WGU D488 Cybersecurity Architecture
and Engineering OA Test Bank |
2026–2027
A+ Verified Certification Study Guide – 360 Questions | 8 Domains | 45 Questions
Each
✓ A+ VERIFIED – 2026/2027 EDITION
8 360 45 100%
DOMAINS QUESTIONS PER DOMAIN VERIFIED
This test bank is designed for self-assessment and exam preparation. Use it to identify knowledge gaps, build confidence, and
reinforce core concepts before attempting the WGU D488 objective assessment.
© 2026–2027 | All rights reserved. For personal study use only.
, How to Use This Test Bank
This test bank contains 8 sections (domains) aligned with the WGU D488 Cybersecurity Architecture and
Engineering competency areas. Each section contains 45 questions, complete with answer keys and detailed
rationales.
Domain 1: Security Architecture Principles & Threat Models — 45 Questions
Domain 2: Risk Management & Governance — 45 Questions
Domain 3: Network Security & Secure Communications — 45 Questions
Domain 4: Identity & Access Management — 45 Questions
Domain 5: Cryptography & Data Protection — 45 Questions
Domain 6: Secure Software Development & Engineering — 45 Questions
Domain 7: Security Operations, Monitoring & Incident Response — 45 Questions
Domain 8: Compliance, Auditing & Cloud Security Architecture — 45 Questions
Study Tips
• Read each question carefully. The scenario-based questions are designed to test applied knowledge, not
just memorization.
• Review the rationale for every answer, even for questions you answer correctly. The rationale explains the
underlying security principle.
• Focus on the “best” answer in scenario questions. More than one option may be partially correct, but only
one is the most appropriate.
• Use the answer key to track progress. Revisit weak domains until you consistently score above 85%.
WGU D488 Cybersecurity Architecture and Engineering OA Test Bank | 2026–2027 Page 2
, SECTION 1: Security Architecture Principles & Threat
Models
Q1. A financial services firm is designing a new security architecture for its trading platform. The
CISO wants to ensure that security controls are built into the system from the initial design phase
rather than added later. Which security framework best supports this approach?
A. NIST SP 800-53
B. ISO/IEC 27001
C. NIST SP 800-160 (Systems Security Engineering)
D. COBIT 2019
Answer: C
Rationale: NIST SP 800-160 focuses on systems security engineering, integrating security into the system development
lifecycle from the earliest stages. While NIST 800-53 and ISO 27001 provide control catalogs, and COBIT governs IT
management, 800-160 specifically emphasizes built-in security through engineering principles.
Q2. An enterprise is adopting a zero trust architecture across its hybrid cloud environment. The
security team must design a model that assumes no implicit trust for any entity, regardless of
network location. Which architectural principle is most central to implementing this requirement?
A. Perimeter-based firewall segmentation
B. Least privilege and continuous verification of every access request
C. Network Address Translation at all gateways
D. Flat internal network topology with strong endpoint antivirus
Answer: B
Rationale: Zero trust architectures operate on the principle of never trusting and always verifying, requiring least privilege
and continuous authentication for every access request. Perimeter-based models, NAT alone, and flat topologies contradict
zero trust fundamentals by assuming internal trust.
Q3. A defense contractor is required to meet CMMC Level 3 certification. The organization's security
architecture must demonstrate that security practices are maintained and reviewed at regular
intervals. Which CMMC domain most directly addresses sustained security process maturity?
A. Asset Management
B. Risk Management
C. Situational Awareness
D. Security Process Maturity and Institutionalization
Answer: D
Rationale: CMMC Level 3 emphasizes institutionalization of security processes through maturity practices that ensure
processes are maintained, reviewed, and improved over time. While asset management, risk management, and situational
awareness are important domains, process maturity and institutionalization specifically address sustained practice.
Q4. A healthcare organization is designing a new electronic health record system. The security
architect must select a framework that provides a comprehensive catalog of security and privacy
controls specifically tailored for federal information systems. Which framework is most appropriate?
A. NIST SP 800-53 Rev 5
WGU D488 Cybersecurity Architecture and Engineering OA Test Bank | 2026–2027 Page 3
, B. PCI DSS v4.0
C. HIPAA Security Rule alone
D. SOC 2 Type II
Answer: A
Rationale: NIST SP 800-53 Rev 5 provides a comprehensive catalog of security and privacy controls for federal information
systems, and healthcare organizations often align with it for robust control mapping. PCI DSS focuses on payment card
data, the HIPAA Security Rule is regulatory but less granular, and SOC 2 is an attestation framework.
Q5. A multinational corporation is consolidating security architecture standards across subsidiaries
in North America, Europe, and Asia. The CISO wants a single internationally recognized framework
for information security management systems. Which standard best meets this requirement?
A. NIST Cybersecurity Framework
B. ISO/IEC 27001:2022
C. CIS Controls v8
D. FedRAMP
Answer: B
Rationale: ISO/IEC 27001:2022 is an internationally recognized standard for information security management systems,
making it ideal for multinational standardization. The NIST CSF and CIS Controls are excellent guidance but not certifiable
management system standards, while FedRAMP is U.S.-specific cloud authorization.
Q6. A cloud service provider is building a security architecture to support government workloads.
The architecture must include standardized security assessment, authorization, and continuous
monitoring for cloud products and services. Which U.S. government program is designed for this
purpose?
A. FISMA
B. FedRAMP
C. NIST RMF
D. DFARS 7012
Answer: B
Rationale: FedRAMP standardizes security assessment, authorization, and continuous monitoring for cloud services used by
federal agencies. FISMA governs federal information security broadly, NIST RMF provides a risk management process, and
DFARS 7012 addresses defense contractor cybersecurity requirements.
Q7. An automotive manufacturer is designing the security architecture for connected vehicles. The
architecture must account for safety-critical systems where a cybersecurity failure could cause
physical harm. Which systems engineering approach best integrates security with safety in this
context?
A. Agile software development with daily standups
B. NIST SP 800-160 systems security engineering with safety considerations
C. ISO 9001 quality management
D. ITIL service management
Answer: B
Rationale: NIST SP 800-160 systems security engineering explicitly addresses the integration of security with safety and
resiliency in safety-critical systems. Agile development, ISO 9001, and ITIL do not specifically integrate cybersecurity with
safety engineering for automotive or physical systems.
WGU D488 Cybersecurity Architecture and Engineering OA Test Bank | 2026–2027 Page 4
and Engineering OA Test Bank |
2026–2027
A+ Verified Certification Study Guide – 360 Questions | 8 Domains | 45 Questions
Each
✓ A+ VERIFIED – 2026/2027 EDITION
8 360 45 100%
DOMAINS QUESTIONS PER DOMAIN VERIFIED
This test bank is designed for self-assessment and exam preparation. Use it to identify knowledge gaps, build confidence, and
reinforce core concepts before attempting the WGU D488 objective assessment.
© 2026–2027 | All rights reserved. For personal study use only.
, How to Use This Test Bank
This test bank contains 8 sections (domains) aligned with the WGU D488 Cybersecurity Architecture and
Engineering competency areas. Each section contains 45 questions, complete with answer keys and detailed
rationales.
Domain 1: Security Architecture Principles & Threat Models — 45 Questions
Domain 2: Risk Management & Governance — 45 Questions
Domain 3: Network Security & Secure Communications — 45 Questions
Domain 4: Identity & Access Management — 45 Questions
Domain 5: Cryptography & Data Protection — 45 Questions
Domain 6: Secure Software Development & Engineering — 45 Questions
Domain 7: Security Operations, Monitoring & Incident Response — 45 Questions
Domain 8: Compliance, Auditing & Cloud Security Architecture — 45 Questions
Study Tips
• Read each question carefully. The scenario-based questions are designed to test applied knowledge, not
just memorization.
• Review the rationale for every answer, even for questions you answer correctly. The rationale explains the
underlying security principle.
• Focus on the “best” answer in scenario questions. More than one option may be partially correct, but only
one is the most appropriate.
• Use the answer key to track progress. Revisit weak domains until you consistently score above 85%.
WGU D488 Cybersecurity Architecture and Engineering OA Test Bank | 2026–2027 Page 2
, SECTION 1: Security Architecture Principles & Threat
Models
Q1. A financial services firm is designing a new security architecture for its trading platform. The
CISO wants to ensure that security controls are built into the system from the initial design phase
rather than added later. Which security framework best supports this approach?
A. NIST SP 800-53
B. ISO/IEC 27001
C. NIST SP 800-160 (Systems Security Engineering)
D. COBIT 2019
Answer: C
Rationale: NIST SP 800-160 focuses on systems security engineering, integrating security into the system development
lifecycle from the earliest stages. While NIST 800-53 and ISO 27001 provide control catalogs, and COBIT governs IT
management, 800-160 specifically emphasizes built-in security through engineering principles.
Q2. An enterprise is adopting a zero trust architecture across its hybrid cloud environment. The
security team must design a model that assumes no implicit trust for any entity, regardless of
network location. Which architectural principle is most central to implementing this requirement?
A. Perimeter-based firewall segmentation
B. Least privilege and continuous verification of every access request
C. Network Address Translation at all gateways
D. Flat internal network topology with strong endpoint antivirus
Answer: B
Rationale: Zero trust architectures operate on the principle of never trusting and always verifying, requiring least privilege
and continuous authentication for every access request. Perimeter-based models, NAT alone, and flat topologies contradict
zero trust fundamentals by assuming internal trust.
Q3. A defense contractor is required to meet CMMC Level 3 certification. The organization's security
architecture must demonstrate that security practices are maintained and reviewed at regular
intervals. Which CMMC domain most directly addresses sustained security process maturity?
A. Asset Management
B. Risk Management
C. Situational Awareness
D. Security Process Maturity and Institutionalization
Answer: D
Rationale: CMMC Level 3 emphasizes institutionalization of security processes through maturity practices that ensure
processes are maintained, reviewed, and improved over time. While asset management, risk management, and situational
awareness are important domains, process maturity and institutionalization specifically address sustained practice.
Q4. A healthcare organization is designing a new electronic health record system. The security
architect must select a framework that provides a comprehensive catalog of security and privacy
controls specifically tailored for federal information systems. Which framework is most appropriate?
A. NIST SP 800-53 Rev 5
WGU D488 Cybersecurity Architecture and Engineering OA Test Bank | 2026–2027 Page 3
, B. PCI DSS v4.0
C. HIPAA Security Rule alone
D. SOC 2 Type II
Answer: A
Rationale: NIST SP 800-53 Rev 5 provides a comprehensive catalog of security and privacy controls for federal information
systems, and healthcare organizations often align with it for robust control mapping. PCI DSS focuses on payment card
data, the HIPAA Security Rule is regulatory but less granular, and SOC 2 is an attestation framework.
Q5. A multinational corporation is consolidating security architecture standards across subsidiaries
in North America, Europe, and Asia. The CISO wants a single internationally recognized framework
for information security management systems. Which standard best meets this requirement?
A. NIST Cybersecurity Framework
B. ISO/IEC 27001:2022
C. CIS Controls v8
D. FedRAMP
Answer: B
Rationale: ISO/IEC 27001:2022 is an internationally recognized standard for information security management systems,
making it ideal for multinational standardization. The NIST CSF and CIS Controls are excellent guidance but not certifiable
management system standards, while FedRAMP is U.S.-specific cloud authorization.
Q6. A cloud service provider is building a security architecture to support government workloads.
The architecture must include standardized security assessment, authorization, and continuous
monitoring for cloud products and services. Which U.S. government program is designed for this
purpose?
A. FISMA
B. FedRAMP
C. NIST RMF
D. DFARS 7012
Answer: B
Rationale: FedRAMP standardizes security assessment, authorization, and continuous monitoring for cloud services used by
federal agencies. FISMA governs federal information security broadly, NIST RMF provides a risk management process, and
DFARS 7012 addresses defense contractor cybersecurity requirements.
Q7. An automotive manufacturer is designing the security architecture for connected vehicles. The
architecture must account for safety-critical systems where a cybersecurity failure could cause
physical harm. Which systems engineering approach best integrates security with safety in this
context?
A. Agile software development with daily standups
B. NIST SP 800-160 systems security engineering with safety considerations
C. ISO 9001 quality management
D. ITIL service management
Answer: B
Rationale: NIST SP 800-160 systems security engineering explicitly addresses the integration of security with safety and
resiliency in safety-critical systems. Agile development, ISO 9001, and ITIL do not specifically integrate cybersecurity with
safety engineering for automotive or physical systems.
WGU D488 Cybersecurity Architecture and Engineering OA Test Bank | 2026–2027 Page 4
