WGU D488 Cybersecurity Architecture and Engineering
Final Exam Test Bank Actual 2026/2027 with Detailed
Rationales | 100% Verified | Pass Guaranteed – A+
Graded
SECTION 1: Cybersecurity Architecture Fundamentals (Questions
1-12)
Q1: Which NIST publication provides the Framework for Improving Critical
Infrastructure Cybersecurity?
A. NIST SP 800-53
B. NIST SP 800-171
C. NIST Cybersecurity Framework (CSF) 1.1/2.0 [CORRECT]
D. NIST SP 800-37
Correct Answer: C
Rationale: The NIST Cybersecurity Framework (CSF) was specifically developed to
provide a risk-based approach for improving critical infrastructure cybersecurity,
organized around the five functions: Identify, Protect, Detect, Respond, and Recover.
Q2: In the Bell-LaPadula security model, which property prevents a subject at a
higher security level from writing to an object at a lower security level?
A. Simple Security Property (no read up)
B. *-Property (Star Property) (no write down)
C. Discretionary Security Property
D. Tranquility Property
Correct Answer: B
,Rationale: The *-Property (Star Property) prevents information flow from high to low
by restricting subjects from writing to objects at a lower classification, thereby
enforcing confidentiality through preventing write-down operations.
Q3: A security architect is designing a network where no user or device is trusted by
default, regardless of location or network perimeter. Which architecture model is
being implemented?
A. Defense-in-Depth
B. Perimeter-Based Security
C. Zero Trust Architecture [CORRECT]
D. Trusted Computing Base
Correct Answer: C
Rationale: Zero Trust Architecture operates on the principle of "never trust, always
verify," requiring continuous authentication and authorization for every access
request regardless of network location or prior trust status.
Q4: Which of the following best describes the primary purpose of the ISO/IEC 27001
standard?
A. Providing specific technical security controls
B. Establishing an Information Security Management System (ISMS)
C. Defining incident response procedures
D. Mandating encryption requirements
Correct Answer: B
Rationale: ISO/IEC 27001 specifies the requirements for establishing, implementing,
maintaining, and continually improving an Information Security Management System
(ISMS) within an organization.
Q5: In the Clark-Wilson integrity model, what mechanism ensures that data can only
be modified in allowed ways?
A. Access Control Lists
B. Well-Formed Transactions and Separation of Duties [CORRECT]
C. Mandatory Access Controls
D. Lattice-Based Controls
, Correct Answer: B
Rationale: The Clark-Wilson model enforces integrity through well-formed
transactions that constrain how data can be manipulated and separation of duties
that prevent any single user from corrupting the system.
Q6: A government agency needs to protect Top Secret data from unauthorized
disclosure while allowing authorized users to access information at their clearance
level. Which security model is MOST appropriate?
A. Biba Integrity Model
B. Bell-LaPadula Confidentiality Model [CORRECT]
C. Graham-Denning Model
D. Harrison-Ruzzo-Ullman Model
Correct Answer: B
Rationale: The Bell-LaPadula model is specifically designed to protect confidentiality
through its simple security property (no read up) and *-property (no write down),
making it ideal for military and government classification systems.
Q7: Which layer of the defense-in-depth strategy focuses on protecting individual
endpoints from malware and unauthorized access?
A. Perimeter Layer
B. Network Layer
C. Host Layer [CORRECT]
D. Application Layer
Correct Answer: C
Rationale: The host layer of defense-in-depth focuses on securing individual
endpoints through antivirus, host-based firewalls, patch management, and endpoint
detection and response (EDR) solutions.
Q8: During a security architecture review, an architect identifies that the system lacks
mechanisms to verify that security controls continue to operate correctly over time.
Which principle is being violated?
A. Least Privilege
B. Security by Design / Continuous Monitoring
C. Separation of Duties
Final Exam Test Bank Actual 2026/2027 with Detailed
Rationales | 100% Verified | Pass Guaranteed – A+
Graded
SECTION 1: Cybersecurity Architecture Fundamentals (Questions
1-12)
Q1: Which NIST publication provides the Framework for Improving Critical
Infrastructure Cybersecurity?
A. NIST SP 800-53
B. NIST SP 800-171
C. NIST Cybersecurity Framework (CSF) 1.1/2.0 [CORRECT]
D. NIST SP 800-37
Correct Answer: C
Rationale: The NIST Cybersecurity Framework (CSF) was specifically developed to
provide a risk-based approach for improving critical infrastructure cybersecurity,
organized around the five functions: Identify, Protect, Detect, Respond, and Recover.
Q2: In the Bell-LaPadula security model, which property prevents a subject at a
higher security level from writing to an object at a lower security level?
A. Simple Security Property (no read up)
B. *-Property (Star Property) (no write down)
C. Discretionary Security Property
D. Tranquility Property
Correct Answer: B
,Rationale: The *-Property (Star Property) prevents information flow from high to low
by restricting subjects from writing to objects at a lower classification, thereby
enforcing confidentiality through preventing write-down operations.
Q3: A security architect is designing a network where no user or device is trusted by
default, regardless of location or network perimeter. Which architecture model is
being implemented?
A. Defense-in-Depth
B. Perimeter-Based Security
C. Zero Trust Architecture [CORRECT]
D. Trusted Computing Base
Correct Answer: C
Rationale: Zero Trust Architecture operates on the principle of "never trust, always
verify," requiring continuous authentication and authorization for every access
request regardless of network location or prior trust status.
Q4: Which of the following best describes the primary purpose of the ISO/IEC 27001
standard?
A. Providing specific technical security controls
B. Establishing an Information Security Management System (ISMS)
C. Defining incident response procedures
D. Mandating encryption requirements
Correct Answer: B
Rationale: ISO/IEC 27001 specifies the requirements for establishing, implementing,
maintaining, and continually improving an Information Security Management System
(ISMS) within an organization.
Q5: In the Clark-Wilson integrity model, what mechanism ensures that data can only
be modified in allowed ways?
A. Access Control Lists
B. Well-Formed Transactions and Separation of Duties [CORRECT]
C. Mandatory Access Controls
D. Lattice-Based Controls
, Correct Answer: B
Rationale: The Clark-Wilson model enforces integrity through well-formed
transactions that constrain how data can be manipulated and separation of duties
that prevent any single user from corrupting the system.
Q6: A government agency needs to protect Top Secret data from unauthorized
disclosure while allowing authorized users to access information at their clearance
level. Which security model is MOST appropriate?
A. Biba Integrity Model
B. Bell-LaPadula Confidentiality Model [CORRECT]
C. Graham-Denning Model
D. Harrison-Ruzzo-Ullman Model
Correct Answer: B
Rationale: The Bell-LaPadula model is specifically designed to protect confidentiality
through its simple security property (no read up) and *-property (no write down),
making it ideal for military and government classification systems.
Q7: Which layer of the defense-in-depth strategy focuses on protecting individual
endpoints from malware and unauthorized access?
A. Perimeter Layer
B. Network Layer
C. Host Layer [CORRECT]
D. Application Layer
Correct Answer: C
Rationale: The host layer of defense-in-depth focuses on securing individual
endpoints through antivirus, host-based firewalls, patch management, and endpoint
detection and response (EDR) solutions.
Q8: During a security architecture review, an architect identifies that the system lacks
mechanisms to verify that security controls continue to operate correctly over time.
Which principle is being violated?
A. Least Privilege
B. Security by Design / Continuous Monitoring
C. Separation of Duties
