WGU D485 DGN2 UPDATED ACTUAL
EXAM QUESTIONS AND CORRECT
ANSWERS
●● WAF (Web Application Firewall)
Answer: Protects web applications by filtering HTTP/HTTPS traffic.
Blocks OWASP Top 10 attacks (SQLi, XSS, etc.). Sits in front of web
servers.
●● IDS (Intrusion Detection System)
Answer: Detects and ALERTS on malicious traffic. Passive — does not
block. Can be network-based (NIDS) or host-based (HIDS).
●● IPS (Intrusion Prevention System)
Answer: Detects and STOPS malicious traffic. Inline and active.
Upgrade from IDS in terms of response capability.
●● DMZ (Demilitarized Zone)
Answer: Network segment between the internet and internal network.
Hosts public-facing services (web, email) while protecting internal
resources.
●● Microsegmentation
,Answer: Divides the network into small isolated zones. Limits lateral
movement after a breach. Core component of Zero Trust architectures.
●● Bastion Host
Answer: Hardened server that is the sole controlled entry point from a
lower-security zone into a higher-security zone.
●● VPN (Virtual Private Network)
Answer: Encrypts traffic over public networks. IPSec VPN preferred for
cloud uploads. Site-to-site vs. remote access variants.
●● Zero Trust
Answer: Never trust, always verify. No implicit trust based on network
location. Every request is authenticated and authorized regardless of
source.
●● NIC (Network Interface Card) Teaming
Answer: Combining multiple physical NICs into one logical interface.
Provides redundancy (failover) and increased bandwidth (load
balancing).
●● VLAN (Virtual Local Area Network)
,Answer: Logically segments a physical network into separate broadcast
domains without additional hardware. Isolates sensitive systems on
shared infrastructure.
●● NACL (Network Access Control List)
Answer: Stateless firewall at the subnet level. Evaluates each packet
independently against numbered allow/deny rules. In AWS, protects
entire subnets.
●● NSG (Network Security Group)
Answer: Stateful firewall at the resource/instance level. Tracks
connection state — return traffic automatically permitted. Common in
Azure.
●● Hub and Spoke Network
Answer: Central hub (transit VPC or service provider) connects to
multiple spoke networks. Traffic flows through hub for centralized
security inspection.
●● Defense in Depth
Answer: Multiple layers of security controls so if one fails, others still
protect. No single point of failure in security posture.
●● Air Gap
, Answer: Complete physical/logical isolation from other networks.
Highest security for classified or critical systems.
●● Egress Monitoring
Answer: Monitors outbound traffic for data exfiltration, C2 (Command
and Control) beaconing, and policy violations.
●● Authentication vs Authorization
Answer: Authentication = proving who you are. Authorization = what
you are allowed to do. These are separate and sequential steps.
●● MFA (Multi-Factor Authentication)
Answer: Requires two or more factors: something you know (password),
something you have (token), something you are (biometric).
●● SAML (Security Assertion Markup Language)
Answer: XML-based standard for exchanging authentication and
authorization data between an IdP (Identity Provider) and SP (Service
Provider). Common for enterprise SSO.
●● OAuth 2.0
Answer: Authorization framework allowing third-party apps to access
resources on behalf of a user without exposing credentials. Issues access
tokens.
EXAM QUESTIONS AND CORRECT
ANSWERS
●● WAF (Web Application Firewall)
Answer: Protects web applications by filtering HTTP/HTTPS traffic.
Blocks OWASP Top 10 attacks (SQLi, XSS, etc.). Sits in front of web
servers.
●● IDS (Intrusion Detection System)
Answer: Detects and ALERTS on malicious traffic. Passive — does not
block. Can be network-based (NIDS) or host-based (HIDS).
●● IPS (Intrusion Prevention System)
Answer: Detects and STOPS malicious traffic. Inline and active.
Upgrade from IDS in terms of response capability.
●● DMZ (Demilitarized Zone)
Answer: Network segment between the internet and internal network.
Hosts public-facing services (web, email) while protecting internal
resources.
●● Microsegmentation
,Answer: Divides the network into small isolated zones. Limits lateral
movement after a breach. Core component of Zero Trust architectures.
●● Bastion Host
Answer: Hardened server that is the sole controlled entry point from a
lower-security zone into a higher-security zone.
●● VPN (Virtual Private Network)
Answer: Encrypts traffic over public networks. IPSec VPN preferred for
cloud uploads. Site-to-site vs. remote access variants.
●● Zero Trust
Answer: Never trust, always verify. No implicit trust based on network
location. Every request is authenticated and authorized regardless of
source.
●● NIC (Network Interface Card) Teaming
Answer: Combining multiple physical NICs into one logical interface.
Provides redundancy (failover) and increased bandwidth (load
balancing).
●● VLAN (Virtual Local Area Network)
,Answer: Logically segments a physical network into separate broadcast
domains without additional hardware. Isolates sensitive systems on
shared infrastructure.
●● NACL (Network Access Control List)
Answer: Stateless firewall at the subnet level. Evaluates each packet
independently against numbered allow/deny rules. In AWS, protects
entire subnets.
●● NSG (Network Security Group)
Answer: Stateful firewall at the resource/instance level. Tracks
connection state — return traffic automatically permitted. Common in
Azure.
●● Hub and Spoke Network
Answer: Central hub (transit VPC or service provider) connects to
multiple spoke networks. Traffic flows through hub for centralized
security inspection.
●● Defense in Depth
Answer: Multiple layers of security controls so if one fails, others still
protect. No single point of failure in security posture.
●● Air Gap
, Answer: Complete physical/logical isolation from other networks.
Highest security for classified or critical systems.
●● Egress Monitoring
Answer: Monitors outbound traffic for data exfiltration, C2 (Command
and Control) beaconing, and policy violations.
●● Authentication vs Authorization
Answer: Authentication = proving who you are. Authorization = what
you are allowed to do. These are separate and sequential steps.
●● MFA (Multi-Factor Authentication)
Answer: Requires two or more factors: something you know (password),
something you have (token), something you are (biometric).
●● SAML (Security Assertion Markup Language)
Answer: XML-based standard for exchanging authentication and
authorization data between an IdP (Identity Provider) and SP (Service
Provider). Common for enterprise SSO.
●● OAuth 2.0
Answer: Authorization framework allowing third-party apps to access
resources on behalf of a user without exposing credentials. Issues access
tokens.
