The Planning phase of the software development life cycle (SDLC) includes creating user stories. Managing Cloud principles explain that user stories capture functional requirements from the end user's perspective and help define application behavior and priorities.
During planning, stakeholders collaborate to identify business needs, define scope, and establish development goals. User stories are used to guide development tasks and ensure alignment with customer expectations.
Designing focuses on architecture, developing involves coding, and defining establishes high-level objectives.
Therefore, planning is the correct SDLC phase for creating user stories.

Securing the hypervisor is the primary security measure that controls virtualization in the cloud. Managing Cloud principles explain that the hypervisor is the foundational component that enables multiple virtual machines to share the same physical hardware.
If the hypervisor is compromised, all hosted workloads are at risk. Therefore, securing the hypervisor through hardening, access control, patching, and monitoring is critical to maintaining isolation between virtual machines and preventing privilege escalation.
Monitoring and logging provide visibility, dedicated hosting reduces shared risk, and managing image assets supports consistency, but none directly control virtualization. Therefore, securing the hypervisor is the correct answer.

File storage is based on a hierarchical system. Managing Cloud principles explain that file storage organizes data using directories and subdirectories, forming a tree-like structure familiar to traditional file systems.
This hierarchy allows users and applications to navigate folders and files using paths. File storage is commonly used for shared file systems, home directories, and content repositories that require structured organization.
Block storage organizes data into fixed-size blocks without hierarchy, object storage uses flat addressing with metadata, and databases use structured tables. Therefore, file storage is the correct answer.

When sharing personal data with a trusted third party, organizations must ensure that the recipient understands and adheres to theorganization's privacy policy and handling practices. This ensures consistent treatment of personal information across entities and aligns with consent provided by individuals.
Audit results and contractual notices are internal matters, while federal laws define obligations but do not substitute for organizational policies. By explicitly sharing policies and practices, organizations reinforce accountability and ensure compliance with privacy regulations such as GDPR, HIPAA, or CCPA.
This communication sets expectations for data use, retention, and disclosure. It also provides a defensible framework in case of regulatory inquiries, showing that due diligence was performed when transferring data to third parties.

Runtime Application Self-Protection (RASP) prevents environments from being over-controlled with performance-degrading security measures. Managing Cloud guidance explains that RASP operates from within the application, monitoring behavior and responding to threats in real time.
Because RASP provides contextual awareness of application logic, it reduces the need for excessive external security controls such as heavy network filtering or constant scanning. This minimizes performance impact while maintaining effective protection against attacks like injection, unauthorized access, and misuse of application functions.
QoS manages traffic prioritization, DDoS describes an attack type, and IDS detects threats but does not prevent over-control. Therefore, RASP is the correct technology.