WGU D488 Final Exam Test Bank (Latest Update 2026/2027)
OBJECTIVE ASSESSMENT - EXAM
Cybersecurity Architecture and Engineering
Final Exam Test Bank | 2026/2027 Edition
75 75 80% 5
QUESTIONS VERIFIED ANSWERS PASSING SCORE SECTIONS
TOPICS COVERED
• Zero-Trust Architecture • Cryptographic Protocols
• Microservices Security • Key Management & PKI
• Data Diodes & Cross-Domain • Tokenization & FPE
• Cloud Service Models • Network Microsegmentation
• Secure SDLC • Identity Federation
COVER PAGE - 1
, SECTION 1: SECURITY ARCHITECTURE & DESIGN WEIGHT: 20%
Q1 A financial institution is designing a new zero-trust architecture for its hybrid cloud environment. The CISO
requires that every access request be authenticated and authorized dynamically based on real-time risk signals,
regardless of network location. Which architectural principle best supports this requirement?
A. Implementing perimeter-based firewalls with deep packet inspection at all network boundaries
B. Establishing a flat network topology with role-based access control enforced at the application layer only
C. Deploying software-defined perimeters that authenticate every transaction before granting micro-segmented access
D. Using hardware security modules to encrypt all data at rest across the enterprise infrastructure
Correct Answer: C
Rationale: Zero-trust architecture requires continuous verification of every access request, which software-defined perimeters achieve by
authenticating each transaction individually. Perimeter-based firewalls (A) contradict zero-trust principles by assuming internal traffic is safe. Flat
topologies (B) lack segmentation, and HSMs (D) address encryption rather than access control.
Q2 An enterprise is migrating from a monolithic application to a microservices architecture deployed across
multiple Kubernetes clusters. The security team must ensure that compromised services cannot laterally move
to access sensitive databases. Which design pattern should be prioritized?
A. Implementing a service mesh with mutual TLS and fine-grained authorization policies between all services
B. Deploying a centralized API gateway that routes all traffic through a single authentication bottleneck
C. Using container runtime monitoring to detect anomalous process execution within individual pods
D. Applying network address translation at the cluster level to obfuscate internal service endpoints
Correct Answer: A
Rationale: A service mesh with mTLS and authorization policies provides encrypted east-west traffic and explicit access controls between services,
preventing lateral movement. A centralized gateway (B) creates a single point of failure. Runtime monitoring (C) is detective, not preventive. NAT
obfuscation (D) offers no real security against determined attackers.
Q3 A defense contractor must architect a system that processes classified data while maintaining strict separation
between networks at different classification levels. The solution must prevent covert channels while allowing
controlled data transfer. Which architecture satisfies these constraints?
A. A dual-homed bastion host with firewall rules restricting traffic between classified and unclassified networks
B. A cross-domain solution with data diode technology for unidirectional transfer and content validation
C. A virtual private network tunnel with end-to-end encryption bridging the high and low side networks
D. A shared storage area network with logical unit number masking to partition data by classification level
Correct Answer: B
Rationale: Cross-domain solutions with data diodes enforce unidirectional data flow, preventing covert channels while enabling controlled transfer.
Dual-homed hosts (A) create bridging risks. VPN tunnels (C) violate separation principles. Shared SANs (D) do not prevent covert channels or
enforce mandatory access control.
Q4 During a security architecture review, an assessor discovers that a critical payment processing system lacks
fault tolerance mechanisms and has a single point of failure in its authentication service. Which design flaw
classification best describes this vulnerability?
A. Insecure data storage due to the absence of database encryption at rest
B. Broken access control caused by missing multi-factor authentication requirements
C. Insecure deserialization from untrusted input validation on authentication tokens
D. Insufficient redundancy resulting from the failure to implement high-availability clustering
Correct Answer: D
Rationale: The absence of fault tolerance and a single point of failure directly indicates insufficient redundancy and lack of high-availability clustering.
There is no mention of encryption (A), MFA (B), or deserialization (C) in the scenario, making those classifications irrelevant to the described flaw.
, WGU D488 Final Exam Test Bank (Latest Update 2026/2027) Cybersecurity Architecture and Eng... CONFIDENTIAL
Q5 A healthcare organization is designing a new patient data repository that must comply with HIPAA technical
safeguards. The architecture must ensure that ePHI is accessible only to authorized personnel and that access
attempts are fully auditable. Which combination of controls best satisfies these requirements?
A. Attribute-based access control with continuous session monitoring and immutable audit logging
B. Role-based access control with quarterly access reviews and encrypted backups stored offsite
C. Discretionary access control with user-managed permissions and weekly log rotation policies
D. Mandatory access control with static security labels and manual audit log review procedures
Correct Answer: A
Rationale: Attribute-based access control enables fine-grained, dynamic authorization suitable for healthcare contexts, while continuous monitoring
and immutable logs satisfy HIPAA audit requirements. RBAC with quarterly reviews (B) lacks real-time enforcement. DAC (C) allows users to grant
permissions improperly. MAC with static labels (D) is too rigid for healthcare workflows.
Q6 An organization is evaluating cloud service models for a new customer-facing application that handles
personally identifiable information. The CISO wants maximum control over encryption key management while
minimizing infrastructure management overhead. Which service model alignment best meets these objectives?
A. Software as a Service with customer-managed encryption keys and third-party key escrow
B. Platform as a Service with bring-your-own-key capabilities and automated patch management
C. Infrastructure as a Service with hardware security module integration and manual OS patching
D. Function as a Service with ephemeral compute instances and no persistent storage requirements
Correct Answer: B
Rationale: Platform as a Service provides automated infrastructure management while supporting bring-your-own-key for encryption control. SaaS
(A) offers limited control over key management. IaaS (C) requires significant management overhead for patching. FaaS (D) lacks persistent storage,
making it unsuitable for applications requiring data retention.
Q7 A multinational corporation needs to design a secure software development lifecycle that integrates security
testing at multiple phases without significantly delaying release cycles. The team wants to shift security left
while maintaining deployment velocity. Which approach best achieves this balance?
A. Conducting comprehensive penetration testing only during the pre-production staging phase
B. Performing manual code reviews for every commit with security architect sign-off before builds
C. Outsourcing all security testing to a third-party firm after each major release cycle
D. Implementing automated static analysis in CI pipelines with incremental dynamic testing in staging
Correct Answer: D
Rationale: Automated static analysis in CI pipelines shifts security left by catching vulnerabilities early, while incremental dynamic testing in staging
maintains velocity. Penetration testing only in staging (A) delays discovery. Manual reviews per commit (B) create bottlenecks. Outsourced
post-release testing (C) fails to integrate security into the SDLC.
Q8 An enterprise architect is designing a secure messaging system for a government agency that requires
non-repudiation of message origin and integrity verification. The system must operate in a high-latency,
intermittently connected environment. Which cryptographic approach best satisfies these constraints?
A. Asymmetric digital signatures with certificate-based public key distribution and offline revocation checks
B. Symmetric key encryption with hash-based message authentication codes and timestamp tokens
C. Quantum-resistant lattice-based encryption with ephemeral key exchange and real-time certificate status
D. Homomorphic encryption with zero-knowledge proofs and centralized key generation authority
Correct Answer: A
Rationale: Asymmetric digital signatures provide non-repudiation, and certificate-based PKI with offline revocation checks functions in disconnected
environments. Symmetric encryption (B) cannot provide non-repudiation. Quantum-resistant schemes (C) with real-time checks fail offline.
Homomorphic encryption (D) is unnecessary for messaging integrity and non-repudiation.
OBJECTIVE ASSESSMENT - EXAM
Cybersecurity Architecture and Engineering
Final Exam Test Bank | 2026/2027 Edition
75 75 80% 5
QUESTIONS VERIFIED ANSWERS PASSING SCORE SECTIONS
TOPICS COVERED
• Zero-Trust Architecture • Cryptographic Protocols
• Microservices Security • Key Management & PKI
• Data Diodes & Cross-Domain • Tokenization & FPE
• Cloud Service Models • Network Microsegmentation
• Secure SDLC • Identity Federation
COVER PAGE - 1
, SECTION 1: SECURITY ARCHITECTURE & DESIGN WEIGHT: 20%
Q1 A financial institution is designing a new zero-trust architecture for its hybrid cloud environment. The CISO
requires that every access request be authenticated and authorized dynamically based on real-time risk signals,
regardless of network location. Which architectural principle best supports this requirement?
A. Implementing perimeter-based firewalls with deep packet inspection at all network boundaries
B. Establishing a flat network topology with role-based access control enforced at the application layer only
C. Deploying software-defined perimeters that authenticate every transaction before granting micro-segmented access
D. Using hardware security modules to encrypt all data at rest across the enterprise infrastructure
Correct Answer: C
Rationale: Zero-trust architecture requires continuous verification of every access request, which software-defined perimeters achieve by
authenticating each transaction individually. Perimeter-based firewalls (A) contradict zero-trust principles by assuming internal traffic is safe. Flat
topologies (B) lack segmentation, and HSMs (D) address encryption rather than access control.
Q2 An enterprise is migrating from a monolithic application to a microservices architecture deployed across
multiple Kubernetes clusters. The security team must ensure that compromised services cannot laterally move
to access sensitive databases. Which design pattern should be prioritized?
A. Implementing a service mesh with mutual TLS and fine-grained authorization policies between all services
B. Deploying a centralized API gateway that routes all traffic through a single authentication bottleneck
C. Using container runtime monitoring to detect anomalous process execution within individual pods
D. Applying network address translation at the cluster level to obfuscate internal service endpoints
Correct Answer: A
Rationale: A service mesh with mTLS and authorization policies provides encrypted east-west traffic and explicit access controls between services,
preventing lateral movement. A centralized gateway (B) creates a single point of failure. Runtime monitoring (C) is detective, not preventive. NAT
obfuscation (D) offers no real security against determined attackers.
Q3 A defense contractor must architect a system that processes classified data while maintaining strict separation
between networks at different classification levels. The solution must prevent covert channels while allowing
controlled data transfer. Which architecture satisfies these constraints?
A. A dual-homed bastion host with firewall rules restricting traffic between classified and unclassified networks
B. A cross-domain solution with data diode technology for unidirectional transfer and content validation
C. A virtual private network tunnel with end-to-end encryption bridging the high and low side networks
D. A shared storage area network with logical unit number masking to partition data by classification level
Correct Answer: B
Rationale: Cross-domain solutions with data diodes enforce unidirectional data flow, preventing covert channels while enabling controlled transfer.
Dual-homed hosts (A) create bridging risks. VPN tunnels (C) violate separation principles. Shared SANs (D) do not prevent covert channels or
enforce mandatory access control.
Q4 During a security architecture review, an assessor discovers that a critical payment processing system lacks
fault tolerance mechanisms and has a single point of failure in its authentication service. Which design flaw
classification best describes this vulnerability?
A. Insecure data storage due to the absence of database encryption at rest
B. Broken access control caused by missing multi-factor authentication requirements
C. Insecure deserialization from untrusted input validation on authentication tokens
D. Insufficient redundancy resulting from the failure to implement high-availability clustering
Correct Answer: D
Rationale: The absence of fault tolerance and a single point of failure directly indicates insufficient redundancy and lack of high-availability clustering.
There is no mention of encryption (A), MFA (B), or deserialization (C) in the scenario, making those classifications irrelevant to the described flaw.
, WGU D488 Final Exam Test Bank (Latest Update 2026/2027) Cybersecurity Architecture and Eng... CONFIDENTIAL
Q5 A healthcare organization is designing a new patient data repository that must comply with HIPAA technical
safeguards. The architecture must ensure that ePHI is accessible only to authorized personnel and that access
attempts are fully auditable. Which combination of controls best satisfies these requirements?
A. Attribute-based access control with continuous session monitoring and immutable audit logging
B. Role-based access control with quarterly access reviews and encrypted backups stored offsite
C. Discretionary access control with user-managed permissions and weekly log rotation policies
D. Mandatory access control with static security labels and manual audit log review procedures
Correct Answer: A
Rationale: Attribute-based access control enables fine-grained, dynamic authorization suitable for healthcare contexts, while continuous monitoring
and immutable logs satisfy HIPAA audit requirements. RBAC with quarterly reviews (B) lacks real-time enforcement. DAC (C) allows users to grant
permissions improperly. MAC with static labels (D) is too rigid for healthcare workflows.
Q6 An organization is evaluating cloud service models for a new customer-facing application that handles
personally identifiable information. The CISO wants maximum control over encryption key management while
minimizing infrastructure management overhead. Which service model alignment best meets these objectives?
A. Software as a Service with customer-managed encryption keys and third-party key escrow
B. Platform as a Service with bring-your-own-key capabilities and automated patch management
C. Infrastructure as a Service with hardware security module integration and manual OS patching
D. Function as a Service with ephemeral compute instances and no persistent storage requirements
Correct Answer: B
Rationale: Platform as a Service provides automated infrastructure management while supporting bring-your-own-key for encryption control. SaaS
(A) offers limited control over key management. IaaS (C) requires significant management overhead for patching. FaaS (D) lacks persistent storage,
making it unsuitable for applications requiring data retention.
Q7 A multinational corporation needs to design a secure software development lifecycle that integrates security
testing at multiple phases without significantly delaying release cycles. The team wants to shift security left
while maintaining deployment velocity. Which approach best achieves this balance?
A. Conducting comprehensive penetration testing only during the pre-production staging phase
B. Performing manual code reviews for every commit with security architect sign-off before builds
C. Outsourcing all security testing to a third-party firm after each major release cycle
D. Implementing automated static analysis in CI pipelines with incremental dynamic testing in staging
Correct Answer: D
Rationale: Automated static analysis in CI pipelines shifts security left by catching vulnerabilities early, while incremental dynamic testing in staging
maintains velocity. Penetration testing only in staging (A) delays discovery. Manual reviews per commit (B) create bottlenecks. Outsourced
post-release testing (C) fails to integrate security into the SDLC.
Q8 An enterprise architect is designing a secure messaging system for a government agency that requires
non-repudiation of message origin and integrity verification. The system must operate in a high-latency,
intermittently connected environment. Which cryptographic approach best satisfies these constraints?
A. Asymmetric digital signatures with certificate-based public key distribution and offline revocation checks
B. Symmetric key encryption with hash-based message authentication codes and timestamp tokens
C. Quantum-resistant lattice-based encryption with ephemeral key exchange and real-time certificate status
D. Homomorphic encryption with zero-knowledge proofs and centralized key generation authority
Correct Answer: A
Rationale: Asymmetric digital signatures provide non-repudiation, and certificate-based PKI with offline revocation checks functions in disconnected
environments. Symmetric encryption (B) cannot provide non-repudiation. Quantum-resistant schemes (C) with real-time checks fail offline.
Homomorphic encryption (D) is unnecessary for messaging integrity and non-repudiation.
