Managing-Cloud-Security Exam Dumps : WGU Managing Cloud Security (JY02, GZO1)

In the Software as a Service (SaaS) model, the cloud service provider bears the greatest responsibility for security. Managing Cloud documentation explains that in SaaS environments, the provider manages the application, operating system, middleware, infrastructure, and often many security controls.

Customers primarily focus on user access, data classification, and configuration of application-level settings, while the provider ensures platform availability, patching, vulnerability management, and infrastructure security. This shared responsibility model places the largest security burden on the provider in SaaS compared to other service models.

In PaaS and IaaS, customers assume increasing responsibility for securing operating systems, applications, and configurations. DBaaS still requires customer involvement in access control and data management. Therefore, SaaS is the correct answer.

The most effective way to protect network traffic from interception is Transport Layer Security (TLS). TLS provides confidentiality, integrity, and authentication by encrypting data as it travels between client and server. Unlike older protocols like SSL, which is now deprecated due to vulnerabilities, TLS is the industry-standard protocol endorsed by modern security frameworks.

Compression and password protection through GZ is not a reliable method, as it does not offer strong encryption or resistance against sophisticated interception attacks. GRE is a tunneling protocol and does not inherently provide encryption.

By implementing TLS, organizations ensure protection against on-path attacks, replay attacks, and packet sniffing. TLS also supports features such as forward secrecy and certificate-based authentication, ensuring both secure data transmission and mutual trust between endpoints. In compliance-driven industries like healthcare and finance, TLS is explicitly mandated for protecting sensitive information in transit.

The Information Security Plan is a key requirement of the Gramm-Leach-Bliley Act (GLBA) designed to protect private customer data. Managing Cloud guidance explains that GLBA requires financial institutions to develop, implement, and maintain a comprehensive written information security program.

This plan must describe administrative, technical, and physical safeguards used to protect customer information. It includes risk assessment, security controls, monitoring, and incident response procedures. The objective is to ensure the confidentiality and integrity of sensitive financial data throughout its lifecycle.

The other options are not explicit GLBA requirements. Independent audits and gap analyses may support compliance efforts but are not mandated components. Limited scope definition is not a GLBA safeguard. Therefore, the information security plan is the correct requirement.