D320/ C838 OBJECTIVE ASSESSMENT FINAL NEWEST
2026 ACTUAL EXAM TEST BANK| WGU D320/ C838 OA
FINAL WITH COMPLETE 650 REAL EXAM — 200
Questions
Section 1: Cloud Concepts and Models (Questions 1-20)
1 A financial services firm is migrating a legacy monolithic trading application to the cloud. The application
requires low-latency access to market data and must comply with strict regulatory auditing. The CTO proposes
using a combination of on-premises infrastructure for latency-sensitive components and a public cloud for
compute-intensive risk analytics. Which deployment model best describes this architecture?
A) Community cloud
B) Hybrid cloud
C) Multi-cloud
D) Distributed cloud
Answer: B
Rationale: A hybrid cloud combines on-premises private cloud (or dedicated infrastructure) with public cloud
resources, connected via orchestration. This matches the scenario where latency-sensitive components remain
on-premises while analytics run in the public cloud. Multi-cloud involves multiple public cloud providers but not
on-premises. Community cloud is shared by several organizations with common concerns. Distributed cloud
distributes public cloud services to different physical locations but remains under the provider's control.
2 A company deploys a web application using a Platform as a Service (PaaS) offering. The developer configures
auto-scaling based on CPU utilization. Which of the following is a key limitation of PaaS that the developer
must account for in this architecture?
A) Inability to scale horizontally beyond a single instance
B) Limited control over the underlying operating system and runtime environment
C) Vendor lock-in due to proprietary APIs that prevent migration to other PaaS providers
D) Requirement to manage virtual machines and network configurations manually
Answer: B
Rationale: PaaS abstracts the underlying infrastructure, meaning the developer cannot modify the OS or runtime
environment. This limits custom configurations and debugging at the OS level. Horizontal scaling is typically
supported in PaaS. Vendor lock-in can occur but is not an inherent limitation of PaaS itself—it's a risk. Managing
VMs and networks is characteristic of IaaS, not PaaS.
3 In the context of the shared responsibility model for Infrastructure as a Service (IaaS), which of the following
responsibilities is explicitly assigned to the cloud customer?
A) Physical security of data centers
B) Network infrastructure maintenance
C) Hypervisor security patching
D) Encryption of data at rest within guest operating systems
Answer: D
Rationale: In IaaS, the customer is responsible for securing data within the guest OS, including encryption of data at
rest stored on virtual disks. The provider handles physical security, network infrastructure, and hypervisor
,patching. This division is a core tenet of the shared responsibility model.
4 A startup is building a real-time data processing pipeline that ingests streaming data from IoT devices. The
pipeline must automatically scale to handle variable throughput and minimize idle resource costs. Which cloud
service model is most appropriate for deploying the compute component of this pipeline?
A) Infrastructure as a Service (IaaS) with pre-provisioned virtual machines
B) Platform as a Service (PaaS) with a managed stream processing framework
C) Software as a Service (SaaS) for data analytics
D) Function as a Service (FaaS) with event-driven triggers
Answer: D
Rationale: FaaS (serverless) is ideal for event-driven, variable workloads because it scales automatically to zero
when idle and charges only for execution time. IaaS with pre-provisioned VMs would incur costs even when idle
and requires manual scaling. PaaS manages the platform but may still have minimum resource allocation. SaaS is a
complete application, not a compute component for custom processing.
5 An organization deploys a multi-cloud strategy using AWS for compute and Azure for data analytics. They want
to use a single identity and access management (IAM) system across both providers. Which architectural
approach is most suitable?
A) Federated identity using SAML 2.0 with an on-premises identity provider
B) Separate IAM configurations in each cloud with manual synchronization
C) Using a third-party cloud access security broker (CASB) that proxies all authentication
D) Deploying a virtual private network (VPN) between the clouds and using Active Directory replication
Answer: A
Rationale: Federated identity (e.g., SAML 2.0) allows a single identity provider to assert authentication across
multiple cloud providers, enabling centralized IAM. Separate IAM configurations create management overhead and
inconsistency. CASBs focus on security policy enforcement, not identity federation. VPN and AD replication can
help but do not provide unified IAM across clouds.
6 A company is evaluating cloud providers for a global application that must serve users in regions with strict data
sovereignty laws. The application must process personal data within the country of origin. Which deployment
model ensures data residency compliance while leveraging cloud benefits?
A) Public cloud with a single global region
B) Private cloud hosted in a colocation facility within each country
C) Community cloud shared with other organizations in the same industry
D) Hybrid cloud with on-premises data centers in each country
Answer: B
Rationale: A private cloud hosted within each country allows full control over data location and compliance with
data sovereignty laws. Public cloud with a single region does not guarantee data stays within required boundaries.
Community cloud may not offer per-country isolation. Hybrid cloud with on-premises data centers is feasible but
may not provide the same elasticity and managed services as a private cloud hosted by a provider.
7 Which of the following best describes the difference between vertical scaling and horizontal scaling in cloud
computing?
A) Vertical scaling adds more resources to a single node, while horizontal scaling adds more nodes to a system.
B) Vertical scaling is always more cost-effective than horizontal scaling for stateless applications.
C) Horizontal scaling is limited by the maximum capacity of a single server, while vertical scaling is limited by
the number of available nodes.
,D) Vertical scaling requires application rearchitecture to distribute load, while horizontal scaling does not.
Answer: A
Rationale: Vertical scaling (scale up) increases the capacity of a single node (e.g., more CPU, RAM). Horizontal
scaling (scale out) adds more nodes to distribute load. Horizontal scaling is often more cost-effective for stateless
apps because it uses commodity hardware. Horizontal scaling is limited by the number of nodes, not single server
capacity. Vertical scaling does not require rearchitecture; horizontal scaling often does to handle distributed state.
8 A cloud architect is designing a disaster recovery plan for a critical application. The primary site runs in a public
cloud region, and the recovery site must be in a different geographic region. The RTO is 15 minutes, and the
RPO is 1 minute. Which replication strategy best meets these requirements?
A) Asynchronous replication with periodic snapshots every 5 minutes
B) Synchronous replication with continuous data replication
C) Backup to object storage with cross-region replication enabled
D) Pilot light configuration with data replication every hour
Answer: B
Rationale: Synchronous replication ensures that data is written to both sites before acknowledging the write,
achieving an RPO of near zero. For an RPO of 1 minute, asynchronous replication with 5-minute snapshots is too
slow. Backup to object storage may take longer to restore. Pilot light with hourly replication cannot meet the RPO.
9 Which of the following is a primary advantage of using containers over virtual machines in a cloud
environment?
A) Containers provide stronger isolation between workloads than virtual machines.
B) Containers share the host OS kernel, resulting in faster startup times and lower overhead.
C) Containers can run directly on bare metal without a hypervisor, reducing hardware costs.
D) Containers are inherently more secure than virtual machines due to reduced attack surface.
Answer: B
Rationale: Containers share the host OS kernel, which makes them lightweight and fast to start compared to VMs
that include a full guest OS. VMs provide stronger isolation because each has its own kernel and hypervisor layer.
Containers typically run on top of an OS, not directly on bare metal. Security is not inherently better; container
escape vulnerabilities exist.
10 A company wants to migrate its on-premises virtualized workloads to the cloud while minimizing changes to
existing management tools and processes. The workloads include legacy applications that require static IP
addresses and dedicated network segments. Which cloud service model is most appropriate?
A) Software as a Service (SaaS)
B) Platform as a Service (PaaS)
C) Infrastructure as a Service (IaaS)
D) Function as a Service (FaaS)
Answer: C
Rationale: IaaS provides virtualized infrastructure (VMs, networks, storage) that closely resembles on-premises
environments, allowing lift-and-shift migration with minimal changes. Customers can configure static IPs and
network segments. PaaS and SaaS abstract infrastructure, limiting control. FaaS is for event-driven code, not full
VM migration.
, 11 A multinational corporation is migrating its on-premises infrastructure to a public cloud provider. The security
team requires that all data stored in the cloud be encrypted at rest using customer-managed keys, and that the
cloud provider cannot access these keys under any circumstances. Which cloud service model is most
appropriate for this requirement?
A) Infrastructure as a Service (IaaS) with a hardware security module (HSM) integrated into the provider's key
management service
B) Platform as a Service (PaaS) with a customer-managed key encryption add-on
C) Software as a Service (SaaS) with a bring-your-own-key (BYOK) feature
D) Infrastructure as a Service (IaaS) with an on-premises HSM and a cloud-based key management proxy
Answer: D
Rationale: The requirement that the cloud provider cannot access the keys means the keys must be stored and
managed entirely outside the provider's infrastructure. Option D achieves this by using an on-premises HSM with a
proxy that allows the cloud to use the keys without the provider ever having direct access. Options A, B, and C all
involve the provider's key management service, which inherently gives the provider potential access to the keys.
12 A DevOps team is designing a cloud-native application that requires automatic scaling based on real-time
demand, with no manual intervention. The application must also maintain high availability across multiple
geographic regions. Which cloud deployment model best supports these requirements?
A) Private cloud with a cluster of virtual machines in a single data center
B) Public cloud with serverless computing and a global load balancer
C) Hybrid cloud with on-premises burst capacity
D) Community cloud shared among several organizations with similar compliance needs
Answer: B
Rationale: Serverless computing (e.g., AWS Lambda, Azure Functions) automatically scales based on demand
without manual intervention, and a global load balancer can distribute traffic across multiple regions for high
availability. A private cloud (A) typically has limited scalability and geographic redundancy. Hybrid cloud (C) may
require manual scaling decisions. Community cloud (D) is not optimized for automatic scaling or multi-region
availability.
13 A university research team needs to run a high-performance computing (HPC) workload that requires
low-latency inter-node communication. The workload is expected to run for several weeks. Which cloud
computing characteristic is most critical for this scenario?
A) On-demand self-service
B) Rapid elasticity
C) Resource pooling
D) Measured service
Answer: A
Rationale: While all are important, on-demand self-service allows the research team to provision and configure the
HPC cluster without human interaction with the provider, which is essential for quickly setting up the environment
for a long-running job. Rapid elasticity (B) is more relevant for workloads with variable demand. Resource pooling
(C) is a provider-side feature. Measured service (D) is for billing and optimization.
14 A company is evaluating cloud providers for a deployment that must comply with the Payment Card Industry
Data Security Standard (PCI DSS). The provider must be able to demonstrate that the underlying infrastructure
is audited and certified for PCI DSS compliance. Which concept is most relevant?
A) Shared responsibility model
B) Service-level agreement (SLA)
2026 ACTUAL EXAM TEST BANK| WGU D320/ C838 OA
FINAL WITH COMPLETE 650 REAL EXAM — 200
Questions
Section 1: Cloud Concepts and Models (Questions 1-20)
1 A financial services firm is migrating a legacy monolithic trading application to the cloud. The application
requires low-latency access to market data and must comply with strict regulatory auditing. The CTO proposes
using a combination of on-premises infrastructure for latency-sensitive components and a public cloud for
compute-intensive risk analytics. Which deployment model best describes this architecture?
A) Community cloud
B) Hybrid cloud
C) Multi-cloud
D) Distributed cloud
Answer: B
Rationale: A hybrid cloud combines on-premises private cloud (or dedicated infrastructure) with public cloud
resources, connected via orchestration. This matches the scenario where latency-sensitive components remain
on-premises while analytics run in the public cloud. Multi-cloud involves multiple public cloud providers but not
on-premises. Community cloud is shared by several organizations with common concerns. Distributed cloud
distributes public cloud services to different physical locations but remains under the provider's control.
2 A company deploys a web application using a Platform as a Service (PaaS) offering. The developer configures
auto-scaling based on CPU utilization. Which of the following is a key limitation of PaaS that the developer
must account for in this architecture?
A) Inability to scale horizontally beyond a single instance
B) Limited control over the underlying operating system and runtime environment
C) Vendor lock-in due to proprietary APIs that prevent migration to other PaaS providers
D) Requirement to manage virtual machines and network configurations manually
Answer: B
Rationale: PaaS abstracts the underlying infrastructure, meaning the developer cannot modify the OS or runtime
environment. This limits custom configurations and debugging at the OS level. Horizontal scaling is typically
supported in PaaS. Vendor lock-in can occur but is not an inherent limitation of PaaS itself—it's a risk. Managing
VMs and networks is characteristic of IaaS, not PaaS.
3 In the context of the shared responsibility model for Infrastructure as a Service (IaaS), which of the following
responsibilities is explicitly assigned to the cloud customer?
A) Physical security of data centers
B) Network infrastructure maintenance
C) Hypervisor security patching
D) Encryption of data at rest within guest operating systems
Answer: D
Rationale: In IaaS, the customer is responsible for securing data within the guest OS, including encryption of data at
rest stored on virtual disks. The provider handles physical security, network infrastructure, and hypervisor
,patching. This division is a core tenet of the shared responsibility model.
4 A startup is building a real-time data processing pipeline that ingests streaming data from IoT devices. The
pipeline must automatically scale to handle variable throughput and minimize idle resource costs. Which cloud
service model is most appropriate for deploying the compute component of this pipeline?
A) Infrastructure as a Service (IaaS) with pre-provisioned virtual machines
B) Platform as a Service (PaaS) with a managed stream processing framework
C) Software as a Service (SaaS) for data analytics
D) Function as a Service (FaaS) with event-driven triggers
Answer: D
Rationale: FaaS (serverless) is ideal for event-driven, variable workloads because it scales automatically to zero
when idle and charges only for execution time. IaaS with pre-provisioned VMs would incur costs even when idle
and requires manual scaling. PaaS manages the platform but may still have minimum resource allocation. SaaS is a
complete application, not a compute component for custom processing.
5 An organization deploys a multi-cloud strategy using AWS for compute and Azure for data analytics. They want
to use a single identity and access management (IAM) system across both providers. Which architectural
approach is most suitable?
A) Federated identity using SAML 2.0 with an on-premises identity provider
B) Separate IAM configurations in each cloud with manual synchronization
C) Using a third-party cloud access security broker (CASB) that proxies all authentication
D) Deploying a virtual private network (VPN) between the clouds and using Active Directory replication
Answer: A
Rationale: Federated identity (e.g., SAML 2.0) allows a single identity provider to assert authentication across
multiple cloud providers, enabling centralized IAM. Separate IAM configurations create management overhead and
inconsistency. CASBs focus on security policy enforcement, not identity federation. VPN and AD replication can
help but do not provide unified IAM across clouds.
6 A company is evaluating cloud providers for a global application that must serve users in regions with strict data
sovereignty laws. The application must process personal data within the country of origin. Which deployment
model ensures data residency compliance while leveraging cloud benefits?
A) Public cloud with a single global region
B) Private cloud hosted in a colocation facility within each country
C) Community cloud shared with other organizations in the same industry
D) Hybrid cloud with on-premises data centers in each country
Answer: B
Rationale: A private cloud hosted within each country allows full control over data location and compliance with
data sovereignty laws. Public cloud with a single region does not guarantee data stays within required boundaries.
Community cloud may not offer per-country isolation. Hybrid cloud with on-premises data centers is feasible but
may not provide the same elasticity and managed services as a private cloud hosted by a provider.
7 Which of the following best describes the difference between vertical scaling and horizontal scaling in cloud
computing?
A) Vertical scaling adds more resources to a single node, while horizontal scaling adds more nodes to a system.
B) Vertical scaling is always more cost-effective than horizontal scaling for stateless applications.
C) Horizontal scaling is limited by the maximum capacity of a single server, while vertical scaling is limited by
the number of available nodes.
,D) Vertical scaling requires application rearchitecture to distribute load, while horizontal scaling does not.
Answer: A
Rationale: Vertical scaling (scale up) increases the capacity of a single node (e.g., more CPU, RAM). Horizontal
scaling (scale out) adds more nodes to distribute load. Horizontal scaling is often more cost-effective for stateless
apps because it uses commodity hardware. Horizontal scaling is limited by the number of nodes, not single server
capacity. Vertical scaling does not require rearchitecture; horizontal scaling often does to handle distributed state.
8 A cloud architect is designing a disaster recovery plan for a critical application. The primary site runs in a public
cloud region, and the recovery site must be in a different geographic region. The RTO is 15 minutes, and the
RPO is 1 minute. Which replication strategy best meets these requirements?
A) Asynchronous replication with periodic snapshots every 5 minutes
B) Synchronous replication with continuous data replication
C) Backup to object storage with cross-region replication enabled
D) Pilot light configuration with data replication every hour
Answer: B
Rationale: Synchronous replication ensures that data is written to both sites before acknowledging the write,
achieving an RPO of near zero. For an RPO of 1 minute, asynchronous replication with 5-minute snapshots is too
slow. Backup to object storage may take longer to restore. Pilot light with hourly replication cannot meet the RPO.
9 Which of the following is a primary advantage of using containers over virtual machines in a cloud
environment?
A) Containers provide stronger isolation between workloads than virtual machines.
B) Containers share the host OS kernel, resulting in faster startup times and lower overhead.
C) Containers can run directly on bare metal without a hypervisor, reducing hardware costs.
D) Containers are inherently more secure than virtual machines due to reduced attack surface.
Answer: B
Rationale: Containers share the host OS kernel, which makes them lightweight and fast to start compared to VMs
that include a full guest OS. VMs provide stronger isolation because each has its own kernel and hypervisor layer.
Containers typically run on top of an OS, not directly on bare metal. Security is not inherently better; container
escape vulnerabilities exist.
10 A company wants to migrate its on-premises virtualized workloads to the cloud while minimizing changes to
existing management tools and processes. The workloads include legacy applications that require static IP
addresses and dedicated network segments. Which cloud service model is most appropriate?
A) Software as a Service (SaaS)
B) Platform as a Service (PaaS)
C) Infrastructure as a Service (IaaS)
D) Function as a Service (FaaS)
Answer: C
Rationale: IaaS provides virtualized infrastructure (VMs, networks, storage) that closely resembles on-premises
environments, allowing lift-and-shift migration with minimal changes. Customers can configure static IPs and
network segments. PaaS and SaaS abstract infrastructure, limiting control. FaaS is for event-driven code, not full
VM migration.
, 11 A multinational corporation is migrating its on-premises infrastructure to a public cloud provider. The security
team requires that all data stored in the cloud be encrypted at rest using customer-managed keys, and that the
cloud provider cannot access these keys under any circumstances. Which cloud service model is most
appropriate for this requirement?
A) Infrastructure as a Service (IaaS) with a hardware security module (HSM) integrated into the provider's key
management service
B) Platform as a Service (PaaS) with a customer-managed key encryption add-on
C) Software as a Service (SaaS) with a bring-your-own-key (BYOK) feature
D) Infrastructure as a Service (IaaS) with an on-premises HSM and a cloud-based key management proxy
Answer: D
Rationale: The requirement that the cloud provider cannot access the keys means the keys must be stored and
managed entirely outside the provider's infrastructure. Option D achieves this by using an on-premises HSM with a
proxy that allows the cloud to use the keys without the provider ever having direct access. Options A, B, and C all
involve the provider's key management service, which inherently gives the provider potential access to the keys.
12 A DevOps team is designing a cloud-native application that requires automatic scaling based on real-time
demand, with no manual intervention. The application must also maintain high availability across multiple
geographic regions. Which cloud deployment model best supports these requirements?
A) Private cloud with a cluster of virtual machines in a single data center
B) Public cloud with serverless computing and a global load balancer
C) Hybrid cloud with on-premises burst capacity
D) Community cloud shared among several organizations with similar compliance needs
Answer: B
Rationale: Serverless computing (e.g., AWS Lambda, Azure Functions) automatically scales based on demand
without manual intervention, and a global load balancer can distribute traffic across multiple regions for high
availability. A private cloud (A) typically has limited scalability and geographic redundancy. Hybrid cloud (C) may
require manual scaling decisions. Community cloud (D) is not optimized for automatic scaling or multi-region
availability.
13 A university research team needs to run a high-performance computing (HPC) workload that requires
low-latency inter-node communication. The workload is expected to run for several weeks. Which cloud
computing characteristic is most critical for this scenario?
A) On-demand self-service
B) Rapid elasticity
C) Resource pooling
D) Measured service
Answer: A
Rationale: While all are important, on-demand self-service allows the research team to provision and configure the
HPC cluster without human interaction with the provider, which is essential for quickly setting up the environment
for a long-running job. Rapid elasticity (B) is more relevant for workloads with variable demand. Resource pooling
(C) is a provider-side feature. Measured service (D) is for billing and optimization.
14 A company is evaluating cloud providers for a deployment that must comply with the Payment Card Industry
Data Security Standard (PCI DSS). The provider must be able to demonstrate that the underlying infrastructure
is audited and certified for PCI DSS compliance. Which concept is most relevant?
A) Shared responsibility model
B) Service-level agreement (SLA)
