Get WGU Managing Cloud Security (JY02) Exam Practice Questions - Real and Updated

Answer : C

The Change Management Board (CMB), also called the Change Advisory Board (CAB), is the formal authority responsible for reviewing, assessing, and approving planned modifications to IT environments. This group ensures that proposed changes align with business objectives, do not introduce unnecessary risks, and comply with security and regulatory requirements.

Event management teams focus on monitoring events, problem management teams handle root-cause analysis, and executive boards provide strategic direction but are not operational approval authorities. Only the CMB has the explicit role of validating technical and security implications before implementation.

By involving the CMB, organizations enforce structured governance, minimize disruptions, and establish accountability. This practice is central in ITIL and ISO/IEC 20000 standards, ensuring that operational integrity and security are preserved during change cycles.

Answer : A

The described control is authorization, which occurs after authentication. Authorization determines what resources a user can access based on their role, attributes, or policies stored in an access control database.

Authentication confirms identity, but authorization validates permissions. WAFs protect applications from malicious traffic, and antispyware tools detect malware. Neither applies to access decisions.

By checking users against a database of permissions, the organization enforces the principle of least privilege, ensuring employees only access the resources necessary for their role. This strengthens data protection, reduces insider threats, and aligns with compliance requirements for access governance.

Answer : C

The capability to rapidly create and destroy virtual systems as demand fluctuates is known as ephemeral computing. These short-lived resources are provisioned automatically when needed and decommissioned when demand subsides.

Resource scheduling helps allocate resources but does not imply temporary lifespans. High availability ensures continuous service, and maintenance mode is used for administrative tasks.

Ephemeral computing is central to elasticity in cloud environments, reducing costs and improving scalability. For example, containers or serverless functions may run only while needed and then disappear. This model optimizes utilization, lowers expenses, and supports modern application architectures that demand agility.

Answer : D

Once a vendor has been chosen, the onboarding phase requires confirming contractual details and arranging technical agreements. This includes specifying encryption standards, data transfer methods, SLAs, and compliance responsibilities. These discussions establish a clear foundation for the partnership.

Auditing and monitoring occur later, during ongoing vendor management. Evaluating requirements and policies occurs earlier, during vendor selection. Terminating a relationship is an offboarding activity, not onboarding.

Clarifying technical and contractual details at onboarding ensures a secure, compliant, and efficient partnership. It reduces risks of miscommunication and enforces accountability from the beginning.

Answer : C

Multifactor Authentication (MFA) is a commonly mandated control for obtaining cybersecurity insurance. MFA requires users to present at least two independent factors---something they know (password), something they have (token), or something they are (biometrics). This significantly reduces the risk of unauthorized access due to stolen or weak credentials.

Network segmentation and application whitelisting are valuable, but they are not universal insurance requirements. TPM is a hardware component for securing local devices but does not protect remote access in distributed work models.

By enforcing MFA across VPNs, cloud services, email, and administrative interfaces, organizations demonstrate strong access control measures. Insurance providers recognize MFA as a foundational safeguard, reducing claims risk from credential-based breaches. This makes MFA both a compliance requirement and a best practice.