Download Full Version Managing-Cloud-Security WGU Exam

The STRIDE threat model identifies six categories: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. In this scenario, the accountant modified data they were not authorized to change. This is an act of Tampering, which refers to unauthorized alteration of data or systems.

Spoofing would involve impersonating another identity, denial of service would block availability, and elevation of privilege would involve gaining higher access rights. The accountant already had legitimate access but misused it to alter data outside their scope of responsibility.

Tampering compromises data integrity, one of the pillars of the CIA triad. In cloud and enterprise systems, safeguards against tampering include role-based access control, least privilege, and auditing to detect unauthorized changes. Recognizing this as tampering helps in identifying insider misuse and implementing compensating controls.

The requirement for a username, password, and security token describes authentication—the process of verifying the identity of a user. By requiring multiple factors (something you know + something you have), the organization is implementing multifactor authentication (MFA).

Authorization defines what resources a user can access after authentication. WAFs protect web applications, and ACLs specify rules for allowed or denied traffic, but neither validate user identity.

Authentication ensures that only legitimate users gain access to cloud resources. In hybrid environments, MFA is a strong safeguard against credential theft and phishing attacks, providing assurance that identities are genuine before authorization decisions are made.

File storage is based on a hierarchical system. Managing Cloud principles explain that file storage organizes data using directories and subdirectories, forming a tree-like structure familiar to traditional file systems.

This hierarchy allows users and applications to navigate folders and files using paths. File storage is commonly used for shared file systems, home directories, and content repositories that require structured organization.

Block storage organizes data into fixed-size blocks without hierarchy, object storage uses flat addressing with metadata, and databases use structured tables. Therefore, file storage is the correct answer.

A Web Application Firewall (WAF) includes anti-distributed denial of service (DDoS) capabilities designed to protect cloud-hosted applications and underlying data storage from availability-based attacks. Managing Cloud principles state that WAFs sit in front of web applications and analyze incoming traffic to identify and block malicious requests, including high-volume attack patterns characteristic of DDoS attacks.

By filtering traffic at the application layer, a WAF prevents excessive or malicious requests from overwhelming backend services such as cloud storage systems and databases. Many WAF solutions implement rate limiting, traffic profiling, and behavioral analysis to distinguish legitimate users from attackers, ensuring continued access to cloud resources.

The other options do not provide DDoS protection. An XML gateway focuses on validating and securing XML-based messages. NDAM and ADAM solutions monitor database activity but do not mitigate network-level or application-layer flood attacks. Therefore, the Web Application Firewall is the correct security device for providing anti-DDoS protection in cloud environments.