WGU C795 Cybersecurity Management II
Tactical OA Exam Actual Exam 2026/2027 –
Complete Exam-Style Questions with Detailed
Rationales | 100% Verified | Pass Guaranteed –
A+ Graded
Section A: Cybersecurity Governance, Policy, & Strategy
Q1: A mid-sized healthcare organization is implementing a new cybersecurity program.
The CISO drafts a document stating that "all workforce members must complete annual
security awareness training" and that "non-compliance will result in disciplinary action."
Which component of the policy hierarchy does this document represent?
A. A guideline
B. A standard
C. A policy [CORRECT]
D. A procedure
Correct Answer: C
Rationale: A policy is a high-level directive that establishes what must be done and why,
with consequences for non-compliance. Standards specify mandatory requirements,
procedures detail step-by-step execution, and guidelines are recommendations without
enforcement.
Q2: An enterprise security team is evaluating whether to adopt the NIST Cybersecurity
Framework or ISO 27001. The CISO wants a framework that provides a common
language for organizing cybersecurity activities into five core functions. Which
framework best meets this requirement?
A. ISO 27001
B. COBIT
C. NIST Cybersecurity Framework [CORRECT]
D. ITIL
Correct Answer: C
,Rationale: The NIST CSF organizes cybersecurity activities into five core functions:
Identify, Protect, Detect, Respond, and Recover. ISO 27001 is an auditable standard for
ISMS, COBIT focuses on IT governance, and ITIL addresses IT service management.
Q3: During a policy-gap assessment, the security team discovers that the organization
has strong technical controls but lacks documented procedures for incident escalation.
Which type of gap has been identified?
A. Technology gap
B. Governance gap
C. Procedural gap [CORRECT]
D. Personnel gap
Correct Answer: C
Rationale: A procedural gap exists when documented steps to carry out policies are
missing or inadequate. A technology gap involves missing tools, a governance gap
involves decision-making structures, and a personnel gap involves staffing or skills.
Q4: The board of directors establishes that the organization is willing to accept up to $5
million in annual cyber risk losses before requiring additional controls. This statement
best describes:
A. Risk tolerance
B. Risk appetite [CORRECT]
C. Risk capacity
D. Risk threshold
Correct Answer: B
Rationale: Risk appetite defines the total amount of risk an organization is willing to
accept in pursuit of objectives. Risk tolerance applies to specific categories, risk
capacity is the maximum risk the organization can bear, and risk threshold is a trigger
point for action.
Q5: A CISO is developing a security strategy and wants to ensure that security
investments align with the organization's mission to deliver uninterrupted patient care.
Which principle of security governance best supports this alignment?
A. Security as a cost center
B. Security as an enabler of business objectives [CORRECT]
C. Security as an independent function
, D. Security as a compliance checkbox
Correct Answer: B
Rationale: Effective cybersecurity governance positions security as an enabler that
supports organizational objectives rather than a blocker. Options A, C, and D represent
outdated or ineffective governance perspectives.
Q6: An organization has a document that specifies "all laptops must use AES-256
encryption for data at rest." This document is best classified as:
A. A policy
B. A standard [CORRECT]
C. A guideline
D. A baseline
Correct Answer: B
Rationale: Standards establish mandatory, specific requirements that support policies.
This document mandates a specific control (AES-256), making it a standard. Policies
are broader, guidelines are recommendations, and baselines are minimum
configurations.
Q7: A new CISO joins an organization and finds that security decisions are made ad hoc
by various IT managers without centralized oversight. Which governance element is
most urgently needed?
A. A new firewall
B. A governance structure with defined accountability and decision-making authority
[CORRECT]
C. A vulnerability scanner
D. An intrusion detection system
Correct Answer: B
Rationale: Governance establishes who makes security decisions, how they align with
objectives, and who is accountable. Without governance, technology purchases
(options A, C, D) will not be strategically aligned or effectively managed.
Q8: The security team is drafting a document that provides step-by-step instructions for
configuring multi-factor authentication on all remote access systems. This document is
best classified as:
A. A policy
Tactical OA Exam Actual Exam 2026/2027 –
Complete Exam-Style Questions with Detailed
Rationales | 100% Verified | Pass Guaranteed –
A+ Graded
Section A: Cybersecurity Governance, Policy, & Strategy
Q1: A mid-sized healthcare organization is implementing a new cybersecurity program.
The CISO drafts a document stating that "all workforce members must complete annual
security awareness training" and that "non-compliance will result in disciplinary action."
Which component of the policy hierarchy does this document represent?
A. A guideline
B. A standard
C. A policy [CORRECT]
D. A procedure
Correct Answer: C
Rationale: A policy is a high-level directive that establishes what must be done and why,
with consequences for non-compliance. Standards specify mandatory requirements,
procedures detail step-by-step execution, and guidelines are recommendations without
enforcement.
Q2: An enterprise security team is evaluating whether to adopt the NIST Cybersecurity
Framework or ISO 27001. The CISO wants a framework that provides a common
language for organizing cybersecurity activities into five core functions. Which
framework best meets this requirement?
A. ISO 27001
B. COBIT
C. NIST Cybersecurity Framework [CORRECT]
D. ITIL
Correct Answer: C
,Rationale: The NIST CSF organizes cybersecurity activities into five core functions:
Identify, Protect, Detect, Respond, and Recover. ISO 27001 is an auditable standard for
ISMS, COBIT focuses on IT governance, and ITIL addresses IT service management.
Q3: During a policy-gap assessment, the security team discovers that the organization
has strong technical controls but lacks documented procedures for incident escalation.
Which type of gap has been identified?
A. Technology gap
B. Governance gap
C. Procedural gap [CORRECT]
D. Personnel gap
Correct Answer: C
Rationale: A procedural gap exists when documented steps to carry out policies are
missing or inadequate. A technology gap involves missing tools, a governance gap
involves decision-making structures, and a personnel gap involves staffing or skills.
Q4: The board of directors establishes that the organization is willing to accept up to $5
million in annual cyber risk losses before requiring additional controls. This statement
best describes:
A. Risk tolerance
B. Risk appetite [CORRECT]
C. Risk capacity
D. Risk threshold
Correct Answer: B
Rationale: Risk appetite defines the total amount of risk an organization is willing to
accept in pursuit of objectives. Risk tolerance applies to specific categories, risk
capacity is the maximum risk the organization can bear, and risk threshold is a trigger
point for action.
Q5: A CISO is developing a security strategy and wants to ensure that security
investments align with the organization's mission to deliver uninterrupted patient care.
Which principle of security governance best supports this alignment?
A. Security as a cost center
B. Security as an enabler of business objectives [CORRECT]
C. Security as an independent function
, D. Security as a compliance checkbox
Correct Answer: B
Rationale: Effective cybersecurity governance positions security as an enabler that
supports organizational objectives rather than a blocker. Options A, C, and D represent
outdated or ineffective governance perspectives.
Q6: An organization has a document that specifies "all laptops must use AES-256
encryption for data at rest." This document is best classified as:
A. A policy
B. A standard [CORRECT]
C. A guideline
D. A baseline
Correct Answer: B
Rationale: Standards establish mandatory, specific requirements that support policies.
This document mandates a specific control (AES-256), making it a standard. Policies
are broader, guidelines are recommendations, and baselines are minimum
configurations.
Q7: A new CISO joins an organization and finds that security decisions are made ad hoc
by various IT managers without centralized oversight. Which governance element is
most urgently needed?
A. A new firewall
B. A governance structure with defined accountability and decision-making authority
[CORRECT]
C. A vulnerability scanner
D. An intrusion detection system
Correct Answer: B
Rationale: Governance establishes who makes security decisions, how they align with
objectives, and who is accountable. Without governance, technology purchases
(options A, C, D) will not be strategically aligned or effectively managed.
Q8: The security team is drafting a document that provides step-by-step instructions for
configuring multi-factor authentication on all remote access systems. This document is
best classified as:
A. A policy
