WGU D488 CYBERSECURITY ARCHITECTURE & ENGINEERING OA EXAM
PRACTICE | ADVANCED STUDY GUIDE | COMPREHENSIVE TESTBANK | PRACTICE
QUESTIONS & ANSWERS | EXAM PREPARATION | LATEST UPDATE 2026/2027
i. Cybersecurity Architecture Principles and Design
ii. Security Engineering and Systems Architecture
iii. Identity, Access Control, and Zero Trust
iv. Network, Cloud, and Application Security Architecture
v. Threat Modeling, Risk, and Security Controls
vi. Resilience, Cryptography, and Secure Infrastructure
vii. Security Operations, Governance, and Architectural Decision-Making
INTRODUCTION
This comprehensive WGU D488 Cybersecurity Architecture & Engineering practice
exam is designed to assess advanced knowledge of cybersecurity architecture,
secure systems engineering, risk-based control selection, identity and access
management, network and cloud security, cryptography, resilience, and
architectural decision-making. Questions emphasize practical analysis rather than
memorization, requiring students to evaluate competing security requirements,
identify architectural weaknesses, select appropriate controls, and reason through
realistic enterprise scenarios. The difficulty ranges from advanced to extremely
difficult and is intended to support preparation for graduate-level and professional
cybersecurity assessments. Expect scenario-driven questions involving defense-in-
depth, zero trust, threat modeling, secure design principles, compliance
considerations, availability requirements, and tradeoffs between security,
performance, cost, and operational complexity.
QUESTIONS 1–30
Question 1
A multinational organization is redesigning its enterprise security architecture after
discovering that several internal applications implicitly trust users once they are
connected to the corporate network. The security architect wants to minimize the
impact of compromised credentials and compromised endpoints while maintaining
access for legitimate employees.
,Which architectural change BEST addresses the underlying weakness?
A. Expand the corporate VPN to include all internal applications
B. Implement continuous identity-, device-, and context-based authorization
C. Place all internal applications behind a single network firewall
D. Require employees to change passwords every 30 days
🔴 Correct Answer: B. Implement continuous identity-, device-, and context-
based authorization.
🔵 Explanation: A zero-trust architecture assumes that network location alone does
not establish trust. Continuous evaluation of identity, device posture, resource
sensitivity, and contextual factors limits the ability of compromised credentials or
endpoints to provide unrestricted lateral access.
Question 2
A security architect is evaluating two designs for a payment-processing
environment. Design A uses a single highly capable security appliance protecting
the entire environment. Design B distributes security controls across application,
network, host, identity, and data layers.
The organization is primarily concerned with preventing a single control failure
from exposing sensitive transactions.
Which principle MOST strongly supports Design B?
A. Least functionality
B. Separation of duties
C. Defense in depth
D. Open design
🔴 Correct Answer: C. Defense in depth.
🔵 Explanation: Defense in depth distributes protective mechanisms across multiple
layers so that failure or bypass of one control does not automatically compromise the
entire system. This reduces architectural dependence on a single security mechanism.
Question 3
,During threat modeling, an engineering team identifies an internet-facing API that
accepts authenticated requests and subsequently accesses a highly privileged
internal database account. The API itself has significantly fewer privileges than the
database account.
Which architectural modification provides the BEST reduction in potential impact
from an API compromise?
A. Increase the API server's CPU and memory capacity
B. Require longer passwords for database administrators
C. Replace the database with a larger database cluster
D. Use a narrowly scoped database identity for the API
🔴 Correct Answer: D. Use a narrowly scoped database identity for the API.
🔵 Explanation: Least privilege requires each component to receive only the
permissions necessary to perform its function. If the API is compromised, a restricted
database identity limits the attacker's ability to access or modify unrelated data.
Question 4
An organization is designing a new cloud-hosted application. Developers argue that
because the cloud provider secures the physical facilities and hypervisor, the
organization does not need to perform additional security architecture activities.
Which response by the security architect is MOST accurate?
A. Cloud providers assume responsibility for all security controls
B. The organization remains responsible for security responsibilities allocated to it
under the service model
C. Cloud environments eliminate the need for threat modeling
D. Physical security is the only security responsibility shared with the provider
🔴 Correct Answer: B. The organization remains responsible for security
responsibilities allocated to it under the service model.
🔵 Explanation: Cloud security follows a shared-responsibility model. The provider
secures services and infrastructure within its responsibility boundary, while the
customer remains responsible for controls such as identities, configurations, data,
, applications, and other customer-managed components depending on the service
model.
Question 5
A security architect is reviewing a system that encrypts sensitive information while
stored but transmits the information across an untrusted network without
encryption because the network is considered "temporary."
Which security principle is MOST directly violated?
A. Secure failure
B. Economy of mechanism
C. Complete mediation
D. Protection of data in transit
🔴 Correct Answer: D. Protection of data in transit.
🔵 Explanation: Sensitive information should be protected while traversing networks
that cannot be inherently trusted. Encrypting data only at rest leaves confidentiality
and potentially integrity exposed during transmission.
Question 6
An enterprise wants to isolate a compromised workload so that an attacker cannot
easily move from one application environment to another. The workloads currently
share a broadly routable internal network with minimal filtering.
Which architecture BEST reduces lateral movement?
A. Increase the bandwidth of the internal network
B. Implement network segmentation with narrowly defined communication paths
C. Consolidate all workloads onto one server
D. Disable all logging between application servers
🔴 Correct Answer: B. Implement network segmentation with narrowly defined
communication paths.
🔵 Explanation: Segmentation creates security boundaries that constrain
communication between workloads. Properly enforced segmentation limits lateral
PRACTICE | ADVANCED STUDY GUIDE | COMPREHENSIVE TESTBANK | PRACTICE
QUESTIONS & ANSWERS | EXAM PREPARATION | LATEST UPDATE 2026/2027
i. Cybersecurity Architecture Principles and Design
ii. Security Engineering and Systems Architecture
iii. Identity, Access Control, and Zero Trust
iv. Network, Cloud, and Application Security Architecture
v. Threat Modeling, Risk, and Security Controls
vi. Resilience, Cryptography, and Secure Infrastructure
vii. Security Operations, Governance, and Architectural Decision-Making
INTRODUCTION
This comprehensive WGU D488 Cybersecurity Architecture & Engineering practice
exam is designed to assess advanced knowledge of cybersecurity architecture,
secure systems engineering, risk-based control selection, identity and access
management, network and cloud security, cryptography, resilience, and
architectural decision-making. Questions emphasize practical analysis rather than
memorization, requiring students to evaluate competing security requirements,
identify architectural weaknesses, select appropriate controls, and reason through
realistic enterprise scenarios. The difficulty ranges from advanced to extremely
difficult and is intended to support preparation for graduate-level and professional
cybersecurity assessments. Expect scenario-driven questions involving defense-in-
depth, zero trust, threat modeling, secure design principles, compliance
considerations, availability requirements, and tradeoffs between security,
performance, cost, and operational complexity.
QUESTIONS 1–30
Question 1
A multinational organization is redesigning its enterprise security architecture after
discovering that several internal applications implicitly trust users once they are
connected to the corporate network. The security architect wants to minimize the
impact of compromised credentials and compromised endpoints while maintaining
access for legitimate employees.
,Which architectural change BEST addresses the underlying weakness?
A. Expand the corporate VPN to include all internal applications
B. Implement continuous identity-, device-, and context-based authorization
C. Place all internal applications behind a single network firewall
D. Require employees to change passwords every 30 days
🔴 Correct Answer: B. Implement continuous identity-, device-, and context-
based authorization.
🔵 Explanation: A zero-trust architecture assumes that network location alone does
not establish trust. Continuous evaluation of identity, device posture, resource
sensitivity, and contextual factors limits the ability of compromised credentials or
endpoints to provide unrestricted lateral access.
Question 2
A security architect is evaluating two designs for a payment-processing
environment. Design A uses a single highly capable security appliance protecting
the entire environment. Design B distributes security controls across application,
network, host, identity, and data layers.
The organization is primarily concerned with preventing a single control failure
from exposing sensitive transactions.
Which principle MOST strongly supports Design B?
A. Least functionality
B. Separation of duties
C. Defense in depth
D. Open design
🔴 Correct Answer: C. Defense in depth.
🔵 Explanation: Defense in depth distributes protective mechanisms across multiple
layers so that failure or bypass of one control does not automatically compromise the
entire system. This reduces architectural dependence on a single security mechanism.
Question 3
,During threat modeling, an engineering team identifies an internet-facing API that
accepts authenticated requests and subsequently accesses a highly privileged
internal database account. The API itself has significantly fewer privileges than the
database account.
Which architectural modification provides the BEST reduction in potential impact
from an API compromise?
A. Increase the API server's CPU and memory capacity
B. Require longer passwords for database administrators
C. Replace the database with a larger database cluster
D. Use a narrowly scoped database identity for the API
🔴 Correct Answer: D. Use a narrowly scoped database identity for the API.
🔵 Explanation: Least privilege requires each component to receive only the
permissions necessary to perform its function. If the API is compromised, a restricted
database identity limits the attacker's ability to access or modify unrelated data.
Question 4
An organization is designing a new cloud-hosted application. Developers argue that
because the cloud provider secures the physical facilities and hypervisor, the
organization does not need to perform additional security architecture activities.
Which response by the security architect is MOST accurate?
A. Cloud providers assume responsibility for all security controls
B. The organization remains responsible for security responsibilities allocated to it
under the service model
C. Cloud environments eliminate the need for threat modeling
D. Physical security is the only security responsibility shared with the provider
🔴 Correct Answer: B. The organization remains responsible for security
responsibilities allocated to it under the service model.
🔵 Explanation: Cloud security follows a shared-responsibility model. The provider
secures services and infrastructure within its responsibility boundary, while the
customer remains responsible for controls such as identities, configurations, data,
, applications, and other customer-managed components depending on the service
model.
Question 5
A security architect is reviewing a system that encrypts sensitive information while
stored but transmits the information across an untrusted network without
encryption because the network is considered "temporary."
Which security principle is MOST directly violated?
A. Secure failure
B. Economy of mechanism
C. Complete mediation
D. Protection of data in transit
🔴 Correct Answer: D. Protection of data in transit.
🔵 Explanation: Sensitive information should be protected while traversing networks
that cannot be inherently trusted. Encrypting data only at rest leaves confidentiality
and potentially integrity exposed during transmission.
Question 6
An enterprise wants to isolate a compromised workload so that an attacker cannot
easily move from one application environment to another. The workloads currently
share a broadly routable internal network with minimal filtering.
Which architecture BEST reduces lateral movement?
A. Increase the bandwidth of the internal network
B. Implement network segmentation with narrowly defined communication paths
C. Consolidate all workloads onto one server
D. Disable all logging between application servers
🔴 Correct Answer: B. Implement network segmentation with narrowly defined
communication paths.
🔵 Explanation: Segmentation creates security boundaries that constrain
communication between workloads. Properly enforced segmentation limits lateral
