WGU D488 (Latest Update 2026/2027)
OBJECTIVE ASSESSMENT - EXAM
WGU D488 Final Exam Test Bank
Cybersecurity Architecture and Engineering
Questions and Answers | Grade A | 100% Correct (Verified Solutions)
75 100%
QUESTIONS VERIFIED ANSWERS EDITION
TOPICS COVERED
Security Architecture & Design Principles Risk Management, Compliance & Governance
Identity & Access Management (IAM) Secure Engineering, DevSecOps & Emerging Threats
Network Security & Secure Communications NIST Frameworks & Cybersecurity Standards
COVER PAGE - 1
, SECTION 1 | Security Architecture & Design Principles | Q1-Q15 | D488 2026/2027
Q1 Question 1 of 75
A financial institution is designing a new online banking platform. The security architect wants to ensure
that if one security control fails, additional controls remain in place to protect customer data. Which
foundational security principle is the architect applying?
A. Security through obscurity
B. Defense in depth
C. Single point of failure
D. Fail open
Correct Answer: B
Rationale:
Defense in depth is a security strategy that employs multiple layers of security controls throughout an IT system. If
one layer fails, subsequent layers continue to protect the asset. This approach assumes no single control is
perfect and redundancy strengthens overall security posture. Security through obscurity relies on hiding
information, while fail open is the opposite of secure design.
Q2 Question 2 of 75
A healthcare organization is migrating its patient records system to a cloud environment. The CISO
mandates that no user or device should be trusted by default, regardless of whether they are inside or
outside the network perimeter. Which architectural model aligns with this requirement?
A. Traditional perimeter-based security
B. Zero Trust architecture
C. Demilitarized zone (DMZ) model
D. Flat network topology
Correct Answer: B
Rationale:
Zero Trust architecture operates on the principle of 'never trust, always verify,' requiring continuous authentication
and authorization for every user and device attempting to access resources. Unlike traditional perimeter-based
models that trust internal users, Zero Trust assumes breach and verifies every request as though it originated
from an uncontrolled network.
WGU D488 Cybersecurity Architecture & Engineering 2026/2027 | Passing Score: 80% | Page 2 of 42
, Q3 Question 3 of 75
An e-commerce company needs to protect customer credit card data stored in its database. The security
team decides to transform the data using an algorithm that makes it computationally infeasible to reverse
without a key. Which cryptographic technique should they implement?
A. Hashing with SHA-256
B. Symmetric encryption with AES-256
C. Base64 encoding
D. Tokenization
Correct Answer: B
Rationale:
Symmetric encryption with AES-256 transforms plaintext data into ciphertext using a secret key, making it
computationally infeasible to reverse without the key. This is the appropriate method for protecting stored
sensitive data. Hashing is one-way and cannot be reversed for legitimate use, Base64 is not encryption, and
tokenization replaces data rather than transforming it.
Q4 Question 4 of 75
A software development firm is building a new application and wants to identify potential security flaws
during the design phase before any code is written. Which structured approach should the security team
use to systematically identify and prioritize threats?
A. Penetration testing
B. Threat modeling using STRIDE
C. Vulnerability scanning
D. Code review
Correct Answer: B
Rationale:
Threat modeling using STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service,
Elevation of Privilege) is a structured approach used during the design phase to identify and categorize potential
security threats before implementation. Penetration testing and vulnerability scanning occur after deployment,
while code review happens during development.
WGU D488 Cybersecurity Architecture & Engineering 2026/2027 | Passing Score: 80% | Page 3 of 42
, Q5 Question 5 of 75
A government contractor must ensure that its secure messaging system provides proof that a message
was sent by a specific sender and has not been altered in transit. Which two cryptographic services are
required to achieve both goals?
A. Symmetric encryption and steganography
B. Digital signatures and hashing
C. Salting and key stretching
D. Obfuscation and encoding
Correct Answer: B
Rationale:
Digital signatures provide non-repudiation and authentication by proving the sender's identity, while hashing
ensures message integrity by detecting any alterations. Together, these cryptographic services achieve both
sender authenticity and content integrity. Symmetric encryption provides confidentiality but not authentication, and
steganography hides data rather than protecting its integrity.
Q6 Question 6 of 75
An organization is designing a new data center and wants to implement physical security zones that
progressively restrict access as one moves closer to critical systems. The innermost zone houses the
core servers. Which concept best describes this layered physical security approach?
A. Security through obscurity
B. Concentric circles of protection
C. Single sign-on
D. Flat security model
Correct Answer: B
Rationale:
Concentric circles of protection is a physical security concept that implements multiple layers of security controls
arranged in zones, with the most critical assets protected by the innermost layers. Each successive layer provides
additional protection, creating a defense-in-depth approach for physical security. This is fundamentally different
from a flat model or authentication mechanisms.
WGU D488 Cybersecurity Architecture & Engineering 2026/2027 | Passing Score: 80% | Page 4 of 42
OBJECTIVE ASSESSMENT - EXAM
WGU D488 Final Exam Test Bank
Cybersecurity Architecture and Engineering
Questions and Answers | Grade A | 100% Correct (Verified Solutions)
75 100%
QUESTIONS VERIFIED ANSWERS EDITION
TOPICS COVERED
Security Architecture & Design Principles Risk Management, Compliance & Governance
Identity & Access Management (IAM) Secure Engineering, DevSecOps & Emerging Threats
Network Security & Secure Communications NIST Frameworks & Cybersecurity Standards
COVER PAGE - 1
, SECTION 1 | Security Architecture & Design Principles | Q1-Q15 | D488 2026/2027
Q1 Question 1 of 75
A financial institution is designing a new online banking platform. The security architect wants to ensure
that if one security control fails, additional controls remain in place to protect customer data. Which
foundational security principle is the architect applying?
A. Security through obscurity
B. Defense in depth
C. Single point of failure
D. Fail open
Correct Answer: B
Rationale:
Defense in depth is a security strategy that employs multiple layers of security controls throughout an IT system. If
one layer fails, subsequent layers continue to protect the asset. This approach assumes no single control is
perfect and redundancy strengthens overall security posture. Security through obscurity relies on hiding
information, while fail open is the opposite of secure design.
Q2 Question 2 of 75
A healthcare organization is migrating its patient records system to a cloud environment. The CISO
mandates that no user or device should be trusted by default, regardless of whether they are inside or
outside the network perimeter. Which architectural model aligns with this requirement?
A. Traditional perimeter-based security
B. Zero Trust architecture
C. Demilitarized zone (DMZ) model
D. Flat network topology
Correct Answer: B
Rationale:
Zero Trust architecture operates on the principle of 'never trust, always verify,' requiring continuous authentication
and authorization for every user and device attempting to access resources. Unlike traditional perimeter-based
models that trust internal users, Zero Trust assumes breach and verifies every request as though it originated
from an uncontrolled network.
WGU D488 Cybersecurity Architecture & Engineering 2026/2027 | Passing Score: 80% | Page 2 of 42
, Q3 Question 3 of 75
An e-commerce company needs to protect customer credit card data stored in its database. The security
team decides to transform the data using an algorithm that makes it computationally infeasible to reverse
without a key. Which cryptographic technique should they implement?
A. Hashing with SHA-256
B. Symmetric encryption with AES-256
C. Base64 encoding
D. Tokenization
Correct Answer: B
Rationale:
Symmetric encryption with AES-256 transforms plaintext data into ciphertext using a secret key, making it
computationally infeasible to reverse without the key. This is the appropriate method for protecting stored
sensitive data. Hashing is one-way and cannot be reversed for legitimate use, Base64 is not encryption, and
tokenization replaces data rather than transforming it.
Q4 Question 4 of 75
A software development firm is building a new application and wants to identify potential security flaws
during the design phase before any code is written. Which structured approach should the security team
use to systematically identify and prioritize threats?
A. Penetration testing
B. Threat modeling using STRIDE
C. Vulnerability scanning
D. Code review
Correct Answer: B
Rationale:
Threat modeling using STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service,
Elevation of Privilege) is a structured approach used during the design phase to identify and categorize potential
security threats before implementation. Penetration testing and vulnerability scanning occur after deployment,
while code review happens during development.
WGU D488 Cybersecurity Architecture & Engineering 2026/2027 | Passing Score: 80% | Page 3 of 42
, Q5 Question 5 of 75
A government contractor must ensure that its secure messaging system provides proof that a message
was sent by a specific sender and has not been altered in transit. Which two cryptographic services are
required to achieve both goals?
A. Symmetric encryption and steganography
B. Digital signatures and hashing
C. Salting and key stretching
D. Obfuscation and encoding
Correct Answer: B
Rationale:
Digital signatures provide non-repudiation and authentication by proving the sender's identity, while hashing
ensures message integrity by detecting any alterations. Together, these cryptographic services achieve both
sender authenticity and content integrity. Symmetric encryption provides confidentiality but not authentication, and
steganography hides data rather than protecting its integrity.
Q6 Question 6 of 75
An organization is designing a new data center and wants to implement physical security zones that
progressively restrict access as one moves closer to critical systems. The innermost zone houses the
core servers. Which concept best describes this layered physical security approach?
A. Security through obscurity
B. Concentric circles of protection
C. Single sign-on
D. Flat security model
Correct Answer: B
Rationale:
Concentric circles of protection is a physical security concept that implements multiple layers of security controls
arranged in zones, with the most critical assets protected by the innermost layers. Each successive layer provides
additional protection, creating a defense-in-depth approach for physical security. This is fundamentally different
from a flat model or authentication mechanisms.
WGU D488 Cybersecurity Architecture & Engineering 2026/2027 | Passing Score: 80% | Page 4 of 42
