WGU D418 – Secure Network Design
Final Prep Exam (Latest Update
2026/2027) Questions and Verified
Answers | 100% Correct | Grade A.
1. Which security principle requires limiting user access rights to only
the resources necessary for their job functions?
A. Defense in depth
B. Least privilege
C. Separation of duties
D. Zero trust
Answer: B. Least privilege
Rationale: The principle of least privilege ensures that users,
applications, and systems receive only the minimum permissions
required to perform their assigned tasks. This reduces the potential
damage caused by compromised accounts or accidental misuse.
2. A network architect is designing a secure enterprise network. Which
technology is most appropriate for creating isolated network
segments based on business functions?
A. NAT
B. VLANs
,C. Port mirroring
D. Load balancing
Answer: B. VLANs
Rationale: Virtual LANs (VLANs) logically separate devices into different
broadcast domains, allowing organizations to isolate departments,
services, or security zones without requiring separate physical networks.
3. Which security architecture model assumes no user or device
should automatically be trusted, even if it is inside the corporate
network?
A. Perimeter security model
B. Castle-and-moat model
C. Zero trust architecture
D. Open access model
Answer: C. Zero trust architecture
Rationale: Zero trust requires continuous verification of users, devices,
and applications regardless of location. It assumes that threats can exist
both outside and inside the traditional network perimeter.
4. Which firewall type provides the highest level of application-layer
inspection?
A. Packet-filtering firewall
B. Stateful firewall
C. Next-generation firewall
D. Circuit-level gateway
,Answer: C. Next-generation firewall
Rationale: Next-generation firewalls (NGFWs) provide advanced
capabilities such as deep packet inspection, application awareness,
intrusion prevention, and user-based controls beyond traditional firewall
functions.
5. A company wants to protect public-facing web servers while
preventing direct access to internal systems. Which network design is
most appropriate?
A. Flat network
B. DMZ architecture
C. Peer-to-peer architecture
D. Single broadcast domain
Answer: B. DMZ architecture
Rationale: A demilitarized zone (DMZ) places public-facing services in a
separate network segment, reducing the risk that a compromised
external-facing server can directly expose internal resources.
6. Which protocol is commonly used to securely manage network
devices remotely?
A. Telnet
B. FTP
C. SSH
D. HTTP
Answer: C. SSH
, Rationale: Secure Shell (SSH) encrypts remote administrative sessions,
protecting credentials and commands from interception. Telnet and
HTTP transmit information without adequate encryption.
7. Which security control is designed to detect and prevent malicious
network activity in real time?
A. IDS
B. IPS
C. VPN
D. Proxy server
Answer: B. IPS
Rationale: An Intrusion Prevention System (IPS) actively analyzes
network traffic and can automatically block detected malicious activity.
An IDS primarily detects and alerts without directly preventing attacks.
8. Which network security technology creates an encrypted tunnel
across an untrusted network?
A. VLAN
B. VPN
C. NAT
D. DHCP
Answer: B. VPN
Rationale: Virtual Private Networks (VPNs) provide encrypted
communication channels over public or untrusted networks, protecting
confidentiality and integrity of transmitted data.
Final Prep Exam (Latest Update
2026/2027) Questions and Verified
Answers | 100% Correct | Grade A.
1. Which security principle requires limiting user access rights to only
the resources necessary for their job functions?
A. Defense in depth
B. Least privilege
C. Separation of duties
D. Zero trust
Answer: B. Least privilege
Rationale: The principle of least privilege ensures that users,
applications, and systems receive only the minimum permissions
required to perform their assigned tasks. This reduces the potential
damage caused by compromised accounts or accidental misuse.
2. A network architect is designing a secure enterprise network. Which
technology is most appropriate for creating isolated network
segments based on business functions?
A. NAT
B. VLANs
,C. Port mirroring
D. Load balancing
Answer: B. VLANs
Rationale: Virtual LANs (VLANs) logically separate devices into different
broadcast domains, allowing organizations to isolate departments,
services, or security zones without requiring separate physical networks.
3. Which security architecture model assumes no user or device
should automatically be trusted, even if it is inside the corporate
network?
A. Perimeter security model
B. Castle-and-moat model
C. Zero trust architecture
D. Open access model
Answer: C. Zero trust architecture
Rationale: Zero trust requires continuous verification of users, devices,
and applications regardless of location. It assumes that threats can exist
both outside and inside the traditional network perimeter.
4. Which firewall type provides the highest level of application-layer
inspection?
A. Packet-filtering firewall
B. Stateful firewall
C. Next-generation firewall
D. Circuit-level gateway
,Answer: C. Next-generation firewall
Rationale: Next-generation firewalls (NGFWs) provide advanced
capabilities such as deep packet inspection, application awareness,
intrusion prevention, and user-based controls beyond traditional firewall
functions.
5. A company wants to protect public-facing web servers while
preventing direct access to internal systems. Which network design is
most appropriate?
A. Flat network
B. DMZ architecture
C. Peer-to-peer architecture
D. Single broadcast domain
Answer: B. DMZ architecture
Rationale: A demilitarized zone (DMZ) places public-facing services in a
separate network segment, reducing the risk that a compromised
external-facing server can directly expose internal resources.
6. Which protocol is commonly used to securely manage network
devices remotely?
A. Telnet
B. FTP
C. SSH
D. HTTP
Answer: C. SSH
, Rationale: Secure Shell (SSH) encrypts remote administrative sessions,
protecting credentials and commands from interception. Telnet and
HTTP transmit information without adequate encryption.
7. Which security control is designed to detect and prevent malicious
network activity in real time?
A. IDS
B. IPS
C. VPN
D. Proxy server
Answer: B. IPS
Rationale: An Intrusion Prevention System (IPS) actively analyzes
network traffic and can automatically block detected malicious activity.
An IDS primarily detects and alerts without directly preventing attacks.
8. Which network security technology creates an encrypted tunnel
across an untrusted network?
A. VLAN
B. VPN
C. NAT
D. DHCP
Answer: B. VPN
Rationale: Virtual Private Networks (VPNs) provide encrypted
communication channels over public or untrusted networks, protecting
confidentiality and integrity of transmitted data.
