WGU D488 Cybersecurity Architecture and Engineering - Test Bank 3 Page 1
WGU D488 Cybersecurity Architecture and Engineering
Objective Assessment Test Bank 3
With Actual Questions and Correct Answers
85 Questions | 8 Domains | Scenario-Based and Recall
Section 1: Security Architecture Frameworks and Design Principles (Zero Trust, NIST CSF, ISO
27001, TOGAF, SABSA, and Defense-in-Depth) - Q1-15
Q1: A financial services firm is migrating from a traditional perimeter-based security model to a Zero Trust
architecture. The CISO has mandated that no user, device, or workload should be implicitly trusted based solely on
its network location. Which principle is most fundamental to implementing this transition successfully?
A. Verify explicitly using all available data points including identity, location, and device health posture [CORRECT]
B. Encrypt all data at rest and in transit using AES-256 across every network segment
C. Deploy next-generation firewalls at every network boundary to enforce strict access control lists
D. Implement role-based access control tied exclusively to Active Directory group memberships
Correct Answer: A
Rationale: Zero Trust's foundational principle is 'never trust, always verify,' which requires explicit verification of every access request
using multiple contextual data points. This approach replaces implicit trust based on network location with continuous validation of
identity, device posture, and other risk signals. While encryption and firewalls are important security controls, they do not embody the core
Zero Trust philosophy of continuous, explicit verification.
Q2: An enterprise organization has deployed a Zero Trust Architecture (ZTA) that includes a Policy Decision Point
(PDP) and Policy Enforcement Points (PEPs) across its network. When a remote employee attempts to access an
internal HR application, the PDP evaluates the request and denies access due to an outdated endpoint patch level.
Which component of the ZTA data plane is responsible for blocking this specific access attempt?
A. Policy Decision Point
B. Policy Enforcement Point [CORRECT]
C. Policy Administration Point
D. Trust Broker
Correct Answer: B
Rationale: The Policy Enforcement Point (PEP) is the component within the ZTA data plane that actually enforces the access decisions
made by the Policy Decision Point. When the PDP determines that the device's patch level is insufficient, it communicates this decision to
the PEP, which then blocks the connection at the point of enforcement. The PDP makes the decision but does not directly block traffic,
while the Policy Administration Point manages the overall policy lifecycle.
Q3: A global manufacturing company with operations in 12 countries has adopted Zero Trust but struggles with
legacy industrial control systems that cannot support modern authentication protocols. The security team needs to
design a strategy that protects these systems without requiring direct protocol changes. Which approach best aligns
with Zero Trust principles while accommodating legacy constraints?
A. Isolate legacy ICS devices in a dedicated network segment with a Zero Trust proxy broker mediating all access
[CORRECT]
B. Apply network-based microsegmentation using VLANs and exempt legacy devices from authentication
requirements
C. Deploy host-based agents on all legacy controllers to enable certificate-based mutual TLS authentication
D. Replace all legacy ICS devices with cloud-managed IoT sensors that natively support modern authentication
Correct Answer: A
Rationale: Deploying a Zero Trust proxy broker to mediate access to isolated legacy systems allows the organization to maintain explicit
verification at the network boundary without modifying the legacy devices themselves. This pattern establishes a strong intermediary
control point where identity verification, least-privilege access, and continuous monitoring can be enforced. Network segmentation alone
without a verification broker does not satisfy Zero Trust's explicit verification requirement, and replacing all legacy devices may be
,WGU D488 Cybersecurity Architecture and Engineering - Test Bank 3 Page 2
operationally infeasible.
Q4: A healthcare organization is using the NIST Cybersecurity Framework (CSF) to improve its security posture.
During the Assess step of the framework's process, the team discovers that their current risk management practices
do not align with the organization's business objectives and risk tolerance. According to the NIST CSF, what should
the organization do next in this assessment process?
A. Proceed directly to the Respond function to address the most critical vulnerabilities found during assessment
B. Revisit the organization's business context, risk tolerance, and priorities to ensure proper alignment before
continuing [CORRECT]
C. Document all findings in a risk register and submit it to the board of directors for approval before further action
D. Implement compensating controls for all identified gaps and reassess within 90 days
Correct Answer: B
Rationale: The NIST CSF's Assess step specifically instructs organizations to ensure that risk management practices, priorities, and
activities are aligned with business requirements and risk tolerance before progressing. If misalignment is discovered, the framework
requires revisiting the business context and risk tolerance to recalibrate the security program. Moving directly to Respond or implementing
controls without realignment would perpetuate the fundamental mismatch between security activities and business objectives.
Q5: A mid-sized retail company has completed its initial NIST CSF profile creation by comparing its Current Profile
against the Target Profile. The comparison reveals significant gaps in the Protect function, specifically around PR.AC
(Access Control) and PR.DS (Data Security) categories. Which NIST CSF implementation tier best describes an
organization that is actively working to close these identified gaps through formalized risk management processes?
A. Tier 1: Partial
B. Tier 2: Risk Informed
C. Tier 3: Repeatable [CORRECT]
D. Tier 4: Adaptive
Correct Answer: C
Rationale: Tier 3 (Repeatable) describes organizations that have formalized risk management processes and are actively implementing
their CSF profiles to address identified gaps. At this tier, the organization regularly reviews its current profile against its target profile and
has defined processes in place for closing those gaps. Tier 1 implies ad-hoc practices, Tier 2 indicates risk awareness without formalized
processes, and Tier 4 represents advanced optimization beyond simply closing gaps.
Q6: A technology startup is prioritizing its NIST CSF implementation efforts and has limited resources. The CISO
needs to justify investment in the Detect function by explaining its relationship to the overall framework. Which
statement best describes how the Detect function supports the NIST CSF's core purpose?
A. The Detect function replaces the need for the Protect function by identifying threats before they can exploit
vulnerabilities
B. The Detect function enables timely discovery of cybersecurity events and provides the awareness needed for
effective Respond actions [CORRECT]
C. The Detect function is optional and only necessary for organizations subject to regulatory compliance requirements
D. The Detect function primarily focuses on external threat intelligence gathering and does not apply to internal
monitoring
Correct Answer: B
Rationale: The NIST CSF's Detect function exists to develop and implement appropriate activities to identify the occurrence of
cybersecurity events in a timely manner. Its outputs directly feed the Respond function, as effective response depends on accurate and
timely detection. It does not replace the Protect function, is not optional under the framework, and encompasses both external and internal
monitoring activities rather than focusing exclusively on threat intelligence.
Q7: An organization pursuing ISO 27001 certification has identified a new regulatory requirement that mandates
encryption of all customer data at rest. The security team proposes updating the corporate information security
policy to include this requirement. According to ISO 27001 Clause 6.1.3, what must the organization also perform
when introducing this new control?
A. Conduct a formal risk assessment to determine whether the control addresses the identified risk and update the
Statement of Applicability [CORRECT]
B. Submit the proposed change to the certification auditor for pre-approval before implementation
, WGU D488 Cybersecurity Architecture and Engineering - Test Bank 3 Page 3
C. Rewrite the entire risk treatment plan to accommodate the single new regulatory requirement
D. Implement the control immediately and document its effectiveness during the next surveillance audit
Correct Answer: A
Rationale: ISO 27001 Clause 6.1.3 requires that when selecting controls, particularly those addressing new or changed risks, the
organization must conduct a risk assessment to validate the control's appropriateness and update the Statement of Applicability. The SoA
must reflect all controls deemed necessary, including any new ones introduced by regulatory changes. While the control should be
implemented, the framework mandates proper risk-based justification and documentation before deployment, not after.
Q8: During an ISO 27001 Stage 1 audit, an external auditor reviews the organization's risk assessment methodology.
The auditor notes that the organization has not defined its risk criteria, including the risk appetite and acceptable
risk levels. What is the most significant consequence of this omission according to ISO 27001 requirements?
A. The organization will fail the Stage 1 audit because risk evaluation criteria are a mandatory element of the risk
assessment process [CORRECT]
B. The organization can proceed to Stage 2 but must document risk criteria within 30 days of the initial audit
C. This is a minor nonconformity that does not affect the overall certification decision
D. The auditor will issue a recommendation to adopt the NIST RMF framework in place of ISO 27005
Correct Answer: A
Rationale: ISO 27001 requires that risk criteria, including risk acceptance levels and risk appetite, be defined and documented as part of
the risk assessment process. The absence of defined risk criteria is a fundamental gap that would result in a Stage 1 audit failure, as the
auditor cannot verify that risks are being evaluated against consistent and approved benchmarks. This is not a minor finding but a systemic
deficiency in the information security management system's risk management foundation.
Q9: A company certified to ISO 27001 experiences a significant change when it acquires a smaller firm and integrates
its IT systems. The CISO must ensure continued compliance with ISO 27001 Clause 6.3. What action is most critical
for maintaining certification during this integration?
A. Notify the certification body within 7 days and request an immediate transfer audit of the acquired company
B. Conduct a risk assessment of the changes introduced by the integration and update the ISMS scope, context, and
risk treatment plan accordingly [CORRECT]
C. Maintain a separate ISMS for the acquired entity for a minimum of 12 months before integration
D. Decertify and recertify the entire organization under a new ISO 27001 scope that includes both entities
Correct Answer: B
Rationale: ISO 27001 Clause 6.3 requires organizations to plan and manage changes that could affect the ISMS in a controlled manner.
When an acquisition introduces new systems, processes, and risks, the organization must reassess the impact on its ISMS scope and context,
conduct risk assessments for the newly integrated assets, and update the risk treatment plan. This managed approach maintains compliance
without requiring decertification, and the timeline for notifying the certification body depends on the change's materiality rather than an
arbitrary deadline.
Q10: A large enterprise is using TOGAF's Architecture Development Method (ADM) to design its enterprise security
architecture. The architecture team is currently in Phase C (Information Systems Architectures) and needs to define
how security services will integrate with business applications. Which TOGAF concept is most relevant for ensuring
that security considerations are embedded across all architecture domains rather than treated as a standalone
domain?
A. Architecture Capability
B. Enterprise Continuum
C. Security Architecture as a cross-cutting concern addressed in every ADM phase through stakeholder concerns and
requirements [CORRECT]
D. Architecture Repository
Correct Answer: C
Rationale: In TOGAF, security architecture functions as a cross-cutting concern that must be addressed across all ADM phases rather than
being isolated to a single phase or domain. Each phase of the ADM, from Preliminary through Requirements Management, has
security-related stakeholder concerns that must be captured and addressed. While the Architecture Capability and Enterprise Continuum
are important TOGAF concepts, they do not specifically address the need to embed security across all architecture domains.
WGU D488 Cybersecurity Architecture and Engineering
Objective Assessment Test Bank 3
With Actual Questions and Correct Answers
85 Questions | 8 Domains | Scenario-Based and Recall
Section 1: Security Architecture Frameworks and Design Principles (Zero Trust, NIST CSF, ISO
27001, TOGAF, SABSA, and Defense-in-Depth) - Q1-15
Q1: A financial services firm is migrating from a traditional perimeter-based security model to a Zero Trust
architecture. The CISO has mandated that no user, device, or workload should be implicitly trusted based solely on
its network location. Which principle is most fundamental to implementing this transition successfully?
A. Verify explicitly using all available data points including identity, location, and device health posture [CORRECT]
B. Encrypt all data at rest and in transit using AES-256 across every network segment
C. Deploy next-generation firewalls at every network boundary to enforce strict access control lists
D. Implement role-based access control tied exclusively to Active Directory group memberships
Correct Answer: A
Rationale: Zero Trust's foundational principle is 'never trust, always verify,' which requires explicit verification of every access request
using multiple contextual data points. This approach replaces implicit trust based on network location with continuous validation of
identity, device posture, and other risk signals. While encryption and firewalls are important security controls, they do not embody the core
Zero Trust philosophy of continuous, explicit verification.
Q2: An enterprise organization has deployed a Zero Trust Architecture (ZTA) that includes a Policy Decision Point
(PDP) and Policy Enforcement Points (PEPs) across its network. When a remote employee attempts to access an
internal HR application, the PDP evaluates the request and denies access due to an outdated endpoint patch level.
Which component of the ZTA data plane is responsible for blocking this specific access attempt?
A. Policy Decision Point
B. Policy Enforcement Point [CORRECT]
C. Policy Administration Point
D. Trust Broker
Correct Answer: B
Rationale: The Policy Enforcement Point (PEP) is the component within the ZTA data plane that actually enforces the access decisions
made by the Policy Decision Point. When the PDP determines that the device's patch level is insufficient, it communicates this decision to
the PEP, which then blocks the connection at the point of enforcement. The PDP makes the decision but does not directly block traffic,
while the Policy Administration Point manages the overall policy lifecycle.
Q3: A global manufacturing company with operations in 12 countries has adopted Zero Trust but struggles with
legacy industrial control systems that cannot support modern authentication protocols. The security team needs to
design a strategy that protects these systems without requiring direct protocol changes. Which approach best aligns
with Zero Trust principles while accommodating legacy constraints?
A. Isolate legacy ICS devices in a dedicated network segment with a Zero Trust proxy broker mediating all access
[CORRECT]
B. Apply network-based microsegmentation using VLANs and exempt legacy devices from authentication
requirements
C. Deploy host-based agents on all legacy controllers to enable certificate-based mutual TLS authentication
D. Replace all legacy ICS devices with cloud-managed IoT sensors that natively support modern authentication
Correct Answer: A
Rationale: Deploying a Zero Trust proxy broker to mediate access to isolated legacy systems allows the organization to maintain explicit
verification at the network boundary without modifying the legacy devices themselves. This pattern establishes a strong intermediary
control point where identity verification, least-privilege access, and continuous monitoring can be enforced. Network segmentation alone
without a verification broker does not satisfy Zero Trust's explicit verification requirement, and replacing all legacy devices may be
,WGU D488 Cybersecurity Architecture and Engineering - Test Bank 3 Page 2
operationally infeasible.
Q4: A healthcare organization is using the NIST Cybersecurity Framework (CSF) to improve its security posture.
During the Assess step of the framework's process, the team discovers that their current risk management practices
do not align with the organization's business objectives and risk tolerance. According to the NIST CSF, what should
the organization do next in this assessment process?
A. Proceed directly to the Respond function to address the most critical vulnerabilities found during assessment
B. Revisit the organization's business context, risk tolerance, and priorities to ensure proper alignment before
continuing [CORRECT]
C. Document all findings in a risk register and submit it to the board of directors for approval before further action
D. Implement compensating controls for all identified gaps and reassess within 90 days
Correct Answer: B
Rationale: The NIST CSF's Assess step specifically instructs organizations to ensure that risk management practices, priorities, and
activities are aligned with business requirements and risk tolerance before progressing. If misalignment is discovered, the framework
requires revisiting the business context and risk tolerance to recalibrate the security program. Moving directly to Respond or implementing
controls without realignment would perpetuate the fundamental mismatch between security activities and business objectives.
Q5: A mid-sized retail company has completed its initial NIST CSF profile creation by comparing its Current Profile
against the Target Profile. The comparison reveals significant gaps in the Protect function, specifically around PR.AC
(Access Control) and PR.DS (Data Security) categories. Which NIST CSF implementation tier best describes an
organization that is actively working to close these identified gaps through formalized risk management processes?
A. Tier 1: Partial
B. Tier 2: Risk Informed
C. Tier 3: Repeatable [CORRECT]
D. Tier 4: Adaptive
Correct Answer: C
Rationale: Tier 3 (Repeatable) describes organizations that have formalized risk management processes and are actively implementing
their CSF profiles to address identified gaps. At this tier, the organization regularly reviews its current profile against its target profile and
has defined processes in place for closing those gaps. Tier 1 implies ad-hoc practices, Tier 2 indicates risk awareness without formalized
processes, and Tier 4 represents advanced optimization beyond simply closing gaps.
Q6: A technology startup is prioritizing its NIST CSF implementation efforts and has limited resources. The CISO
needs to justify investment in the Detect function by explaining its relationship to the overall framework. Which
statement best describes how the Detect function supports the NIST CSF's core purpose?
A. The Detect function replaces the need for the Protect function by identifying threats before they can exploit
vulnerabilities
B. The Detect function enables timely discovery of cybersecurity events and provides the awareness needed for
effective Respond actions [CORRECT]
C. The Detect function is optional and only necessary for organizations subject to regulatory compliance requirements
D. The Detect function primarily focuses on external threat intelligence gathering and does not apply to internal
monitoring
Correct Answer: B
Rationale: The NIST CSF's Detect function exists to develop and implement appropriate activities to identify the occurrence of
cybersecurity events in a timely manner. Its outputs directly feed the Respond function, as effective response depends on accurate and
timely detection. It does not replace the Protect function, is not optional under the framework, and encompasses both external and internal
monitoring activities rather than focusing exclusively on threat intelligence.
Q7: An organization pursuing ISO 27001 certification has identified a new regulatory requirement that mandates
encryption of all customer data at rest. The security team proposes updating the corporate information security
policy to include this requirement. According to ISO 27001 Clause 6.1.3, what must the organization also perform
when introducing this new control?
A. Conduct a formal risk assessment to determine whether the control addresses the identified risk and update the
Statement of Applicability [CORRECT]
B. Submit the proposed change to the certification auditor for pre-approval before implementation
, WGU D488 Cybersecurity Architecture and Engineering - Test Bank 3 Page 3
C. Rewrite the entire risk treatment plan to accommodate the single new regulatory requirement
D. Implement the control immediately and document its effectiveness during the next surveillance audit
Correct Answer: A
Rationale: ISO 27001 Clause 6.1.3 requires that when selecting controls, particularly those addressing new or changed risks, the
organization must conduct a risk assessment to validate the control's appropriateness and update the Statement of Applicability. The SoA
must reflect all controls deemed necessary, including any new ones introduced by regulatory changes. While the control should be
implemented, the framework mandates proper risk-based justification and documentation before deployment, not after.
Q8: During an ISO 27001 Stage 1 audit, an external auditor reviews the organization's risk assessment methodology.
The auditor notes that the organization has not defined its risk criteria, including the risk appetite and acceptable
risk levels. What is the most significant consequence of this omission according to ISO 27001 requirements?
A. The organization will fail the Stage 1 audit because risk evaluation criteria are a mandatory element of the risk
assessment process [CORRECT]
B. The organization can proceed to Stage 2 but must document risk criteria within 30 days of the initial audit
C. This is a minor nonconformity that does not affect the overall certification decision
D. The auditor will issue a recommendation to adopt the NIST RMF framework in place of ISO 27005
Correct Answer: A
Rationale: ISO 27001 requires that risk criteria, including risk acceptance levels and risk appetite, be defined and documented as part of
the risk assessment process. The absence of defined risk criteria is a fundamental gap that would result in a Stage 1 audit failure, as the
auditor cannot verify that risks are being evaluated against consistent and approved benchmarks. This is not a minor finding but a systemic
deficiency in the information security management system's risk management foundation.
Q9: A company certified to ISO 27001 experiences a significant change when it acquires a smaller firm and integrates
its IT systems. The CISO must ensure continued compliance with ISO 27001 Clause 6.3. What action is most critical
for maintaining certification during this integration?
A. Notify the certification body within 7 days and request an immediate transfer audit of the acquired company
B. Conduct a risk assessment of the changes introduced by the integration and update the ISMS scope, context, and
risk treatment plan accordingly [CORRECT]
C. Maintain a separate ISMS for the acquired entity for a minimum of 12 months before integration
D. Decertify and recertify the entire organization under a new ISO 27001 scope that includes both entities
Correct Answer: B
Rationale: ISO 27001 Clause 6.3 requires organizations to plan and manage changes that could affect the ISMS in a controlled manner.
When an acquisition introduces new systems, processes, and risks, the organization must reassess the impact on its ISMS scope and context,
conduct risk assessments for the newly integrated assets, and update the risk treatment plan. This managed approach maintains compliance
without requiring decertification, and the timeline for notifying the certification body depends on the change's materiality rather than an
arbitrary deadline.
Q10: A large enterprise is using TOGAF's Architecture Development Method (ADM) to design its enterprise security
architecture. The architecture team is currently in Phase C (Information Systems Architectures) and needs to define
how security services will integrate with business applications. Which TOGAF concept is most relevant for ensuring
that security considerations are embedded across all architecture domains rather than treated as a standalone
domain?
A. Architecture Capability
B. Enterprise Continuum
C. Security Architecture as a cross-cutting concern addressed in every ADM phase through stakeholder concerns and
requirements [CORRECT]
D. Architecture Repository
Correct Answer: C
Rationale: In TOGAF, security architecture functions as a cross-cutting concern that must be addressed across all ADM phases rather than
being isolated to a single phase or domain. Each phase of the ADM, from Preliminary through Requirements Management, has
security-related stakeholder concerns that must be captured and addressed. While the Architecture Capability and Enterprise Continuum
are important TOGAF concepts, they do not specifically address the need to embed security across all architecture domains.
