2025年最新の実際のManaging-Cloud-Security問題集最新WGU練習テスト問題集ゲット
Managing-Cloud-Security問題集PDFでManaging-Cloud-Securityリアル試験問題解答
質問 # 36
An organization is implementing a new hybrid cloud deployment and wants all employees to provide a username, password, and security token before accessing any of the cloud resources. Which type of security control is the organization leveraging for its employees?
- A. Access control list (ACL)
- B. Authentication
- C. Web application firewall (WAF)
- D. Authorization
正解：B
解説：
The requirement for a username, password, and security token describesauthentication-the process of verifying the identity of a user. By requiring multiple factors (something you know + something you have), the organization is implementing multifactor authentication (MFA).
Authorization defines what resources a user can access after authentication. WAFs protect web applications, and ACLs specify rules for allowed or denied traffic, but neither validate user identity.
Authentication ensures that only legitimate users gain access to cloud resources. In hybrid environments, MFA is a strong safeguard against credential theft and phishing attacks, providing assurance that identities are genuine before authorization decisions are made.
質問 # 37
Which setting ensures that an attacker cannot read the information stored temporarily for use by another virtual machine (VM)?
- A. Encrypted network protocols
- B. Dedicated processor
- C. Dedicated memory
- D. Encrypted file system
正解：C
解説：
Dedicated memoryallocation ensures isolation between virtual machines in a shared environment. Without memory isolation, remnants of one VM's operations might remain in physical memory and be accessible to another VM, leading to cross-tenant data leakage. Assigning dedicated memory prevents attackers from exploiting memory-sharing vulnerabilities.
Encrypted network protocols protect data in transit, not memory. Encrypted file systems safeguard storage, not volatile memory. A dedicated processor helps with performance and isolation of compute tasks but does not secure temporary memory contents.
Cloud environments are multi-tenant, which makes memory isolation a critical safeguard. By dedicating memory or enforcing strict hypervisor-level isolation, providers prevent data exposure between customers.
This aligns with best practices for virtualization security and the "resource pooling" characteristic of cloud computing, ensuring that shared infrastructure does not compromise confidentiality.
質問 # 38
An organization's help desk receives a call from a person claiming to be an employee wanting to verify their home address on file. The caller answers the basic authentication questions, so the help desk employee provides them the sensitive information. The organization later discovers that this call was fraudulent. Which type of threat does this represent?
- A. Man-in-the-middle attacks
- B. Social engineering
- C. Internal threats
- D. Escalation of privilege
正解：B
解説：
This is an example ofsocial engineering, where attackers manipulate individuals into divulging confidential information or performing actions that compromise security. In this case, the fraudulent caller convinced the help desk to disclose sensitive employee data.
Man-in-the-middle attacks involve intercepting communication between parties, escalation of privilege involves gaining higher access rights, and internal threats come from legitimate insiders. None of these fit the situation as accurately as social engineering.
Social engineering exploits human trust rather than technical vulnerabilities. Common tactics include phishing, pretexting, and phone-based fraud (vishing). Preventing such threats requires strong identity verification processes, employee awareness training, and layered authentication mechanisms. By recognizing the human element as a weak point, organizations can better prepare staff to resist manipulative tactics.
質問 # 39
An organization negotiates a new contract with a cloud provider and wants to ensure that its critical business data is protected if the cloud provider goes out of business. For this reason, the organization wants the cloud provider to store a copy of the organization's data with a neutral third party, which would release the data in case the provider is unable to meet its obligations. Which type of provision should be included in the contract to ensure this?
- A. Indemnification
- B. Escrow
- C. Encryption
- D. Offboarding
正解：B
解説：
The correct contractual safeguard is anescrow agreement. Data escrow involves storing critical data or software with a neutral third party, which can release it to the customer if the provider fails to meet obligations, such as bankruptcy or service discontinuation.
Indemnification covers liability, offboarding manages termination processes, and encryption secures data but does not ensure availability if the provider disappears.
Escrow provisions protect business continuity by guaranteeing customer access to data regardless of provider viability. They are especially important for organizations handling mission-critical workloads or long-term regulatory obligations in the cloud.
質問 # 40
Which term refers to taking an accurate account of a system's desired standard state so changes can be quickly detected for approval or remediation?
- A. Baselining
- B. Deployment
- C. Capacity management
- D. Patch management
正解：A
解説：
Baselining is the process of establishing a reference point for the standard configuration of systems, networks, or applications. This baseline represents the approved, secure state. By continuously comparing the current environment to the baseline, organizations can detect deviations, unauthorized changes, or misconfigurations.
Patch management involves updating systems, deployment refers to installing new systems, and capacity management focuses on resource planning. While important, these do not establish a standard state for comparison.
Baselining is essential for change management and security auditing. It supports configuration management databases (CMDBs), intrusion detection, and compliance requirements. When deviations are detected, they can be escalated for remediation or formally approved through change control processes.
質問 # 41
During a financial data investigation, the investigator is unsure how to handle a specific data set. Which set of documentation should they refer to for detailed steps on how to proceed?
- A. Policies
- B. Legal rulings
- C. Procedures
- D. Legal definitions
正解：C
解説：
Proceduresare detailed, step-by-step instructions that guide personnel on how to perform specific tasks in alignment with higher-level policies. In an investigation, when uncertainty arises about handling a dataset, procedures provide the exact operational guidance required.
Policies establish high-level rules (e.g., "financial data must be protected"), while procedures explain how to achieve compliance with those policies (e.g., "verify encryption, label dataset, log access, and escalate to compliance officer"). Legal rulings and definitions are external references but do not provide operational steps.
By following documented procedures, investigators ensure consistency, compliance, and defensibility in legal contexts. This also ensures that evidence is handled properly, supporting admissibility in court and protecting the organization against legal or regulatory challenges.
質問 # 42
Which data destruction technique involves encrypting the data, followed by encrypting the resulting keys with a different engine, and then destroying the keys resulting from the second encryption round?
- A. Cryptographic erasure
- B. Overwriting
- C. One-way hashing
- D. Degaussing
正解：A
解説：
Cryptographic erasure is a secure data sanitization technique that relies on encryption. The process involves encrypting the data, encrypting the keys with a second layer, and then destroying the encryption keys.
Without the keys, the encrypted data becomes unreadable and is effectively destroyed, even though the storage media remains intact.
One-way hashing is used for password storage, not full data destruction. Degaussing is for magnetic media, and overwriting involves physically writing new data over existing sectors.
Cryptographic erasure is widely used in cloud environments where physical media cannot be easily destroyed or reclaimed by customers. It ensures compliance with data retention and privacy regulations while maintaining environmental sustainability by allowing reuse of storage hardware.
質問 # 43
Which concept focuses on operating highly available workloads in the cloud?
- A. Security
- B. Operational excellence
- C. Reliability
- D. Resource hierarchy
正解：C
解説：
Reliabilityin cloud design ensures workloads can recover quickly from disruptions and continue operating as expected. This concept focuses on high availability, fault tolerance, and disaster recovery. Reliability requires implementing redundancy, backup strategies, and robust monitoring.
Security ensures data protection, operational excellence covers continuous improvement, and resource hierarchy refers to organizational structures, but none focus specifically on availability and resilience.
By prioritizing reliability, organizations design cloud architectures capable of withstanding failures at multiple layers-compute, storage, networking, and even regions. This design principle ensures customer trust and compliance with service-level agreements.
質問 # 44
After creating a backup set, an engineer stores the backups according to company policy. Which action should the engineer take periodically to ensure the backed-up data is viable?
- A. The engineer should compare the old backups with newer ones.
- B. The engineer should test the backups according to company policy.
- C. The engineer should delete backups according to company policy.
- D. The engineer should replace the old backups with newer ones.
正解：B
解説：
Backups are only valuable if they can be successfully restored when needed. Testing backups on a periodic basis is the only reliable way to validate their viability. Simply storing backups without testing may create a false sense of security, because corruption, misconfiguration, or incomplete backup sets can go unnoticed until a disaster occurs.
Industry best practices, such as those recommended by NIST and ISO 27031, emphasize regular backup testing as part of disaster recovery and business continuity planning. Testing involves restoring data to a test environment, verifying its integrity, and ensuring that applications can use the restored data as expected.
Deleting, comparing, or replacing backups might help in managing storage efficiency, but these actions do not confirm whether the backups are usable. Periodic testing ensures alignment with company policy, regulatory requirements, and internal risk management controls. It also provides confidence to management that recovery objectives, such as RTO (Recovery Time Objective) and RPO (Recovery Point Objective), can be met.
質問 # 45
An organization experienced an unplanned event. As a result, the customers using the web application face a loss of service. What does the incident generated in this situation seek to resolve?
- A. Bug
- B. Change
- C. Disruption
- D. Error
正解：C
解説：
The unplanned event described is adisruptionof service. In IT service management frameworks like ITIL, disruptions occur when an incident prevents normal service delivery. The goal of incident management is to restore service quickly and minimize impact on customers.
A bug refers to a software defect, which may cause disruptions but is not synonymous with the event itself.
An error represents a fault, while change refers to deliberate modifications. Only disruption captures the unplanned nature of service unavailability.
Recognizing incidents as disruptions helps organizations apply structured processes such as escalation, root- cause analysis, and communication. It ensures resilience in cloud-based environments where uptime is a key performance indicator and customer trust is closely tied to availability.
質問 # 46
An organization designing a data center wants the ability to quickly create and shut down virtual systems based on demand. Which concept describes this capability?
- A. Resource scheduling
- B. Ephemeral computing
- C. High availability
- D. Maintenance mode
正解：B
解説：
The capability to rapidly create and destroy virtual systems as demand fluctuates is known asephemeral computing. These short-lived resources are provisioned automatically when needed and decommissioned when demand subsides.
Resource scheduling helps allocate resources but does not imply temporary lifespans. High availability ensures continuous service, and maintenance mode is used for administrative tasks.
Ephemeral computing is central to elasticity in cloud environments, reducing costs and improving scalability.
For example, containers or serverless functions may run only while needed and then disappear. This model optimizes utilization, lowers expenses, and supports modern application architectures that demand agility.
質問 # 47
An organization is planning for an upcoming Payment Card Industry Data Security Standard (PCI DSS) audit and wants to ensure that only relevant files are included in the audit materials. Which process should the organization use to ensure that the relevant files are identified?
- A. Categorization
- B. Normalization
- C. Anonymization
- D. Tokenization
正解：A
解説：
Categorizationis the process of systematically identifying and classifying files according to content and relevance. In preparation for a PCI DSS audit, it is critical to identify which files fall within scope-those that contain cardholder data or impact its security.
Normalization adjusts data format, tokenization substitutes sensitive data with tokens, and anonymization removes identifiers. While useful, none directly address the task of isolating "relevant files" for audit.
Categorization ensures that files are grouped correctly, allowing auditors to focus on the proper scope and preventing unnecessary exposure of unrelated data.
This step aligns with PCI DSS requirements that limit scope to systems and data directly affecting cardholder data security. Proper categorization streamlines audits and demonstrates effective data governance.
質問 # 48
An organization is evaluating which cloud computing service model it should implement. It is considering either platform as a service (PaaS) or software as a service (SaaS). Which risk associated with SaaS can the organization avoid by choosing PaaS?
- A. Personnel threat
- B. Natural disaster
- C. Vendor lock-out
- D. Vendor lock-in
正解：D
解説：
WithSaaS, applications are delivered entirely by the provider, and customers have little to no control over the underlying platform or data portability. This creates a higher risk ofvendor lock-in, as migrating away from one SaaS provider to another may require reworking applications or losing features.
In contrast,PaaSgives customers more flexibility by allowing them to build, deploy, and manage their own applications while relying on standardized frameworks and platforms. Because applications are customer- managed, switching providers or migrating workloads can be easier compared to SaaS.
Vendor lock-out, personnel threats, and natural disasters are risks in any service model. The key differentiator here is portability and flexibility. Choosing PaaS reduces dependence on a single provider's application features, thereby lowering vendor lock-in risk while still offloading infrastructure management.
質問 # 49
As part of an e-discovery process, an employee needs to identify all documents that contain a specific phrase.
Which type of discovery method should the employee use to identify these documents?
- A. Location-based
- B. Metadata-based
- C. Content-based
- D. Label-based
正解：C
解説：
Content-based discoveryinvolves searching within the actual text or binary content of documents to find matches for keywords, phrases, or patterns. In e-discovery, when the requirement is to locate documents containing a specific phrase, searching based on content is the most direct and reliable method.
Other approaches, such as metadata-based discovery, only examine properties like creation date or author, which do not reveal the presence of specific text. Label-based discovery relies on pre-applied classification labels, which may not always be accurate. Location-based discovery limits searches to folders or storage locations but does not guarantee relevance.
Content-based discovery provides completeness in legal and regulatory investigations. It ensures that no relevant documents are overlooked simply because of inconsistent labeling or metadata, thus supporting compliance and defensibility in court proceedings.
質問 # 50
A group of DevOps engineers adopted the network-as-code methodology to manage network infrastructure.
During a code release, the engineers find a bug that is causing issues on a production site. Which safeguard will allow the engineers to restore functionality to the production site?
- A. Staging
- B. Code testing
- C. Code review
- D. Rollback
正解：D
解説：
Arollbackis the safeguard that restores a system to its previous, stable state when a new code release introduces issues. In DevOps workflows, rollbacks provide a rapid recovery mechanism, reducing downtime and minimizing customer impact.
Staging, code review, and testing are preventive controls that reduce the likelihood of defects reaching production, but once a bug has already been deployed, rollback is the corrective control.
Rollback strategies often rely on version control systems, container orchestration, or infrastructure-as-code automation to quickly revert to earlier configurations. This practice is essential for maintaining reliability and availability, especially in cloud environments with continuous deployment pipelines.
質問 # 51
Which category of cloud service provides on-demand, self-service access to basic building blocks, such as virtualized servers, block storage, and networking capacity, that can be used to create custom IT solutions?
- A. Networking as a service (NaaS)
- B. Software as a service (SaaS)
- C. Platform as a service (PaaS)
- D. Infrastructure as a service (IaaS)
正解：D
解説：
Infrastructure as a Service (IaaS) delivers fundamental computing resources over the cloud. These include virtual machines, block storage, networking, and load balancers. Customers use these resources to build and manage custom IT solutions, while the provider manages the underlying hardware.
PaaS abstracts infrastructure further, providing a development environment for applications without requiring infrastructure management. SaaS delivers fully functional applications over the internet. NaaS is a narrower category focusing on network delivery.
IaaS is the correct answer because it gives maximum flexibility and control compared to the other models, allowing organizations to build tailored environments. It also requires customers to manage operating systems, middleware, and runtime security, making shared responsibility an essential part of the model.
質問 # 52
An organization is implementing a new hybrid cloud deployment. Before granting access to any of the resources, the security team wants to ensure that all employees are checked against a database to see if they are allowed to access the requested resource. Which type of security control is the organization leveraging for its employees?
- A. Web application firewall (WAF)
- B. Authentication
- C. Antispyware program
- D. Authorization
正解：D
解説：
The described control isauthorization, which occurs after authentication. Authorization determines what resources a user can access based on their role, attributes, or policies stored in an access control database.
Authentication confirms identity, but authorization validates permissions. WAFs protect applications from malicious traffic, and antispyware tools detect malware. Neither applies to access decisions.
By checking users against a database of permissions, the organization enforces the principle of least privilege, ensuring employees only access the resources necessary for their role. This strengthens data protection, reduces insider threats, and aligns with compliance requirements for access governance.
質問 # 53
An organization is sharing personal information that is defined in its privacy policy with a trusted third party.
What else should the organization communicate to the trusted third party about the personal information?
- A. The results of the organization's most recent privacy audit
- B. The organization's privacy policy and handling practices
- C. A copy of federal privacy laws regarding unauthorized data disclosure
- D. A notice of any contractual obligations that do not align with the privacy policy
正解：B
解説：
When sharing personal data with a trusted third party, organizations must ensure that the recipient understands and adheres to theorganization's privacy policy and handling practices. This ensures consistent treatment of personal information across entities and aligns with consent provided by individuals.
Audit results and contractual notices are internal matters, while federal laws define obligations but do not substitute for organizational policies. By explicitly sharing policies and practices, organizations reinforce accountability and ensure compliance with privacy regulations such as GDPR, HIPAA, or CCPA.
This communication sets expectations for data use, retention, and disclosure. It also provides a defensible framework in case of regulatory inquiries, showing that due diligence was performed when transferring data to third parties.
質問 # 54
Which type of storage includes categories such as relational, nonrelational, key-value, and document-oriented?
- A. Volume
- B. Object-based
- C. XML
- D. Database
正解：D
解説：
The categories mentioned-relational, nonrelational, key-value, and document-oriented-refer to different types of databases. Relational databases (SQL) organize data into tables with rows and columns, nonrelational databases (NoSQL) provide flexibility for unstructured data, key-value stores map identifiers to values, and document-oriented databases manage data in formats such as JSON or BSON.
Object-based storage and volumes are alternative storage architectures but are not described by these categories. XML is a data format, not a storage type.
In the cloud, database services are offered as managed solutions, reducing the administrative burden on organizations. Properly managing database storage is critical for data governance, confidentiality, and compliance. Databases are also central to security strategies, where access control, encryption, and auditing are applied.
Thus, the correct answer is database storage, which encompasses multiple architectures that address different performance, scalability, and data management needs.
質問 # 55
When should a cloud service provider delete customer data?
- A. When the cloud provider oversubscribes its storage space
- B. When the data has not been accessed in the last 30 days
- C. After a scheduled data review
- D. After the specified retention period
正解：D
解説：
The correct time for data deletion isafter the specified retention perioddefined by contractual agreements, regulatory frameworks, or internal policies. Retention policies ensure that data is kept for as long as necessary for business, legal, or compliance reasons but not longer than required.
Oversubscription, inactivity, or review cycles are not valid triggers because they may conflict with compliance mandates such as GDPR, HIPAA, or PCI DSS. Deleting data prematurely could result in legal penalties or business risks, while keeping it longer than necessary could increase exposure.
By deleting data only after the retention period, providers demonstrate adherence to data governance principles and protect customer rights while minimizing storage costs and liability.
質問 # 56
An organization is going through the process of selecting a new enterprise resource management (ERM) vendor. The organization has already selected the vendor and is now preparing to go through the onboarding process. Which specific issues should be discussed between the organization and the vendor during this phase?
- A. Deciding how to respond to the request for proposal (RFP)
- B. Identifying the business need the vendor will address
- C. Ensuring the vendor has securely destroyed all confidential information
- D. Verifying the details of the contract and arrangements for data transfer
正解：D
解説：
Once a vendor has been selected, the onboarding phase requirescontractual verification and technical arrangements for data transfer. This step ensures that service levels, compliance requirements, encryption standards, and responsibilities are clearly defined before operations begin.
Options such as identifying the business need or responding to the RFP are pre-selection activities. Ensuring secure destruction of data is relevant to offboarding, not onboarding. Therefore, the most critical onboarding task is verifying the contract details and ensuring secure data transfer agreements.
Discussing these issues protects the organization from legal disputes, ensures smooth technical integration, and supports compliance with frameworks such as GDPR and PCI DSS. It also defines the scope of vendor accountability in case of security incidents.
質問 # 57
......
Managing-Cloud-Securityプレミアム試験エンジンPDFをダウンロード：https://jp.fast2test.com/Managing-Cloud-Security-premium-file.html
Managing-Cloud-Security試験 [2025] 問題集でWGUのPDF問題：https://drive.google.com/open?id=13eVi7ixpxFoDdKjVFnRxQvGYPwohVewm