WGU D414 – Cyber Operations Final
Prep Exam (Latest Update 2026/2027)
Questions and Verified Answers | 100%
Correct | Grade A.
1. Which cybersecurity function focuses on continuously monitoring
networks, systems, and endpoints for signs of malicious activity?
A. Governance
B. Compliance
C. Security Operations
D. Software Development
Rationale: Security Operations is responsible for the ongoing
monitoring, detection, analysis, and response to security events.
Analysts working in a Security Operations Center (SOC) use monitoring
tools, threat intelligence, and incident response procedures to identify
and mitigate cyber threats before they cause significant damage.
2. Which framework is organized around the five core functions:
Identify, Protect, Detect, Respond, and Recover?
A. ISO 9001
B. NIST Cybersecurity Framework (CSF)
,C. PCI DSS
D. COBIT
Rationale: The NIST Cybersecurity Framework (CSF) provides a
structured approach to managing cybersecurity risks through its five
core functions. Organizations of all sizes use the framework to improve
security posture while aligning cybersecurity activities with business
objectives.
3. What is the primary purpose of a Security Information and Event
Management (SIEM) system?
A. Encrypt sensitive files
B. Patch operating systems
C. Collect, correlate, and analyze security logs
D. Configure firewall rules
Rationale: SIEM platforms aggregate logs from multiple sources,
correlate events, generate alerts, and provide analysts with centralized
visibility into security incidents. This significantly improves detection and
investigation capabilities.
4. Which protocol securely encrypts remote administrative sessions?
A. Telnet
B. FTP
C. SSH
D. SNMPv1
,Rationale: Secure Shell (SSH) encrypts authentication credentials and
session traffic, protecting against interception and unauthorized access.
Telnet transmits data in plaintext and should not be used for secure
administration.
5. An analyst notices repeated login failures followed by a successful
login from the same IP address. What attack is most likely
occurring?
A. SQL Injection
B. Cross-Site Scripting
C. Brute-force attack
D. ARP Spoofing
Rationale: Brute-force attacks involve repeatedly attempting passwords
until a valid credential is discovered. Multiple failed attempts followed
by a successful login are a common indicator requiring immediate
investigation.
6. Which tool is commonly used to capture and analyze network
packets?
A. Nessus
B. Metasploit
C. Wireshark
D. Hashcat
, Rationale: Wireshark captures live network traffic and allows analysts to
inspect packets in detail. It is invaluable for troubleshooting, incident
response, malware analysis, and protocol examination.
7. What is the primary purpose of a firewall?
A. Encrypt files
B. Filter network traffic based on predefined rules
C. Remove malware
D. Compress network packets
Rationale: Firewalls enforce security policies by allowing or blocking
network traffic according to configured rules. They provide an essential
layer of defense between trusted and untrusted networks.
8. Which log source would most likely record successful and failed
Windows user authentications?
A. DNS logs
B. Proxy logs
C. Windows Security Event Logs
D. DHCP logs
Rationale: Windows Security Event Logs record authentication events,
account changes, privilege usage, and other security-relevant activities.
These logs are among the first examined during investigations involving
unauthorized access.
Prep Exam (Latest Update 2026/2027)
Questions and Verified Answers | 100%
Correct | Grade A.
1. Which cybersecurity function focuses on continuously monitoring
networks, systems, and endpoints for signs of malicious activity?
A. Governance
B. Compliance
C. Security Operations
D. Software Development
Rationale: Security Operations is responsible for the ongoing
monitoring, detection, analysis, and response to security events.
Analysts working in a Security Operations Center (SOC) use monitoring
tools, threat intelligence, and incident response procedures to identify
and mitigate cyber threats before they cause significant damage.
2. Which framework is organized around the five core functions:
Identify, Protect, Detect, Respond, and Recover?
A. ISO 9001
B. NIST Cybersecurity Framework (CSF)
,C. PCI DSS
D. COBIT
Rationale: The NIST Cybersecurity Framework (CSF) provides a
structured approach to managing cybersecurity risks through its five
core functions. Organizations of all sizes use the framework to improve
security posture while aligning cybersecurity activities with business
objectives.
3. What is the primary purpose of a Security Information and Event
Management (SIEM) system?
A. Encrypt sensitive files
B. Patch operating systems
C. Collect, correlate, and analyze security logs
D. Configure firewall rules
Rationale: SIEM platforms aggregate logs from multiple sources,
correlate events, generate alerts, and provide analysts with centralized
visibility into security incidents. This significantly improves detection and
investigation capabilities.
4. Which protocol securely encrypts remote administrative sessions?
A. Telnet
B. FTP
C. SSH
D. SNMPv1
,Rationale: Secure Shell (SSH) encrypts authentication credentials and
session traffic, protecting against interception and unauthorized access.
Telnet transmits data in plaintext and should not be used for secure
administration.
5. An analyst notices repeated login failures followed by a successful
login from the same IP address. What attack is most likely
occurring?
A. SQL Injection
B. Cross-Site Scripting
C. Brute-force attack
D. ARP Spoofing
Rationale: Brute-force attacks involve repeatedly attempting passwords
until a valid credential is discovered. Multiple failed attempts followed
by a successful login are a common indicator requiring immediate
investigation.
6. Which tool is commonly used to capture and analyze network
packets?
A. Nessus
B. Metasploit
C. Wireshark
D. Hashcat
, Rationale: Wireshark captures live network traffic and allows analysts to
inspect packets in detail. It is invaluable for troubleshooting, incident
response, malware analysis, and protocol examination.
7. What is the primary purpose of a firewall?
A. Encrypt files
B. Filter network traffic based on predefined rules
C. Remove malware
D. Compress network packets
Rationale: Firewalls enforce security policies by allowing or blocking
network traffic according to configured rules. They provide an essential
layer of defense between trusted and untrusted networks.
8. Which log source would most likely record successful and failed
Windows user authentications?
A. DNS logs
B. Proxy logs
C. Windows Security Event Logs
D. DHCP logs
Rationale: Windows Security Event Logs record authentication events,
account changes, privilege usage, and other security-relevant activities.
These logs are among the first examined during investigations involving
unauthorized access.
