WGU D488 CYBERSECURITY ARCHITECTURE &
ENGINEERING OA EXAM – 300 PRACTICE
QUESTIONS
---
Question 1
Which security architecture principle states that a system should default to the
most secure configuration, requiring explicit action to reduce restrictions?
A) Defense in depth
B) Least privilege
C) Fail-safe defaults
D) Separation of duties
Correct Answer: C) Fail-safe defaults
Rationale: The fail-safe defaults principle (also known as secure defaults)
mandates that a system's default configuration should be the most restrictive and
secure setting. Users must explicitly take action to lower security controls,
reducing the risk of accidental misconfiguration. Defense in depth uses multiple
layers of security, least privilege limits access rights, and separation of duties
prevents fraud by dividing responsibilities.
---
,Question 2
In the SABSA layered model, which layer focuses on the "why" – the business
context and motivations?
A) Conceptual layer
B) Logical layer
C) Physical layer
D) Contextual layer
Correct Answer: D) Contextual layer
Rationale: The SABSA (Sherwood Applied Business Security Architecture) model
consists of six layers. The Contextual layer addresses the "why" – business
requirements, goals, and motivations. The Conceptual layer addresses "what," the
Logical layer addresses "how," the Physical layer addresses "where," the
Component layer addresses "who," and the Operational layer addresses "when."
---
Question 3
A cybersecurity analyst conducted a vulnerability assessment and discovered
multiple vulnerabilities on the company's webpage. The CISO decided not to fix
them because the vulnerabilities were outside the organization's resources.
Which risk mitigation strategy is demonstrated?
A) Mitigate
B) Accept
,C) Avoid
D) Transfer
Correct Answer: B) Accept
Rationale: Risk acceptance is a strategy where the organization acknowledges the
risk but chooses not to take action, typically because the cost of mitigation
exceeds the potential impact or resources are unavailable. Mitigation involves
reducing risk, avoidance eliminates the risk by removing the activity, and transfer
shifts risk to a third party (e.g., insurance).
---
Question 4
What is the primary purpose of the Diffie-Hellman (DH) algorithm?
A) Digital signatures
B) Secure key exchange
C) Data encryption
D) Hash generation
Correct Answer: B) Secure key exchange
Rationale: Diffie-Hellman is a key exchange protocol that allows two parties to
securely establish a shared secret over an insecure channel. It does not perform
, encryption or digital signatures directly. RSA is used for encryption and digital
signatures, while hash functions generate message digests.
---
Question 5
Which detection technique should be used when an IDS already has a database of
signatures to validate inbound threats?
A) Intrusion detection
B) Deep packet inspection
C) Signature-based detection
D) Intrusion prevention
Correct Answer: C) Signature-based detection
Rationale: Signature-based detection relies on a database of known attack
patterns (signatures) to identify threats. It is effective for known attacks but
cannot detect zero-day threats. Deep packet inspection examines packet
contents, intrusion detection is a broader category, and intrusion prevention
actively blocks threats.
---
Question 6
ENGINEERING OA EXAM – 300 PRACTICE
QUESTIONS
---
Question 1
Which security architecture principle states that a system should default to the
most secure configuration, requiring explicit action to reduce restrictions?
A) Defense in depth
B) Least privilege
C) Fail-safe defaults
D) Separation of duties
Correct Answer: C) Fail-safe defaults
Rationale: The fail-safe defaults principle (also known as secure defaults)
mandates that a system's default configuration should be the most restrictive and
secure setting. Users must explicitly take action to lower security controls,
reducing the risk of accidental misconfiguration. Defense in depth uses multiple
layers of security, least privilege limits access rights, and separation of duties
prevents fraud by dividing responsibilities.
---
,Question 2
In the SABSA layered model, which layer focuses on the "why" – the business
context and motivations?
A) Conceptual layer
B) Logical layer
C) Physical layer
D) Contextual layer
Correct Answer: D) Contextual layer
Rationale: The SABSA (Sherwood Applied Business Security Architecture) model
consists of six layers. The Contextual layer addresses the "why" – business
requirements, goals, and motivations. The Conceptual layer addresses "what," the
Logical layer addresses "how," the Physical layer addresses "where," the
Component layer addresses "who," and the Operational layer addresses "when."
---
Question 3
A cybersecurity analyst conducted a vulnerability assessment and discovered
multiple vulnerabilities on the company's webpage. The CISO decided not to fix
them because the vulnerabilities were outside the organization's resources.
Which risk mitigation strategy is demonstrated?
A) Mitigate
B) Accept
,C) Avoid
D) Transfer
Correct Answer: B) Accept
Rationale: Risk acceptance is a strategy where the organization acknowledges the
risk but chooses not to take action, typically because the cost of mitigation
exceeds the potential impact or resources are unavailable. Mitigation involves
reducing risk, avoidance eliminates the risk by removing the activity, and transfer
shifts risk to a third party (e.g., insurance).
---
Question 4
What is the primary purpose of the Diffie-Hellman (DH) algorithm?
A) Digital signatures
B) Secure key exchange
C) Data encryption
D) Hash generation
Correct Answer: B) Secure key exchange
Rationale: Diffie-Hellman is a key exchange protocol that allows two parties to
securely establish a shared secret over an insecure channel. It does not perform
, encryption or digital signatures directly. RSA is used for encryption and digital
signatures, while hash functions generate message digests.
---
Question 5
Which detection technique should be used when an IDS already has a database of
signatures to validate inbound threats?
A) Intrusion detection
B) Deep packet inspection
C) Signature-based detection
D) Intrusion prevention
Correct Answer: C) Signature-based detection
Rationale: Signature-based detection relies on a database of known attack
patterns (signatures) to identify threats. It is effective for known attacks but
cannot detect zero-day threats. Deep packet inspection examines packet
contents, intrusion detection is a broader category, and intrusion prevention
actively blocks threats.
---
Question 6
