WGU D488 CYBERSECURITY ARCHITECTURE
ENGINEERING
Comprehensive Review Examination
Test Bank 4 | Actual Examination Format 2026/2027
Total Questions 70 Questions
Format Multiple Choice with Rationales
Coverage Complete Domain Syllabus
Distribution Random Topic Mixing
Domains Covered:
Security Architecture & Engineering | Security Frameworks (NIST CSF, ISO 27001, COBIT, ITIL)
Architecture Models (TOGAF, Zachman, SABSA) | Security Design Principles
Security Controls (Preventive, Detective, Corrective, Administrative, Technical, Physical)
Network Security Architecture | Zero Trust & Micro-Segmentation
Identity & Access Management | Application Security & DevSecOps
Cloud Security Architecture | Data Security & Cryptography
Security Operations (SIEM, SOAR, Incident Response) | Risk Management
Business Continuity & Disaster Recovery | Security Governance & Compliance
,Q1. A financial services organization is implementing the NIST Cybersecurity Framework (CSF) to improve its security
posture. Which of the five core functions should be executed FIRST when establishing a new cybersecurity program?
A. Detect - Identify potential cybersecurity events through continuous monitoring
B. Respond - Take action regarding detected cybersecurity incidents
C. Protect - Implement safeguards to ensure delivery of critical services
**D. Identify - Develop organizational understanding to manage cybersecurity risk** [CORRECT]
**E. Recover - Maintain plans for resilience and restoration capabilities**
**Correct Answer: D**
**Rationale: Correct because the Identify function is foundational to the NIST CSF and must be executed first. This
function involves developing an organizational understanding of cybersecurity risk management, including asset
identification, governance, and risk assessment. Without properly identifying assets, business context, and risk tolerance,
organizations cannot effectively implement the other four functions (Protect, Detect, Respond, Recover). Priority is
establishing the risk management foundation before implementing technical controls.**
Q2. An enterprise is migrating from a perimeter-based security model to Zero Trust Architecture (ZTA). What is the
CORE principle that distinguishes ZTA from traditional security models?
A. All users within the corporate network are automatically trusted
B. Network segmentation using VLANs provides adequate security boundaries
C. Multi-factor authentication is required only for remote access
**D. Never trust, always verify - every access request must be authenticated and authorized regardless of location**
[CORRECT]
**E. Firewalls at network boundaries provide sufficient protection**
**Correct Answer: D**
**Rationale: Correct because "Never trust, always verify" is the fundamental principle of Zero Trust Architecture. Unlike
traditional models that trust entities inside the network perimeter, ZTA eliminates implicit trust and requires continuous
verification of every user, device, and connection attempting to access resources. This matches the core tenet that breach
assumption is the baseline - assume the network is already compromised. Priority is understanding that location does not
determine trust in ZTA implementations.**
Q3. A healthcare organization must protect electronic protected health information (ePHI). Applying the defense-in-depth
strategy, which combination of controls provides the MOST comprehensive layered protection?
A. Firewall only at the internet boundary with antivirus on endpoints
B. Single sign-on implementation with annual security awareness training
C. Encryption of data at rest without network monitoring capabilities
**D. Administrative controls (policies), technical controls (encryption/IDS), and physical controls (badge access)
implemented in coordinated layers** [CORRECT]
**E. Intrusion prevention system deployed without supporting policies or procedures**
**Correct Answer: D**
**Rationale: Correct because defense-in-depth requires multiple layers of security controls across different categories
working together. Administrative controls establish governance and procedures, technical controls provide automated
protection mechanisms, and physical controls secure facilities and hardware. This matches the defense-in-depth principle
that no single control is sufficient and that compensating measures must exist if one layer fails. Priority is implementing
, complementary controls that address people, process, and technology dimensions simultaneously.**
Q4. A database administrator is designing access controls for a new customer relationship management (CRM) system.
Applying the principle of least privilege, how should access rights be configured for marketing analysts who need to
generate campaign reports?
A. Grant full administrative privileges to allow flexibility in report generation
B. Provide read-only access to all database tables including sensitive customer PII
C. Assign developer-level permissions to enable custom query creation
**D. Grant SELECT permissions only on required tables/views needed for campaign reporting with time-limited access**
[CORRECT]
**E. Allow unrestricted export capabilities to any file format**
**Correct Answer: D**
**Rationale: Correct because least privilege requires granting only the minimum permissions necessary to perform job
functions. Marketing analysts need only read access (SELECT) to specific tables required for reporting, not full
administrative or developer access. Time-limited access ensures permissions are reviewed regularly. This matches the
principle that excessive privileges increase attack surface and potential damage from compromised accounts. Priority is
restricting access to exactly what is needed, when it is needed, and nothing more.**
Q5. A payment processing company must prevent fraud in its wire transfer system. Which security design pattern BEST
addresses the risk of a single employee initiating and approving fraudulent transactions?
A. Job rotation every six months to detect potential fraud patterns
B. Mandatory vacation policy requiring two-week consecutive absence
C. Background checks conducted annually for all financial staff
**D. Separation of duties requiring different individuals to initiate, approve, and execute wire transfers** [CORRECT]
**E. Enhanced monitoring of employee network activity during business hours**
**Correct Answer: D**
**Rationale: Correct because separation of duties (SoD) divides critical tasks among multiple individuals so no single
person has complete control over a sensitive process. For wire transfers, requiring different people to initiate, approve, and
execute transactions prevents collusion and ensures oversight. This matches the fraud prevention principle that critical
functions require checks and balances. Priority is dividing authorization capabilities so that compromise of one account
cannot complete a fraudulent transaction independently.**
Q6. An organization pursuing ISO 27001 certification is developing its Information Security Management System (ISMS).
According to the standard's Plan-Do-Check-Act (PDCA) cycle, what occurs during the CHECK phase?
A. Establishing security objectives and controls based on risk assessment results
B. Implementing security controls and training personnel on procedures
C. Defining the scope of the ISMS and conducting management reviews
**D. Monitoring and measuring ISMS performance through internal audits and management review** [CORRECT]
**E. Taking corrective actions to address non-conformities and improve effectiveness**
**Correct Answer: D**
ENGINEERING
Comprehensive Review Examination
Test Bank 4 | Actual Examination Format 2026/2027
Total Questions 70 Questions
Format Multiple Choice with Rationales
Coverage Complete Domain Syllabus
Distribution Random Topic Mixing
Domains Covered:
Security Architecture & Engineering | Security Frameworks (NIST CSF, ISO 27001, COBIT, ITIL)
Architecture Models (TOGAF, Zachman, SABSA) | Security Design Principles
Security Controls (Preventive, Detective, Corrective, Administrative, Technical, Physical)
Network Security Architecture | Zero Trust & Micro-Segmentation
Identity & Access Management | Application Security & DevSecOps
Cloud Security Architecture | Data Security & Cryptography
Security Operations (SIEM, SOAR, Incident Response) | Risk Management
Business Continuity & Disaster Recovery | Security Governance & Compliance
,Q1. A financial services organization is implementing the NIST Cybersecurity Framework (CSF) to improve its security
posture. Which of the five core functions should be executed FIRST when establishing a new cybersecurity program?
A. Detect - Identify potential cybersecurity events through continuous monitoring
B. Respond - Take action regarding detected cybersecurity incidents
C. Protect - Implement safeguards to ensure delivery of critical services
**D. Identify - Develop organizational understanding to manage cybersecurity risk** [CORRECT]
**E. Recover - Maintain plans for resilience and restoration capabilities**
**Correct Answer: D**
**Rationale: Correct because the Identify function is foundational to the NIST CSF and must be executed first. This
function involves developing an organizational understanding of cybersecurity risk management, including asset
identification, governance, and risk assessment. Without properly identifying assets, business context, and risk tolerance,
organizations cannot effectively implement the other four functions (Protect, Detect, Respond, Recover). Priority is
establishing the risk management foundation before implementing technical controls.**
Q2. An enterprise is migrating from a perimeter-based security model to Zero Trust Architecture (ZTA). What is the
CORE principle that distinguishes ZTA from traditional security models?
A. All users within the corporate network are automatically trusted
B. Network segmentation using VLANs provides adequate security boundaries
C. Multi-factor authentication is required only for remote access
**D. Never trust, always verify - every access request must be authenticated and authorized regardless of location**
[CORRECT]
**E. Firewalls at network boundaries provide sufficient protection**
**Correct Answer: D**
**Rationale: Correct because "Never trust, always verify" is the fundamental principle of Zero Trust Architecture. Unlike
traditional models that trust entities inside the network perimeter, ZTA eliminates implicit trust and requires continuous
verification of every user, device, and connection attempting to access resources. This matches the core tenet that breach
assumption is the baseline - assume the network is already compromised. Priority is understanding that location does not
determine trust in ZTA implementations.**
Q3. A healthcare organization must protect electronic protected health information (ePHI). Applying the defense-in-depth
strategy, which combination of controls provides the MOST comprehensive layered protection?
A. Firewall only at the internet boundary with antivirus on endpoints
B. Single sign-on implementation with annual security awareness training
C. Encryption of data at rest without network monitoring capabilities
**D. Administrative controls (policies), technical controls (encryption/IDS), and physical controls (badge access)
implemented in coordinated layers** [CORRECT]
**E. Intrusion prevention system deployed without supporting policies or procedures**
**Correct Answer: D**
**Rationale: Correct because defense-in-depth requires multiple layers of security controls across different categories
working together. Administrative controls establish governance and procedures, technical controls provide automated
protection mechanisms, and physical controls secure facilities and hardware. This matches the defense-in-depth principle
that no single control is sufficient and that compensating measures must exist if one layer fails. Priority is implementing
, complementary controls that address people, process, and technology dimensions simultaneously.**
Q4. A database administrator is designing access controls for a new customer relationship management (CRM) system.
Applying the principle of least privilege, how should access rights be configured for marketing analysts who need to
generate campaign reports?
A. Grant full administrative privileges to allow flexibility in report generation
B. Provide read-only access to all database tables including sensitive customer PII
C. Assign developer-level permissions to enable custom query creation
**D. Grant SELECT permissions only on required tables/views needed for campaign reporting with time-limited access**
[CORRECT]
**E. Allow unrestricted export capabilities to any file format**
**Correct Answer: D**
**Rationale: Correct because least privilege requires granting only the minimum permissions necessary to perform job
functions. Marketing analysts need only read access (SELECT) to specific tables required for reporting, not full
administrative or developer access. Time-limited access ensures permissions are reviewed regularly. This matches the
principle that excessive privileges increase attack surface and potential damage from compromised accounts. Priority is
restricting access to exactly what is needed, when it is needed, and nothing more.**
Q5. A payment processing company must prevent fraud in its wire transfer system. Which security design pattern BEST
addresses the risk of a single employee initiating and approving fraudulent transactions?
A. Job rotation every six months to detect potential fraud patterns
B. Mandatory vacation policy requiring two-week consecutive absence
C. Background checks conducted annually for all financial staff
**D. Separation of duties requiring different individuals to initiate, approve, and execute wire transfers** [CORRECT]
**E. Enhanced monitoring of employee network activity during business hours**
**Correct Answer: D**
**Rationale: Correct because separation of duties (SoD) divides critical tasks among multiple individuals so no single
person has complete control over a sensitive process. For wire transfers, requiring different people to initiate, approve, and
execute transactions prevents collusion and ensures oversight. This matches the fraud prevention principle that critical
functions require checks and balances. Priority is dividing authorization capabilities so that compromise of one account
cannot complete a fraudulent transaction independently.**
Q6. An organization pursuing ISO 27001 certification is developing its Information Security Management System (ISMS).
According to the standard's Plan-Do-Check-Act (PDCA) cycle, what occurs during the CHECK phase?
A. Establishing security objectives and controls based on risk assessment results
B. Implementing security controls and training personnel on procedures
C. Defining the scope of the ISMS and conducting management reviews
**D. Monitoring and measuring ISMS performance through internal audits and management review** [CORRECT]
**E. Taking corrective actions to address non-conformities and improve effectiveness**
**Correct Answer: D**
