WGU Updated Managing-Cloud-Security Exam Questions and Answers by ela

A cloud service customer is the role that subscribes to a software as a service (SaaS) application. Managing Cloud principles define the cloud service customer as the individual or organization that consumes cloud services provided by a cloud service provider.

In a SaaS model, the customer accesses applications through a subscription-based arrangement, typically via a web interface. The customer does not manage the underlying infrastructure or platform but is responsible for configuring user access and ensuring proper use of the service.

The cloud service provider delivers and manages the application, while “cloud computing” and “cloud application” are not roles. Therefore, the cloud service customer is the correct role.

Provisioning is the first phase of identity management used to assert a user’s identity. Managing Cloud documentation explains that identity management begins with establishing and registering a user within an identity system. Provisioning involves creating a digital identity, assigning unique identifiers, and associating credentials that allow the user to be recognized by systems and applications.

This phase forms the foundation for all subsequent identity and access management processes. Without proper provisioning, authentication and authorization cannot occur because the system has no trusted identity to evaluate. Provisioning also includes defining initial roles and access levels based on organizational policies.

Centralization and decentralization describe architectural approaches to managing identities rather than lifecycle phases. Deprovisioning occurs at the end of the lifecycle when access is revoked. Therefore, provisioning is correctly identified as the first phase where the user’s identity is established and asserted.

By analyzing natural events that could impact data centers and assessing the risks associated with each, the leadership team is defining the disaster criteria. This step determines what conditions or events qualify as disasters requiring activation of the recovery plan.

An asset inventory identifies systems, but here the focus is on external events. A disaster declaration process occurs during an actual event, and identifying actions comes later when response strategies are created.

Defining disaster criteria is essential to avoid ambiguity during crises. It establishes thresholds such as “category 4 hurricanes,” “regional power outages exceeding 12 hours,” or “seismic events over a set magnitude.” Clear criteria ensure consistent decision-making and timely activation of recovery procedures.

Offsite backups are an effective countermeasure against vendor lock-in and lock-out risks. Managing Cloud principles explain that maintaining copies of data outside a single cloud provider reduces dependency and ensures continued access if services become unavailable.

Offsite backups enable organizations to migrate data, recover from provider outages, or exit a provider relationship without losing critical information. This control supports business continuity, portability, and resilience.

Video surveillance addresses physical security, disk redundancy improves availability within the same provider, and training programs improve awareness but do not reduce dependency. Therefore, offsite backups are the correct security control.