WGU D488 Final Exam Test Bank (Latest Update 2026/2027) Cybersecurity
Architecture and Engineering | Questions and Answers | Grade A | 100%
Correct (Verified Solutions) 2026/2027
OBJECTIVE ASSESSMENT - EXAM
WGU D488 Final Exam Test Bank
(Latest Update 2026/2027)
Cybersecurity Architecture and
Engineering | Questions and
Answers | Grade A | 100% Correct
(Verified Solutions) 2026/2027
D488
100 100%
QUESTIONS VERIFIED ANSWERS EDITION
TOPICS COVERED
Cybersecurity Architecture Risk Management & Compliance
Security Engineering Principles Incident Response & Recovery
Network Security & Defense
COVER PAGE - 1
, SECTION 1 | Cybersecurity Architecture | Q1-Q20 | WGU D488 Final Exam Test Bank (Latest Update
2026/2027) Cybersecurity Architecture and Engineering | Questions and Answers | Grade A | 100%
Correct (Verified Solutions) 2026/2027 2026/2027
Q1 Question 1 of 100
A regional hospital network recently experienced a ransomware breach that propagated from a
compromised workstation to critical patient records. The post-incident review revealed that a single
point of failure at the endpoint level allowed lateral movement with no intermediate barriers to slow or
stop the attack. The security architect must recommend a structural improvement that introduces
multiple independent protective barriers between potential entry points and high-value assets.
A. Deploying concentric layers of administrative, technical, and physical controls so that no single
control failure exposes the entire environment
B. Implementing a host-based intrusion prevention system on every workstation to block known
malware signatures at the endpoint
C. Establishing a dedicated security operations center to provide continuous monitoring and faster
incident response times
D. Mandating full-disk encryption on all endpoints to prevent data exfiltration if a workstation is
compromised
Correct Answer: A
Rationale:
Defense-in-depth relies on multiple overlapping protective layers so that if one control fails, remaining layers
continue to provide protection. Deploying concentric administrative, technical, and physical controls directly
addresses the root cause of the breach, whereas the host-based IPS in option B is a single-layer technical
control that does not create layered defense.
Q2 Question 2 of 100
A financial services firm is migrating from a legacy perimeter-based security model to a modern
architecture that eliminates implicit trust. Their current network assumes that any device inside the
corporate LAN is inherently trustworthy, which has led to several insider threat incidents where
compromised internal accounts moved laterally without detection. The CISO needs a foundational
principle to guide the new architecture.
A. Every user and device must pass network admission control before being placed on a trusted
VLAN segment
B. Every access request must be authenticated, authorized, and continuously validated regardless of
the requestor's network location
C. All internal traffic must be routed through a next-generation firewall with deep packet inspection
enabled
D. Each department must maintain its own independent access control policies aligned with
compliance requirements
Correct Answer: B
m Test Bank (Latest Update 2026/2027) Cybersecurity Architecture and Engineering | Questions and Answers | Grade A | 100% Correct (Verified Solutions) 2026/2027 | 2026/2027 | Passing Score
, Rationale:
The core tenet of Zero Trust Architecture is that trust is never assumed and every request must be fully
authenticated, authorized, and encrypted regardless of whether it originates inside or outside the network
perimeter. Option A describes network access control, which is a component but does not capture the
continuous verification principle that distinguishes Zero Trust.
Q3 Question 3 of 100
A government contractor operates a mixed environment containing classified research data,
employee personal information, and public-facing web services. The security team must define clear
boundaries to ensure that a compromise in the public zone cannot affect the classified zone. The
architect needs to establish demarcation points where security policies and enforcement mechanisms
change.
A. Implement role-based access control lists on every server to restrict data access based on user
clearance level
B. Deploy a data loss prevention solution that monitors and blocks the transfer of sensitive information
across the network
C. Establish distinct security domains with controlled interfaces and enforce strict policy enforcement
at each trust boundary crossing
D. Configure an enterprise-wide intrusion detection system that correlates events across all network
segments in real time
Correct Answer: C
Rationale:
Security domains group resources with identical security requirements, and trust boundaries are the points
where data moves between domains with different policies, making controlled interfaces essential. Option A
addresses access control at the server level but does not define the structural boundaries between zones with
different trust levels.
Q4 Question 4 of 100
A global logistics company is deploying a new order management platform that integrates with
customs databases, payment processors, and warehouse IoT sensors. The chief security architect
needs to produce a comprehensive reference that captures every security-relevant design decision,
data flow, and control for future auditors and maintenance teams. This document must serve as the
single source of truth for how security is embedded into the system.
A. A security requirements traceability matrix that maps each functional requirement to its
corresponding test case
B. A risk assessment report that identifies threats, assigns likelihood and impact ratings, and
recommends mitigations
C. A penetration testing report that documents vulnerabilities discovered during the pre-launch
security evaluation
D. A system security architecture document that describes the security-relevant components, data
flows, trust boundaries, and controls of the system
m Test Bank (Latest Update 2026/2027) Cybersecurity Architecture and Engineering | Questions and Answers | Grade A | 100% Correct (Verified Solutions) 2026/2027 | 2026/2027 | Passing Score
, Correct Answer: D
Rationale:
A system security architecture document provides a holistic view of how security is designed into the system,
including components, data flows, and controls, making it the appropriate single source of truth for auditors.
Option B focuses on risk identification rather than capturing the complete architectural design decisions and
structural security elements.
Q5 Question 5 of 100
A mid-size e-commerce company is migrating its three-tier web application to the cloud and
evaluating different service models. The current on-premises environment requires significant IT staff
time for hardware maintenance, and leadership wants to reduce that overhead. The CISO must
determine which model gives the organization the most direct control over operating system
hardening, patch management, and kernel-level configurations while still eliminating the burden of
managing physical hardware.
A. Platform as a Service, where the provider manages the runtime environment and operating system
while the customer focuses on application code
B. Software as a Service, where the provider manages all layers and the customer accesses the
application through a web browser
C. Function as a Service, where the provider manages the execution environment and the customer
deploys individual event-driven functions
D. Infrastructure as a Service, where the provider manages the physical hardware and hypervisor
while the customer manages the guest operating system and above
Correct Answer: D
Rationale:
In the IaaS model, the cloud provider is responsible for physical infrastructure and the hypervisor, while the
customer retains full control over the guest operating system, enabling direct OS hardening and kernel
configuration. Option A places the OS under provider control, which prevents the customer from performing
operating system-level hardening.
Q6 Question 6 of 100
An online streaming platform has decomposed its monolithic application into over forty independently
deployed microservices. Each service must authenticate callers, authorize requests, and protect data
in transit without introducing significant latency or creating tight coupling between development
teams. The platform architect needs a pattern that centralizes cross-cutting security concerns.
A. Embedding authentication and authorization logic directly within each microservice codebase to
ensure independent operation
B. Deploying a service mesh that handles mutual TLS between services and delegates all security
decisions to a centralized policy engine
C. Implementing an API gateway that serves as a single enforcement point for authentication,
authorization, rate limiting, and traffic encryption
m Test Bank (Latest Update 2026/2027) Cybersecurity Architecture and Engineering | Questions and Answers | Grade A | 100% Correct (Verified Solutions) 2026/2027 | 2026/2027 | Passing Score
Architecture and Engineering | Questions and Answers | Grade A | 100%
Correct (Verified Solutions) 2026/2027
OBJECTIVE ASSESSMENT - EXAM
WGU D488 Final Exam Test Bank
(Latest Update 2026/2027)
Cybersecurity Architecture and
Engineering | Questions and
Answers | Grade A | 100% Correct
(Verified Solutions) 2026/2027
D488
100 100%
QUESTIONS VERIFIED ANSWERS EDITION
TOPICS COVERED
Cybersecurity Architecture Risk Management & Compliance
Security Engineering Principles Incident Response & Recovery
Network Security & Defense
COVER PAGE - 1
, SECTION 1 | Cybersecurity Architecture | Q1-Q20 | WGU D488 Final Exam Test Bank (Latest Update
2026/2027) Cybersecurity Architecture and Engineering | Questions and Answers | Grade A | 100%
Correct (Verified Solutions) 2026/2027 2026/2027
Q1 Question 1 of 100
A regional hospital network recently experienced a ransomware breach that propagated from a
compromised workstation to critical patient records. The post-incident review revealed that a single
point of failure at the endpoint level allowed lateral movement with no intermediate barriers to slow or
stop the attack. The security architect must recommend a structural improvement that introduces
multiple independent protective barriers between potential entry points and high-value assets.
A. Deploying concentric layers of administrative, technical, and physical controls so that no single
control failure exposes the entire environment
B. Implementing a host-based intrusion prevention system on every workstation to block known
malware signatures at the endpoint
C. Establishing a dedicated security operations center to provide continuous monitoring and faster
incident response times
D. Mandating full-disk encryption on all endpoints to prevent data exfiltration if a workstation is
compromised
Correct Answer: A
Rationale:
Defense-in-depth relies on multiple overlapping protective layers so that if one control fails, remaining layers
continue to provide protection. Deploying concentric administrative, technical, and physical controls directly
addresses the root cause of the breach, whereas the host-based IPS in option B is a single-layer technical
control that does not create layered defense.
Q2 Question 2 of 100
A financial services firm is migrating from a legacy perimeter-based security model to a modern
architecture that eliminates implicit trust. Their current network assumes that any device inside the
corporate LAN is inherently trustworthy, which has led to several insider threat incidents where
compromised internal accounts moved laterally without detection. The CISO needs a foundational
principle to guide the new architecture.
A. Every user and device must pass network admission control before being placed on a trusted
VLAN segment
B. Every access request must be authenticated, authorized, and continuously validated regardless of
the requestor's network location
C. All internal traffic must be routed through a next-generation firewall with deep packet inspection
enabled
D. Each department must maintain its own independent access control policies aligned with
compliance requirements
Correct Answer: B
m Test Bank (Latest Update 2026/2027) Cybersecurity Architecture and Engineering | Questions and Answers | Grade A | 100% Correct (Verified Solutions) 2026/2027 | 2026/2027 | Passing Score
, Rationale:
The core tenet of Zero Trust Architecture is that trust is never assumed and every request must be fully
authenticated, authorized, and encrypted regardless of whether it originates inside or outside the network
perimeter. Option A describes network access control, which is a component but does not capture the
continuous verification principle that distinguishes Zero Trust.
Q3 Question 3 of 100
A government contractor operates a mixed environment containing classified research data,
employee personal information, and public-facing web services. The security team must define clear
boundaries to ensure that a compromise in the public zone cannot affect the classified zone. The
architect needs to establish demarcation points where security policies and enforcement mechanisms
change.
A. Implement role-based access control lists on every server to restrict data access based on user
clearance level
B. Deploy a data loss prevention solution that monitors and blocks the transfer of sensitive information
across the network
C. Establish distinct security domains with controlled interfaces and enforce strict policy enforcement
at each trust boundary crossing
D. Configure an enterprise-wide intrusion detection system that correlates events across all network
segments in real time
Correct Answer: C
Rationale:
Security domains group resources with identical security requirements, and trust boundaries are the points
where data moves between domains with different policies, making controlled interfaces essential. Option A
addresses access control at the server level but does not define the structural boundaries between zones with
different trust levels.
Q4 Question 4 of 100
A global logistics company is deploying a new order management platform that integrates with
customs databases, payment processors, and warehouse IoT sensors. The chief security architect
needs to produce a comprehensive reference that captures every security-relevant design decision,
data flow, and control for future auditors and maintenance teams. This document must serve as the
single source of truth for how security is embedded into the system.
A. A security requirements traceability matrix that maps each functional requirement to its
corresponding test case
B. A risk assessment report that identifies threats, assigns likelihood and impact ratings, and
recommends mitigations
C. A penetration testing report that documents vulnerabilities discovered during the pre-launch
security evaluation
D. A system security architecture document that describes the security-relevant components, data
flows, trust boundaries, and controls of the system
m Test Bank (Latest Update 2026/2027) Cybersecurity Architecture and Engineering | Questions and Answers | Grade A | 100% Correct (Verified Solutions) 2026/2027 | 2026/2027 | Passing Score
, Correct Answer: D
Rationale:
A system security architecture document provides a holistic view of how security is designed into the system,
including components, data flows, and controls, making it the appropriate single source of truth for auditors.
Option B focuses on risk identification rather than capturing the complete architectural design decisions and
structural security elements.
Q5 Question 5 of 100
A mid-size e-commerce company is migrating its three-tier web application to the cloud and
evaluating different service models. The current on-premises environment requires significant IT staff
time for hardware maintenance, and leadership wants to reduce that overhead. The CISO must
determine which model gives the organization the most direct control over operating system
hardening, patch management, and kernel-level configurations while still eliminating the burden of
managing physical hardware.
A. Platform as a Service, where the provider manages the runtime environment and operating system
while the customer focuses on application code
B. Software as a Service, where the provider manages all layers and the customer accesses the
application through a web browser
C. Function as a Service, where the provider manages the execution environment and the customer
deploys individual event-driven functions
D. Infrastructure as a Service, where the provider manages the physical hardware and hypervisor
while the customer manages the guest operating system and above
Correct Answer: D
Rationale:
In the IaaS model, the cloud provider is responsible for physical infrastructure and the hypervisor, while the
customer retains full control over the guest operating system, enabling direct OS hardening and kernel
configuration. Option A places the OS under provider control, which prevents the customer from performing
operating system-level hardening.
Q6 Question 6 of 100
An online streaming platform has decomposed its monolithic application into over forty independently
deployed microservices. Each service must authenticate callers, authorize requests, and protect data
in transit without introducing significant latency or creating tight coupling between development
teams. The platform architect needs a pattern that centralizes cross-cutting security concerns.
A. Embedding authentication and authorization logic directly within each microservice codebase to
ensure independent operation
B. Deploying a service mesh that handles mutual TLS between services and delegates all security
decisions to a centralized policy engine
C. Implementing an API gateway that serves as a single enforcement point for authentication,
authorization, rate limiting, and traffic encryption
m Test Bank (Latest Update 2026/2027) Cybersecurity Architecture and Engineering | Questions and Answers | Grade A | 100% Correct (Verified Solutions) 2026/2027 | 2026/2027 | Passing Score
