WGU D488 Cybersecurity Architecture & Engineering
FINAL EXAM / OBJECTIVE ASSESSMENT (OA)
PRACTICE TEST COMPREHENSIVE QUESTION BANK
- 185 QUESTIONS WITH ANSWERS AND RATIONALES
1. A security architect is designing a defense-in-depth strategy for a financial
institution. Which of the following represents the correct layered security approach
from outermost to innermost?
A. Perimeter firewall, Network segmentation, Host-based IPS, Application whitelisting, Data
encryption
B. Data encryption, Application whitelisting, Host-based IPS, Network segmentation,
Perimeter firewall
C. Perimeter firewall, Data encryption, Application whitelisting, Network segmentation, Host-
based IPS
D. Host-based IPS, Perimeter firewall, Network segmentation, Data encryption, Application
whitelisting
ANSWER: A. Perimeter firewall, Network segmentation, Host-based IPS, Application
whitelisting, Data encryption
Rationale: Defense-in-depth requires multiple layers of security controls. The correct order
from outermost (facing the internet) to innermost (protecting the data) is: perimeter firewall
→ network segmentation → host-based IPS → application whitelisting → data encryption.
This ensures that if one layer is breached, subsequent layers continue to provide protection.
2. A company is implementing a Zero Trust architecture. Which principle is
fundamental to this approach?
A. Trust all internal network traffic by default
B. Verify and authenticate every access request regardless of location
C. Rely solely on perimeter firewalls for protection
D. Use single-factor authentication for all users
,ANSWER: B. Verify and authenticate every access request regardless of location
Rationale: Zero Trust architecture operates on the principle of "never trust, always verify."
This means every access request, whether from inside or outside the network, must be
authenticated, authorized, and continuously validated for security posture before granting
access.
3. Which security framework provides a comprehensive set of controls organized into
14 control families for federal information systems?
A. ISO 27001
B. NIST SP 800-53
C. COBIT
D. ITIL
ANSWER: B. NIST SP 800-53
Rationale: NIST Special Publication 800-53 provides a catalog of security and privacy
controls for federal information systems and organizations. It organizes controls into 14
families, covering areas such as access control, audit and accountability, and system and
communications protection.
4. An organization wants to ensure their security program aligns with business
objectives. Which framework is best suited for this purpose?
A. NIST CSF (Cybersecurity Framework)
B. ISO 27001
C. COBIT
D. PCI DSS
ANSWER: C. COBIT
Rationale: COBIT (Control Objectives for Information and Related Technologies) is
specifically designed to align IT and security goals with business objectives. It provides a
comprehensive framework for governance and management of enterprise IT, making it ideal
for ensuring security programs support business needs.
,5. A security architect is designing a secure SDLC (Software Development Life Cycle)
process. At which phase should security requirements be initially incorporated?
A. Testing phase
B. Deployment phase
C. Requirements and design phase
D. Maintenance phase
ANSWER: C. Requirements and design phase
Rationale: Security should be incorporated from the very beginning of the SDLC during the
requirements and design phase. This "shift-left" approach ensures security is built into the
application from the ground up, reducing costs and vulnerabilities compared to adding
security later in the development process.
6. Which security architecture model restricts subjects from accessing objects based
on a hierarchical classification system?
A. Discretionary Access Control (DAC)
B. Mandatory Access Control (MAC)
C. Role-Based Access Control (RBAC)
D. Attribute-Based Access Control (ABAC)
ANSWER: B. Mandatory Access Control (MAC)
Rationale: MAC uses a hierarchical classification system (e.g., Top Secret, Secret,
Confidential) where subjects are assigned clearance levels and objects are assigned
classification levels. Access is granted only if the subject's clearance level equals or
exceeds the object's classification level. The system enforces these rules centrally.
7. A company implements a system where users are granted permissions based on
their job function. When users change roles, their permissions are automatically
updated. Which access control model is being used?
A. Discretionary Access Control (DAC)
B. Mandatory Access Control (MAC)
, C. Role-Based Access Control (RBAC)
D. Rule-Based Access Control (RBAC)
ANSWER: C. Role-Based Access Control (RBAC)
Rationale: RBAC assigns permissions to roles rather than individual users. When a user
assumes a role (based on their job function), they inherit the permissions associated with
that role. When their role changes, their permissions are automatically updated, simplifying
administration and ensuring least privilege.
8. A security architect is evaluating different security architectures for a high-security
government facility. Which architecture provides the strongest separation between
different security domains?
A. Single-level architecture
B. Multilevel security architecture
C. Hybrid security architecture
D. Open security architecture
ANSWER: B. Multilevel security architecture
Rationale: Multilevel security architecture provides the strongest separation by maintaining
multiple security domains within a single system, each with different classification levels. It
uses trusted processes and enforcement mechanisms to prevent information flow between
domains, making it ideal for high-security government environments.
9. What is the primary purpose of a Security Operations Center (SOC)?
A. To develop new security software
B. To monitor, detect, and respond to security incidents
C. To conduct security awareness training
D. To perform penetration testing
ANSWER: B. To monitor, detect, and respond to security incidents
Rationale: The primary purpose of a Security Operations Center (SOC) is to continuously
monitor an organization's security posture, detect potential security incidents, analyze
FINAL EXAM / OBJECTIVE ASSESSMENT (OA)
PRACTICE TEST COMPREHENSIVE QUESTION BANK
- 185 QUESTIONS WITH ANSWERS AND RATIONALES
1. A security architect is designing a defense-in-depth strategy for a financial
institution. Which of the following represents the correct layered security approach
from outermost to innermost?
A. Perimeter firewall, Network segmentation, Host-based IPS, Application whitelisting, Data
encryption
B. Data encryption, Application whitelisting, Host-based IPS, Network segmentation,
Perimeter firewall
C. Perimeter firewall, Data encryption, Application whitelisting, Network segmentation, Host-
based IPS
D. Host-based IPS, Perimeter firewall, Network segmentation, Data encryption, Application
whitelisting
ANSWER: A. Perimeter firewall, Network segmentation, Host-based IPS, Application
whitelisting, Data encryption
Rationale: Defense-in-depth requires multiple layers of security controls. The correct order
from outermost (facing the internet) to innermost (protecting the data) is: perimeter firewall
→ network segmentation → host-based IPS → application whitelisting → data encryption.
This ensures that if one layer is breached, subsequent layers continue to provide protection.
2. A company is implementing a Zero Trust architecture. Which principle is
fundamental to this approach?
A. Trust all internal network traffic by default
B. Verify and authenticate every access request regardless of location
C. Rely solely on perimeter firewalls for protection
D. Use single-factor authentication for all users
,ANSWER: B. Verify and authenticate every access request regardless of location
Rationale: Zero Trust architecture operates on the principle of "never trust, always verify."
This means every access request, whether from inside or outside the network, must be
authenticated, authorized, and continuously validated for security posture before granting
access.
3. Which security framework provides a comprehensive set of controls organized into
14 control families for federal information systems?
A. ISO 27001
B. NIST SP 800-53
C. COBIT
D. ITIL
ANSWER: B. NIST SP 800-53
Rationale: NIST Special Publication 800-53 provides a catalog of security and privacy
controls for federal information systems and organizations. It organizes controls into 14
families, covering areas such as access control, audit and accountability, and system and
communications protection.
4. An organization wants to ensure their security program aligns with business
objectives. Which framework is best suited for this purpose?
A. NIST CSF (Cybersecurity Framework)
B. ISO 27001
C. COBIT
D. PCI DSS
ANSWER: C. COBIT
Rationale: COBIT (Control Objectives for Information and Related Technologies) is
specifically designed to align IT and security goals with business objectives. It provides a
comprehensive framework for governance and management of enterprise IT, making it ideal
for ensuring security programs support business needs.
,5. A security architect is designing a secure SDLC (Software Development Life Cycle)
process. At which phase should security requirements be initially incorporated?
A. Testing phase
B. Deployment phase
C. Requirements and design phase
D. Maintenance phase
ANSWER: C. Requirements and design phase
Rationale: Security should be incorporated from the very beginning of the SDLC during the
requirements and design phase. This "shift-left" approach ensures security is built into the
application from the ground up, reducing costs and vulnerabilities compared to adding
security later in the development process.
6. Which security architecture model restricts subjects from accessing objects based
on a hierarchical classification system?
A. Discretionary Access Control (DAC)
B. Mandatory Access Control (MAC)
C. Role-Based Access Control (RBAC)
D. Attribute-Based Access Control (ABAC)
ANSWER: B. Mandatory Access Control (MAC)
Rationale: MAC uses a hierarchical classification system (e.g., Top Secret, Secret,
Confidential) where subjects are assigned clearance levels and objects are assigned
classification levels. Access is granted only if the subject's clearance level equals or
exceeds the object's classification level. The system enforces these rules centrally.
7. A company implements a system where users are granted permissions based on
their job function. When users change roles, their permissions are automatically
updated. Which access control model is being used?
A. Discretionary Access Control (DAC)
B. Mandatory Access Control (MAC)
, C. Role-Based Access Control (RBAC)
D. Rule-Based Access Control (RBAC)
ANSWER: C. Role-Based Access Control (RBAC)
Rationale: RBAC assigns permissions to roles rather than individual users. When a user
assumes a role (based on their job function), they inherit the permissions associated with
that role. When their role changes, their permissions are automatically updated, simplifying
administration and ensuring least privilege.
8. A security architect is evaluating different security architectures for a high-security
government facility. Which architecture provides the strongest separation between
different security domains?
A. Single-level architecture
B. Multilevel security architecture
C. Hybrid security architecture
D. Open security architecture
ANSWER: B. Multilevel security architecture
Rationale: Multilevel security architecture provides the strongest separation by maintaining
multiple security domains within a single system, each with different classification levels. It
uses trusted processes and enforcement mechanisms to prevent information flow between
domains, making it ideal for high-security government environments.
9. What is the primary purpose of a Security Operations Center (SOC)?
A. To develop new security software
B. To monitor, detect, and respond to security incidents
C. To conduct security awareness training
D. To perform penetration testing
ANSWER: B. To monitor, detect, and respond to security incidents
Rationale: The primary purpose of a Security Operations Center (SOC) is to continuously
monitor an organization's security posture, detect potential security incidents, analyze
