WGU D488
Cybersecurity Architecture Engineering
Comprehensive Review Examination
Objective Assessment Test Bank | 70 Questions
Total Questions: 70
Time Allocation: 120 Minutes Recommended
Question Format: Multiple Choice (A, B, C, D)
Content Areas: Cybersecurity Architecture & Engineering
Cognitive Levels: Recall (30%) | Application (50%) | Analysis (20%)
,Q1: Which component of the NIST Cybersecurity Framework (CSF) 2.0 focuses on
organizational understanding and management of cybersecurity risk to systems, people,
assets, data, and capabilities?
A. Protect (PR)
B. Detect (DE)
**C. Govern (GV) [CORRECT]**
D. Respond (RS)
**Correct Answer: C**
**Rationale: Correct because the Govern (GV) function is unique to CSF 2.0 and establishes the
foundation for all other framework functions by focusing on how an organization's cybersecurity risk
management strategy is governed and how that governance informs organizational priorities. This
matches the hierarchical structure where GV provides context and oversight for Identify, Protect,
Detect, Respond, and Recover functions.**
Q2: A financial services organization is implementing Zero Trust Architecture (ZTA) to
replace their perimeter-based security model. Which principle MOST directly supports
the requirement that no user or system should be inherently trusted based on network
location?
A. Implement strong password complexity requirements
B. Deploy next-generation firewalls at network boundaries
**C. Verify explicitly using all available data points including identity, location, device health,
service, workload, data classification, and anomalies [CORRECT]**
D. Establish a DMZ for externally-facing applications
**Correct Answer: C**
**Rationale: Correct because "Verify Explicitly" is one of the three core tenets of Zero Trust
Architecture defined by NIST SP 800-207, which mandates authenticating and authorizing every access
request using all available data points rather than trusting based on network location alone. Priority is
always authenticate and authorize before accessing resources regardless of location.**
Q3: A security architect reviews a proposed network design that includes: (1) a perimeter
firewall with IDS capabilities, (2) network segmentation using VLANs, (3) host-based
intrusion prevention on critical servers, (4) application-level encryption for sensitive data,
and (5) mandatory security awareness training for all employees. This implementation
BEST demonstrates which fundamental security design principle?
A. Least Privilege
B. Separation of Duties
**C. Defense in Depth [CORRECT]**
D. Fail Secure
**Correct Answer: C**
**Rationale: Correct because Defense in Depth (also called layered security) employs multiple
overlapping security controls at different layers (network, host, application, physical, administrative)
so that if one control fails, others continue to provide protection. This matches the comprehensive
multi-layered approach spanning technical, procedural, and personnel controls demonstrated in this
scenario.**
, Q4: According to ISO/IEC 27001:2022, what is the PRIMARY purpose of Annex A controls in
the context of an Information Security Management System (ISMS)?
A. To provide mandatory technical specifications for encryption algorithms
B. To establish legal requirements for data breach notification
**C. To present a catalog of information security controls that organizations can select and
implement based on their risk assessment results [CORRECT]**
D. To define certification requirements for security professionals
**Correct Answer: C**
**Rationale: Correct because Annex A of ISO/IEC 27001:2022 contains 93 controls organized into 4
themes (Organizational, People, Physical, Technological) that serve as a reference set from which
organizations select applicable controls based on their Statement of Applicability (SoA) derived from
risk assessment. This matches the risk-based approach central to ISMS implementation.**
Q5: An enterprise architecture team uses TOGAF ADM to develop their organization's
security architecture. During Phase C (Data Architecture), they identify several data
classification schemes across different business units that conflict with each other.
According to TOGAF principles, what should be the NEXT step?
A. Immediately implement the most restrictive classification scheme across all units
B. Defer classification decisions until Phase D (Technology Architecture)
**C. Develop gap analysis and reconciliation recommendations as part of the Architecture
Development Cycle, ensuring alignment with business principles and stakeholder concerns
[CORRECT]**
D. Escalate to the CEO for executive decision before proceeding
**Correct Answer: C**
**Rationale: Correct because TOGAF ADM emphasizes iterative development with formal checkpoint
reviews, and gaps identified during any phase should be documented with resolution approaches that
align with architectural principles and stakeholder requirements. This matches the ADM cycle's
emphasis on continuous validation and gap analysis throughout architecture development phases.**
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
━━━━━━━
SCENARIO 1 - Healthcare Organization Cloud Migration
HealthFirst Medical Center is migrating their Electronic Health Record (EHR) system and patient
portal to a major cloud service provider (AWS). The organization handles Protected Health
Information (PHI) subject to HIPAA regulations. Their current infrastructure includes: 2,500
endpoints across 15 facilities, a legacy patient scheduling system requiring Windows Server 2016,
telemedicine applications processing video consultations, and integration partners including
pharmacies and insurance companies. The CISO has identified the following concerns: (1) ensuring
encrypted data both at rest and in transit, (2) maintaining audit trails for all PHI access, (3)
establishing clear boundaries of responsibility between HealthFirst and the cloud provider, (4)
enabling secure remote access for 200 clinical staff members, and (5) validating that the cloud
environment meets healthcare compliance requirements.
Q6: Based on the scenario above, which shared responsibility model component is
EXCLUSIVELY the responsibility of the cloud service provider when HealthFirst uses
Cybersecurity Architecture Engineering
Comprehensive Review Examination
Objective Assessment Test Bank | 70 Questions
Total Questions: 70
Time Allocation: 120 Minutes Recommended
Question Format: Multiple Choice (A, B, C, D)
Content Areas: Cybersecurity Architecture & Engineering
Cognitive Levels: Recall (30%) | Application (50%) | Analysis (20%)
,Q1: Which component of the NIST Cybersecurity Framework (CSF) 2.0 focuses on
organizational understanding and management of cybersecurity risk to systems, people,
assets, data, and capabilities?
A. Protect (PR)
B. Detect (DE)
**C. Govern (GV) [CORRECT]**
D. Respond (RS)
**Correct Answer: C**
**Rationale: Correct because the Govern (GV) function is unique to CSF 2.0 and establishes the
foundation for all other framework functions by focusing on how an organization's cybersecurity risk
management strategy is governed and how that governance informs organizational priorities. This
matches the hierarchical structure where GV provides context and oversight for Identify, Protect,
Detect, Respond, and Recover functions.**
Q2: A financial services organization is implementing Zero Trust Architecture (ZTA) to
replace their perimeter-based security model. Which principle MOST directly supports
the requirement that no user or system should be inherently trusted based on network
location?
A. Implement strong password complexity requirements
B. Deploy next-generation firewalls at network boundaries
**C. Verify explicitly using all available data points including identity, location, device health,
service, workload, data classification, and anomalies [CORRECT]**
D. Establish a DMZ for externally-facing applications
**Correct Answer: C**
**Rationale: Correct because "Verify Explicitly" is one of the three core tenets of Zero Trust
Architecture defined by NIST SP 800-207, which mandates authenticating and authorizing every access
request using all available data points rather than trusting based on network location alone. Priority is
always authenticate and authorize before accessing resources regardless of location.**
Q3: A security architect reviews a proposed network design that includes: (1) a perimeter
firewall with IDS capabilities, (2) network segmentation using VLANs, (3) host-based
intrusion prevention on critical servers, (4) application-level encryption for sensitive data,
and (5) mandatory security awareness training for all employees. This implementation
BEST demonstrates which fundamental security design principle?
A. Least Privilege
B. Separation of Duties
**C. Defense in Depth [CORRECT]**
D. Fail Secure
**Correct Answer: C**
**Rationale: Correct because Defense in Depth (also called layered security) employs multiple
overlapping security controls at different layers (network, host, application, physical, administrative)
so that if one control fails, others continue to provide protection. This matches the comprehensive
multi-layered approach spanning technical, procedural, and personnel controls demonstrated in this
scenario.**
, Q4: According to ISO/IEC 27001:2022, what is the PRIMARY purpose of Annex A controls in
the context of an Information Security Management System (ISMS)?
A. To provide mandatory technical specifications for encryption algorithms
B. To establish legal requirements for data breach notification
**C. To present a catalog of information security controls that organizations can select and
implement based on their risk assessment results [CORRECT]**
D. To define certification requirements for security professionals
**Correct Answer: C**
**Rationale: Correct because Annex A of ISO/IEC 27001:2022 contains 93 controls organized into 4
themes (Organizational, People, Physical, Technological) that serve as a reference set from which
organizations select applicable controls based on their Statement of Applicability (SoA) derived from
risk assessment. This matches the risk-based approach central to ISMS implementation.**
Q5: An enterprise architecture team uses TOGAF ADM to develop their organization's
security architecture. During Phase C (Data Architecture), they identify several data
classification schemes across different business units that conflict with each other.
According to TOGAF principles, what should be the NEXT step?
A. Immediately implement the most restrictive classification scheme across all units
B. Defer classification decisions until Phase D (Technology Architecture)
**C. Develop gap analysis and reconciliation recommendations as part of the Architecture
Development Cycle, ensuring alignment with business principles and stakeholder concerns
[CORRECT]**
D. Escalate to the CEO for executive decision before proceeding
**Correct Answer: C**
**Rationale: Correct because TOGAF ADM emphasizes iterative development with formal checkpoint
reviews, and gaps identified during any phase should be documented with resolution approaches that
align with architectural principles and stakeholder requirements. This matches the ADM cycle's
emphasis on continuous validation and gap analysis throughout architecture development phases.**
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
━━━━━━━
SCENARIO 1 - Healthcare Organization Cloud Migration
HealthFirst Medical Center is migrating their Electronic Health Record (EHR) system and patient
portal to a major cloud service provider (AWS). The organization handles Protected Health
Information (PHI) subject to HIPAA regulations. Their current infrastructure includes: 2,500
endpoints across 15 facilities, a legacy patient scheduling system requiring Windows Server 2016,
telemedicine applications processing video consultations, and integration partners including
pharmacies and insurance companies. The CISO has identified the following concerns: (1) ensuring
encrypted data both at rest and in transit, (2) maintaining audit trails for all PHI access, (3)
establishing clear boundaries of responsibility between HealthFirst and the cloud provider, (4)
enabling secure remote access for 200 clinical staff members, and (5) validating that the cloud
environment meets healthcare compliance requirements.
Q6: Based on the scenario above, which shared responsibility model component is
EXCLUSIVELY the responsibility of the cloud service provider when HealthFirst uses
