily logical or administrative controls, while background checks are personnel security measures. Although important, they are not physical perimeter controls. Therefore, video surveillance capability is the correct answer.
質問 # 47
A company is interested in tokenization as an alternative to protecting data without encryption. The application will soon store the token. Which step should occur immediately before this action?
- A. The tokenization server returns the token to the application.
- B. Data is sent to the tokenization server.
- C. The tokenization server generates the token for the application.
- D. An authorized application requests the token.
正解：A
解説：
Before an application can store a token, it must first receive the token from the tokenization server.
Managing Cloud guidance outlines that tokenization workflows follow a defined sequence: the application submits sensitive data, the tokenization server generates a token, and then the token is returned to the application.
Only after the token has been successfully returned can the application replace the original sensitive data and store the token instead. This ensures that sensitive data is not retained within the application environment, reducing exposure and simplifying compliance requirements.
The other steps occur earlier in the process. An authorized application must request tokenization, and the sensitive data must be sent to the tokenization server before a token can be generated. Therefore, the immediate step before storing the token is the tokenization server returning the token to the application.
質問 # 48
An organization is concerned that it will be unable to recover or access data if the cloud provider goes into bankruptcy and leaves the market. How is this concern addressed in a business continuity and disaster recovery plan?
- A. Use best tools to securely connect to the cloud
- B. Enable multiple zones to mitigate service disruptions
- C. Revise contractual and personnel obligations
- D. Consider options for portability and interoperability
正解：D
解説：
This concern is addressed by considering portability and interoperability options. Managing Cloud guidance explains that organizations must plan for provider exit scenarios to avoid dependency risks.
Portability ensures data and workloads can be moved to another provider or on-premises environment, while interoperability supports compatibility across platforms. This may include standardized data formats, documented APIs, and offsite backups.
Multiple zones address outages, not provider bankruptcy. Contract revisions help legally but do not guarantee recovery. Therefore, portability and interoperability are the correct focus.
質問 # 49
Which risk relates to the removal of a person's information within the public cloud by legal authorities?
- A. Vendor lock-in
- B. Data seizure
- C. Remote wiping
- D. Data masking
正解：B
解説：
Data seizure is the risk associated with legal authorities removing or accessing a person's information stored in a public cloud. Managing Cloud guidance explains that cloud data is subject to the laws and legal processes of the jurisdiction in which it resides.
In some cases, government agencies may compel cloud service providers to disclose or seize data as part of legal investigations. This can occur without the data owner's direct involvement and may affect confidentiality, privacy, and business operations. Public cloud environments increase this risk because infrastructure is shared and often spans multiple jurisdictions.
Remote wiping is a data destruction technique, vendor lock-in relates to dependency on providers, and data masking protects sensitive data. Therefore, data seizure is the correct risk.
質問 # 50
A security analyst is tasked with compiling a report of all people who used a system between two dates. The thorough report must include information about how long and how often the system was used. Which information should the analyst ensure is in the report?
- A. User identifications and access timestamps
- B. User commands and error timestamps
- C. Informational logs and message of the day
- D. Environmental errors and 802.1x logs
正解：A
解説：
To provide a comprehensive report of system usage, the most important elements are user identifications (IDs) and access timestamps. These data points record who accessed the system, at what time, and for how long. Together, they allow the analyst to determine frequency and duration of use, which is essential for both operational auditing and security oversight.
Other options, such as informational logs or error logs, may provide context but do not directly answer the requirement of identifying users and usage patterns. For instance, 802.1x logs are related to network authentication, while commands or error timestamps reveal activity details but not the overall access history.
Collecting and analyzing IDs and timestamps supports compliance with regulatory frameworks like ISO
27001 and SOC 2, which require clear audit trails. It also provides accountability and supports investigations in case of unauthorized access or misuse. By including these elements, the analyst ensures the report meets internal and external requirements for system monitoring.
質問 # 51
Which item determines whether a server has the capacity and the instance allocation to meet a customer's requirements?
- A. Instance provider
- B. Cloud provider
- C. UniFi controller
- D. Cloud controller
正解：D
解説：
The cloud controller determines whether a server has sufficient capacity and appropriate instance allocation to meet customer requirements. Managing Cloud principles explain that the cloud controller manages resource scheduling, provisioning, and allocation across the cloud infrastructure.
It evaluates available compute, memory, storage, and network resources before assigning workloads to physical or virtual servers. This ensures that customer requests are fulfilled without overcommitting resources or degrading performance.
A cloud provider delivers services, an instance provider is not a standard cloud role, and a UniFi controller manages networking devices. Therefore, the cloud controller is the correct answer.
質問 # 52
An organization designing a data center wants the ability to quickly create and shut down virtual systems based on demand. Which concept describes this capability?
- A. High availability
- B. Ephemeral computing
- C. Maintenance mode
- D. Resource scheduling
正解：B
解説：
The capability to rapidly create and destroy virtual systems as demand fluctuates is known asephemeral computing. These short-lived resources are provisioned automatically when needed and decommissioned when demand subsides.
Resource scheduling helps allocate resources but does not imply temporary lifespans. High availability ensures continuous service, and maintenance mode is used for administrative tasks.
Ephemeral computing is central to elasticity in cloud environments, reducing costs and improving scalability.
For example, containers or serverless functions may run only while needed and then disappear. This model optimizes utilization, lowers expenses, and supports modern application architectures that demand agility.
質問 # 53
Which security control is a countermeasure against vendor lock-in and lock-out?
- A. Video surveillance
- B. Disk redundancy
- C. Training programs
- D. Offsite backups
正解：D
解説：
Offsite backups are an effective countermeasure against vendor lock-in and lock-out risks. Managing Cloud principles explain that maintaining copies of data outside a single cloud provider reduces dependency and ensures continued access if services become unavailable.
Offsite backups enable organizations to migrate data, recover from provider outages, or exit a provider relationship without losing critical information. This control supports business continuity, portability, and resilience.
Video surveillance addresses physical security, disk redundancy improves availability within the same provider, and training programs improve awareness but do not reduce dependency. Therefore, offsite backups are the correct security control.
質問 # 54
An organization needs to provide space where security administrators can centrally monitor network traffic and events and respond to threats or outages. What should the organization create?
- A. Security operations center (SOC)
- B. Disaster response team (DRT)
- C. Emergency response team (ERT)
- D. Network operations center (NOC)
正解：A
解説：
ASecurity Operations Center (SOC)is a centralized facility that allows administrators to monitor, detect, investigate, and respond to cybersecurity events in real time. SOC teams leverage tools such as SIEM (Security Information and Event Management), threat intelligence, and incident response playbooks.
ERTs and DRTs are teams focused on emergencies and disaster recovery, respectively, but they do not provide continuous monitoring. A NOC focuses on performance and availability of IT infrastructure but not on security threats.
By establishing a SOC, organizations ensure 24/7 visibility into security events, coordinated incident handling, and compliance with standards such as ISO 27001 and SOC 2. SOCs are essential in cloud environments where threats evolve rapidly, and centralized expertise is needed to minimize impact.
質問 # 55
......
最善な方法で問題集を使おう！練習テストならこれWGU Managing-Cloud-Security：https://jp.fast2test.com/Managing-Cloud-Security-premium-file.html
Managing-Cloud-Security問題集を無料提供しております！試験問題と解答：https://drive.google.com/open?id=1g7iIWbPi0-rtiE_ipYLA2M8ITgwfGRyU