WGU D488 Final Exam Test Bank (Latest Update 2026/2027)
OBJECTIVE ASSESSMENT - EXAM
WGU D488 Final Exam Test Bank (Latest Update
2026/2027) Cybersecurity Architecture and Engineering |
Questions and Answers | Grade A | 100% Correct (Verified
Solutions) 2026/2027
75 100% 2026/2027 80%
QUESTIONS VERIFIED ANSWERS EDITION PASSING SCORE
TOPICS COVERED
• Security Architecture & Design • Identity, Access & Cryptography
• Zero Trust & Defense in Depth • Incident Response & Forensics
• Risk Management & Compliance • Cloud & OT Security
• NIST, ISO 27001, PCI DSS, GDPR • Threat Hunting & Detection
• Network Security & Engineering • Emerging Threats & Operations
COVER PAGE - 1
,Section 1: Security Architecture & Design
WGU D488 Final Exam Test Bank (Latest Update 2026/2027)
Q1.
A financial services firm is redesigning its core banking platform and the security architect must select
a reference model that emphasizes defense in depth with multiple independent security layers. The
architect evaluates the SABSA, TOGAF, and Zachman frameworks. Which framework provides the most
comprehensive enterprise security architecture methodology that maps security controls directly to
business objectives across six layers from contextual to component?
A. Zachman Framework, which organizes enterprise architecture by interrogatives and perspectives but
does not include security-specific layers
B. TOGAF (The Open Group Architecture Framework), which focuses on IT architecture development but
lacks dedicated security layers
C. SABSA (Sherwood Applied Business Security Architecture), which uses a six-layer model from business
context to component security services
D. COBIT 2019, which provides governance and management objectives but is not an architecture
framework per se
Correct Answer: C
Rationale: SABSA is a comprehensive enterprise security architecture framework that uses a six-layer model (contextual,
conceptual, logical, physical, component, and operational) to map security controls directly to business objectives. Unlike
TOGAF or Zachman, SABSA is specifically designed for security architecture and provides a methodology for deriving
security requirements from business risk.
Q2.
A cloud migration team is evaluating whether to deploy a monolithic e-commerce application as a
single virtual machine or decompose it into microservices running in containers. The CISO is
concerned that microservices increase the attack surface due to inter-service communication. Which
security architecture principle best supports the decision to use microservices while managing the
expanded attack surface?
A. The principle of maximum privilege, where each microservice has full access to all data stores for
operational flexibility
B. The principle of security through obscurity, where each microservice hides its API endpoints from
external discovery
C. The principle of single point of failure elimination by consolidating all microservices into a single container
image
D. The principle of least privilege applied to each microservice, combined with mutual TLS and service
mesh policy enforcement
Correct Answer: D
Rationale: Microservices architecture increases the attack surface due to expanded network communication between
services. Applying the principle of least privilege to each service, enforcing mutual TLS for encrypted inter-service
communication, and using a service mesh (like Istio) for policy enforcement and traffic management are the correct security
controls. Security through obscurity is not a valid principle, and maximum privilege violates fundamental security design.
,Q3.
An organization is implementing a zero trust architecture for its hybrid workforce. The network
engineer proposes segmenting the network into VLANs and using traditional VPN concentrators for
remote access. The security architect argues this approach is insufficient. Which zero trust principle
directly contradicts the engineer's proposal of network perimeter-based access?
A. Assume breach — the network is already compromised and must be designed for containment
B. Never trust, always verify — every access request must be authenticated, authorized, and encrypted
regardless of network location
C. Verify explicitly — access decisions are based on all available data points including identity, device
health, and service behavior
D. Use least privilege access — users and devices are granted only the minimum permissions needed
Correct Answer: B
Rationale: The engineer's proposal of VLAN segmentation and VPN concentrators relies on a trusted network perimeter,
which is the antithesis of zero trust. The core zero trust principle of 'never trust, always verify' means that no user, device, or
service is inherently trusted based on network location alone. Every access request must be continuously authenticated and
authorized, regardless of whether the request originates from inside or outside the traditional network perimeter.
Q4.
A healthcare organization is designing a new patient data warehouse that must comply with HIPAA
technical safeguards. The security architect must ensure that data at rest, in transit, and in use are
protected. Which combination of controls best satisfies the HIPAA technical safeguard requirements
for data protection across all three states?
A. ROT13 cipher at rest, plaintext HTTP in transit, and process-level sandboxing for data in use
B. SHA-256 hashing at rest, IPsec in transit, and containerization for data in use
C. Base64 encoding at rest, SSL 3.0 in transit, and virtual machine isolation for data in use
D. AES-256 encryption at rest, TLS 1.3 in transit, and confidential computing with hardware-based memory
encryption for data in use
Correct Answer: D
Rationale: HIPAA technical safeguards require encryption for data at rest (AES-256 is the gold standard), encryption for
data in transit (TLS 1.3 is the current standard), and protection for data in use (confidential computing using
hardware-based memory encryption like Intel SGX or AMD SEV). SHA-256 is a hash function, not encryption. SSL 3.0 and
plaintext HTTP are insecure. Base64 and ROT13 are not encryption.
, Q5.
A defense contractor is building a secure facility for processing classified information and must
implement a TEMPEST-certified architecture. The facility design team is evaluating shielding
requirements for electromagnetic emissions. Which architectural control is specifically required by
TEMPEST standards to prevent electromagnetic emanations from compromising classified data?
A. Video surveillance with 30-day retention and motion detection in all secure areas
B. Biometric access control with dual-factor authentication at all facility entry points
C. Redundant power supplies with uninterruptible power systems and diesel generators
D. Faraday cage construction with conductive shielding on all six surfaces and filtered power and data entry
points
Correct Answer: D
Rationale: TEMPEST (Telecommunications Electronics Materials Protected from Emanating Spurious Transmissions) is a
U.S. government standard for protecting equipment from electromagnetic emanations that could compromise classified
information. The primary architectural control is a Faraday cage — a conductive enclosure on all six surfaces (walls, floor,
ceiling) with filtered power and data lines to prevent electromagnetic signals from escaping. Biometrics, UPS, and video
surveillance are physical security controls but not TEMPEST-specific.
Q6.
A multinational corporation is standardizing its security architecture across three regions with different
regulatory requirements: GDPR in Europe, CCPA in California, and LGPD in Brazil. The security
architect must design a unified architecture that satisfies the most stringent requirements across all
jurisdictions. Which approach best achieves this compliance architecture goal?
A. Design three separate architectures, each optimized for its specific regulatory regime
B. Design for the strictest standard (GDPR) as the baseline, then add jurisdiction-specific controls as
overlays
C. Design for the least common denominator (CCPA) to minimize implementation complexity and cost
D. Design without regulatory consideration and add compliance controls after deployment as needed
Correct Answer: B
Rationale: The most efficient and secure approach for multinational compliance is to design for the strictest standard (GDPR
in this case) as the global baseline, then add jurisdiction-specific controls as overlays where local requirements exceed the
baseline. GDPR has the most comprehensive requirements for data protection, breach notification, and data subject rights.
Three separate architectures create inconsistency and management overhead. The least common denominator approach
would fail GDPR compliance.
OBJECTIVE ASSESSMENT - EXAM
WGU D488 Final Exam Test Bank (Latest Update
2026/2027) Cybersecurity Architecture and Engineering |
Questions and Answers | Grade A | 100% Correct (Verified
Solutions) 2026/2027
75 100% 2026/2027 80%
QUESTIONS VERIFIED ANSWERS EDITION PASSING SCORE
TOPICS COVERED
• Security Architecture & Design • Identity, Access & Cryptography
• Zero Trust & Defense in Depth • Incident Response & Forensics
• Risk Management & Compliance • Cloud & OT Security
• NIST, ISO 27001, PCI DSS, GDPR • Threat Hunting & Detection
• Network Security & Engineering • Emerging Threats & Operations
COVER PAGE - 1
,Section 1: Security Architecture & Design
WGU D488 Final Exam Test Bank (Latest Update 2026/2027)
Q1.
A financial services firm is redesigning its core banking platform and the security architect must select
a reference model that emphasizes defense in depth with multiple independent security layers. The
architect evaluates the SABSA, TOGAF, and Zachman frameworks. Which framework provides the most
comprehensive enterprise security architecture methodology that maps security controls directly to
business objectives across six layers from contextual to component?
A. Zachman Framework, which organizes enterprise architecture by interrogatives and perspectives but
does not include security-specific layers
B. TOGAF (The Open Group Architecture Framework), which focuses on IT architecture development but
lacks dedicated security layers
C. SABSA (Sherwood Applied Business Security Architecture), which uses a six-layer model from business
context to component security services
D. COBIT 2019, which provides governance and management objectives but is not an architecture
framework per se
Correct Answer: C
Rationale: SABSA is a comprehensive enterprise security architecture framework that uses a six-layer model (contextual,
conceptual, logical, physical, component, and operational) to map security controls directly to business objectives. Unlike
TOGAF or Zachman, SABSA is specifically designed for security architecture and provides a methodology for deriving
security requirements from business risk.
Q2.
A cloud migration team is evaluating whether to deploy a monolithic e-commerce application as a
single virtual machine or decompose it into microservices running in containers. The CISO is
concerned that microservices increase the attack surface due to inter-service communication. Which
security architecture principle best supports the decision to use microservices while managing the
expanded attack surface?
A. The principle of maximum privilege, where each microservice has full access to all data stores for
operational flexibility
B. The principle of security through obscurity, where each microservice hides its API endpoints from
external discovery
C. The principle of single point of failure elimination by consolidating all microservices into a single container
image
D. The principle of least privilege applied to each microservice, combined with mutual TLS and service
mesh policy enforcement
Correct Answer: D
Rationale: Microservices architecture increases the attack surface due to expanded network communication between
services. Applying the principle of least privilege to each service, enforcing mutual TLS for encrypted inter-service
communication, and using a service mesh (like Istio) for policy enforcement and traffic management are the correct security
controls. Security through obscurity is not a valid principle, and maximum privilege violates fundamental security design.
,Q3.
An organization is implementing a zero trust architecture for its hybrid workforce. The network
engineer proposes segmenting the network into VLANs and using traditional VPN concentrators for
remote access. The security architect argues this approach is insufficient. Which zero trust principle
directly contradicts the engineer's proposal of network perimeter-based access?
A. Assume breach — the network is already compromised and must be designed for containment
B. Never trust, always verify — every access request must be authenticated, authorized, and encrypted
regardless of network location
C. Verify explicitly — access decisions are based on all available data points including identity, device
health, and service behavior
D. Use least privilege access — users and devices are granted only the minimum permissions needed
Correct Answer: B
Rationale: The engineer's proposal of VLAN segmentation and VPN concentrators relies on a trusted network perimeter,
which is the antithesis of zero trust. The core zero trust principle of 'never trust, always verify' means that no user, device, or
service is inherently trusted based on network location alone. Every access request must be continuously authenticated and
authorized, regardless of whether the request originates from inside or outside the traditional network perimeter.
Q4.
A healthcare organization is designing a new patient data warehouse that must comply with HIPAA
technical safeguards. The security architect must ensure that data at rest, in transit, and in use are
protected. Which combination of controls best satisfies the HIPAA technical safeguard requirements
for data protection across all three states?
A. ROT13 cipher at rest, plaintext HTTP in transit, and process-level sandboxing for data in use
B. SHA-256 hashing at rest, IPsec in transit, and containerization for data in use
C. Base64 encoding at rest, SSL 3.0 in transit, and virtual machine isolation for data in use
D. AES-256 encryption at rest, TLS 1.3 in transit, and confidential computing with hardware-based memory
encryption for data in use
Correct Answer: D
Rationale: HIPAA technical safeguards require encryption for data at rest (AES-256 is the gold standard), encryption for
data in transit (TLS 1.3 is the current standard), and protection for data in use (confidential computing using
hardware-based memory encryption like Intel SGX or AMD SEV). SHA-256 is a hash function, not encryption. SSL 3.0 and
plaintext HTTP are insecure. Base64 and ROT13 are not encryption.
, Q5.
A defense contractor is building a secure facility for processing classified information and must
implement a TEMPEST-certified architecture. The facility design team is evaluating shielding
requirements for electromagnetic emissions. Which architectural control is specifically required by
TEMPEST standards to prevent electromagnetic emanations from compromising classified data?
A. Video surveillance with 30-day retention and motion detection in all secure areas
B. Biometric access control with dual-factor authentication at all facility entry points
C. Redundant power supplies with uninterruptible power systems and diesel generators
D. Faraday cage construction with conductive shielding on all six surfaces and filtered power and data entry
points
Correct Answer: D
Rationale: TEMPEST (Telecommunications Electronics Materials Protected from Emanating Spurious Transmissions) is a
U.S. government standard for protecting equipment from electromagnetic emanations that could compromise classified
information. The primary architectural control is a Faraday cage — a conductive enclosure on all six surfaces (walls, floor,
ceiling) with filtered power and data lines to prevent electromagnetic signals from escaping. Biometrics, UPS, and video
surveillance are physical security controls but not TEMPEST-specific.
Q6.
A multinational corporation is standardizing its security architecture across three regions with different
regulatory requirements: GDPR in Europe, CCPA in California, and LGPD in Brazil. The security
architect must design a unified architecture that satisfies the most stringent requirements across all
jurisdictions. Which approach best achieves this compliance architecture goal?
A. Design three separate architectures, each optimized for its specific regulatory regime
B. Design for the strictest standard (GDPR) as the baseline, then add jurisdiction-specific controls as
overlays
C. Design for the least common denominator (CCPA) to minimize implementation complexity and cost
D. Design without regulatory consideration and add compliance controls after deployment as needed
Correct Answer: B
Rationale: The most efficient and secure approach for multinational compliance is to design for the strictest standard (GDPR
in this case) as the global baseline, then add jurisdiction-specific controls as overlays where local requirements exceed the
baseline. GDPR has the most comprehensive requirements for data protection, breach notification, and data subject rights.
Three separate architectures create inconsistency and management overhead. The least common denominator approach
would fail GDPR compliance.
