WGU Managing Cloud Security (D320) Exam Questions

In Agile development, user stories are the standard way to capture requirements for new features or improvements. A user story describes the functionality from the perspective of the end user, ensuring that development aligns with business needs.

''Cases'' might refer to test cases, which validate requirements, but they are not used to describe them. Cookies are technical elements for web sessions, and notes are informal documentation.

User stories typically follow a format such as: ''As a [role], I want [goal] so that [benefit].'' This provides clarity, fosters communication between developers and stakeholders, and ensures that acceptance criteria can be defined and tested. Using stories as a requirement tool aligns with iterative, customer-focused release cycles.

Categorization is the process of systematically identifying and classifying files according to content and relevance. In preparation for a PCI DSS audit, it is critical to identify which files fall within scope---those that contain cardholder data or impact its security.

Normalization adjusts data format, tokenization substitutes sensitive data with tokens, and anonymization removes identifiers. While useful, none directly address the task of isolating ''relevant files'' for audit. Categorization ensures that files are grouped correctly, allowing auditors to focus on the proper scope and preventing unnecessary exposure of unrelated data.

This step aligns with PCI DSS requirements that limit scope to systems and data directly affecting cardholder data security. Proper categorization streamlines audits and demonstrates effective data governance.

Continuous monitoring is the control that allows organizations to actively verify that a cloud provider is fulfilling contractual and compliance obligations. This involves automated collection and analysis of operational, security, and performance data. It enables organizations to ensure that service-level agreements (SLAs) are being honored and that compliance requirements are being met in real time.

While regulatory oversight is provided by external authorities and incident management is reactive in nature, continuous monitoring is a proactive approach. It allows customers to maintain visibility into provider operations. Confidential computing focuses on data protection but does not verify contract adherence.

By employing continuous monitoring, organizations establish transparency and accountability. It also supports audit processes by providing evidence that controls remain effective over time. This reduces risk associated with outsourcing critical functions to a cloud provider and ensures resilience against potential provider-side failures.

Backups are only valuable if they can be successfully restored when needed. Testing backups on a periodic basis is the only reliable way to validate their viability. Simply storing backups without testing may create a false sense of security, because corruption, misconfiguration, or incomplete backup sets can go unnoticed until a disaster occurs.

Industry best practices, such as those recommended by NIST and ISO 27031, emphasize regular backup testing as part of disaster recovery and business continuity planning. Testing involves restoring data to a test environment, verifying its integrity, and ensuring that applications can use the restored data as expected.

Deleting, comparing, or replacing backups might help in managing storage efficiency, but these actions do not confirm whether the backups are usable. Periodic testing ensures alignment with company policy, regulatory requirements, and internal risk management controls. It also provides confidence to management that recovery objectives, such as RTO (Recovery Time Objective) and RPO (Recovery Point Objective), can be met.

The categories mentioned---relational, nonrelational, key-value, and document-oriented---refer to different types of databases. Relational databases (SQL) organize data into tables with rows and columns, nonrelational databases (NoSQL) provide flexibility for unstructured data, key-value stores map identifiers to values, and document-oriented databases manage data in formats such as JSON or BSON.

Object-based storage and volumes are alternative storage architectures but are not described by these categories. XML is a data format, not a storage type.

In the cloud, database services are offered as managed solutions, reducing the administrative burden on organizations. Properly managing database storage is critical for data governance, confidentiality, and compliance. Databases are also central to security strategies, where access control, encryption, and auditing are applied.

Thus, the correct answer is database storage, which encompasses multiple architectures that address different performance, scalability, and data management needs.