WGU D488 Cybersecurity Architecture
& Engineering – Exam Prep Study
Guide & Practice Questions
Section 1: Security Architecture Frameworks & Principles.
1. An enterprise is redesigning its security architecture to align business goals with security controls.
The security architect selects a framework that begins with business requirements, maps them to
security services, and produces logical and physical architecture layers. The framework chosen
emphasizes business-driven security and uses a six-layer model. Which framework BEST fits this
requirement?
A. TOGAF Architecture Development Method focused primarily on enterprise IT alignment
B. SABSA framework that starts from business requirements and cascades through contextual to
component layers
C. Zachman Framework that organizes artifacts solely by audience perspectives without security
services
D. NIST Cybersecurity Framework that prioritizes detect-function maturity over architectural
layering
ANSWER: B
ROTIONALE: SABSA is explicitly business-driven and structures security architecture from
contextual (business) through conceptual, logical, physical, component, and operational layers.
TOGAF is broader enterprise architecture; Zachman is a taxonomy; NIST CSF is risk/function
oriented rather than a layered architecture method.
2. A chief information security officer requires that every new system undergo a formal architecture
review before production deployment. The review board insists that security controls be selected
according to the principle that no single control failure should allow a complete compromise of critical
assets. This design principle is known as:
A. Least privilege that restricts every user to the minimum rights needed for a task
B. Defense in depth that layers multiple independent controls so that failure of one does not expose
the asset
C. Fail-safe defaults that deny access unless a condition is explicitly met
D. Separation of duties that splits critical functions among multiple individuals
ANSWER: B
ROTIONALE: Defense in depth deliberately overlays complementary controls (preventive,
detective, corrective) so that compromise of any single layer still leaves residual protection. The
other principles address privilege, default posture, or duty segregation rather than layered
resilience.
,3. During an architecture workshop the team debates whether to place a web application firewall in
front of every public-facing application or only those handling regulated data. The decision is guided
by a formal risk assessment that weighs residual risk against the cost of the control. This approach
exemplifies:
A. Compliance-driven design that applies identical controls to every system regardless of risk
B. Technology-driven design that adopts the newest security product for every tier
C. Risk-based architecture that selects and prioritizes controls according to assessed likelihood and
impact
D. Vendor-recommended reference architecture applied without customization
ANSWER: C
ROTIONALE: Risk-based architecture evaluates threats, vulnerabilities, and business impact to
determine which controls are warranted and where they should be placed. Uniform compliance or
technology-driven approaches ignore risk differentiation.
4. A security architect is designing a system that enforces mandatory access controls based on
security labels. Which access control model is being implemented?
A. Role-Based Access Control (RBAC)
B. Mandatory Access Control (MAC)
C. Discretionary Access Control (DAC)
D. Attribute-Based Access Control (ABAC)
ANSWER: B
ROTIONALE: Mandatory Access Control (MAC) enforces access based on security labels assigned
to subjects and objects. Users cannot change these labels, and access is determined by the
system's security policy.
5. Which Zero Trust principle requires that every access request be authenticated and authorized
regardless of network location?
A. Assume breach
B. Never trust, always verify
C. Least privilege
D. Microsegmentation
ANSWER: B
ROTIONALE: The core Zero Trust principle is "never trust, always verify," meaning no user or device
is trusted by default, even if inside the network perimeter.
6. In the SABSA framework, which layer addresses the business view of security architecture?
A. Conceptual layer
,B. Contextual layer
C. Logical layer
D. Physical layer
ANSWER: B
ROTIONALE: The contextual layer in SABSA addresses the business view, including business risk
and the "what, why, how, who, where, when" of security architecture.
7. Which NIST Cybersecurity Framework function is responsible for developing and implementing
appropriate activities to identify the occurrence of a cybersecurity event?
A. Identify (ID)
B. Protect (PR)
C. Detect (DE)
D. Respond (RS)
ANSWER: C
ROTIONALE: The Detect (DE) function defines activities to identify the occurrence of a
cybersecurity event, including continuous monitoring and detection processes.
8. A security architect is selecting controls from NIST SP 800-53. Which control family addresses
access control policies and mechanisms?
A. AC (Access Control)
B. AU (Audit and Accountability)
C. CM (Configuration Management)
D. IA (Identification and Authentication)
ANSWER: A
ROTIONALE: The AC (Access Control) family in NIST SP 800-53 addresses access control
policies, procedures, and mechanisms for protecting information systems.
9. Which security design principle states that a system should default to a secure state when it fails?
A. Least privilege
B. Fail-safe defaults
C. Complete mediation
D. Economy of mechanism
ANSWER: B
ROTIONALE: Fail-safe defaults (also called fail-secure) ensure that when a system fails, it defaults
to a secure state, denying access rather than granting it.
, 10. The principle of "complete mediation" requires that:
A. Every access to every object is checked for authorization
B. Users are granted only the minimum access needed
C. The design should be as simple as possible
D. Security should not rely on secrecy of design
ANSWER: A
ROTIONALE: Complete mediation requires that every access request to every object be checked
against the security policy, ensuring no unauthorized access occurs.
11. Which framework provides a six-layer model for enterprise security architecture?
A. TOGAF
B. SABSA
C. Zachman
D. COBIT
ANSWER: B
ROTIONALE: SABSA (Sherwood Applied Business Security Architecture) provides a six-layer
model: Contextual, Conceptual, Logical, Physical, Component, and Operational.
12. In Zero Trust Architecture, what is the role of the Policy Decision Point (PDP)?
A. Enforces access decisions
B. Makes access decisions based on policy
C. Monitors network traffic
D. Manages encryption keys
ANSWER: B
ROTIONALE: The Policy Decision Point (PDP) evaluates access requests against policy and
makes the decision to grant or deny access. The Policy Enforcement Point (PEP) enforces the
decision.
13. Which NIST RMF step involves determining the security category of a system based on the
impact of loss?
A. Prepare
B. Categorize
C. Select
D. Implement
ANSWER: B
& Engineering – Exam Prep Study
Guide & Practice Questions
Section 1: Security Architecture Frameworks & Principles.
1. An enterprise is redesigning its security architecture to align business goals with security controls.
The security architect selects a framework that begins with business requirements, maps them to
security services, and produces logical and physical architecture layers. The framework chosen
emphasizes business-driven security and uses a six-layer model. Which framework BEST fits this
requirement?
A. TOGAF Architecture Development Method focused primarily on enterprise IT alignment
B. SABSA framework that starts from business requirements and cascades through contextual to
component layers
C. Zachman Framework that organizes artifacts solely by audience perspectives without security
services
D. NIST Cybersecurity Framework that prioritizes detect-function maturity over architectural
layering
ANSWER: B
ROTIONALE: SABSA is explicitly business-driven and structures security architecture from
contextual (business) through conceptual, logical, physical, component, and operational layers.
TOGAF is broader enterprise architecture; Zachman is a taxonomy; NIST CSF is risk/function
oriented rather than a layered architecture method.
2. A chief information security officer requires that every new system undergo a formal architecture
review before production deployment. The review board insists that security controls be selected
according to the principle that no single control failure should allow a complete compromise of critical
assets. This design principle is known as:
A. Least privilege that restricts every user to the minimum rights needed for a task
B. Defense in depth that layers multiple independent controls so that failure of one does not expose
the asset
C. Fail-safe defaults that deny access unless a condition is explicitly met
D. Separation of duties that splits critical functions among multiple individuals
ANSWER: B
ROTIONALE: Defense in depth deliberately overlays complementary controls (preventive,
detective, corrective) so that compromise of any single layer still leaves residual protection. The
other principles address privilege, default posture, or duty segregation rather than layered
resilience.
,3. During an architecture workshop the team debates whether to place a web application firewall in
front of every public-facing application or only those handling regulated data. The decision is guided
by a formal risk assessment that weighs residual risk against the cost of the control. This approach
exemplifies:
A. Compliance-driven design that applies identical controls to every system regardless of risk
B. Technology-driven design that adopts the newest security product for every tier
C. Risk-based architecture that selects and prioritizes controls according to assessed likelihood and
impact
D. Vendor-recommended reference architecture applied without customization
ANSWER: C
ROTIONALE: Risk-based architecture evaluates threats, vulnerabilities, and business impact to
determine which controls are warranted and where they should be placed. Uniform compliance or
technology-driven approaches ignore risk differentiation.
4. A security architect is designing a system that enforces mandatory access controls based on
security labels. Which access control model is being implemented?
A. Role-Based Access Control (RBAC)
B. Mandatory Access Control (MAC)
C. Discretionary Access Control (DAC)
D. Attribute-Based Access Control (ABAC)
ANSWER: B
ROTIONALE: Mandatory Access Control (MAC) enforces access based on security labels assigned
to subjects and objects. Users cannot change these labels, and access is determined by the
system's security policy.
5. Which Zero Trust principle requires that every access request be authenticated and authorized
regardless of network location?
A. Assume breach
B. Never trust, always verify
C. Least privilege
D. Microsegmentation
ANSWER: B
ROTIONALE: The core Zero Trust principle is "never trust, always verify," meaning no user or device
is trusted by default, even if inside the network perimeter.
6. In the SABSA framework, which layer addresses the business view of security architecture?
A. Conceptual layer
,B. Contextual layer
C. Logical layer
D. Physical layer
ANSWER: B
ROTIONALE: The contextual layer in SABSA addresses the business view, including business risk
and the "what, why, how, who, where, when" of security architecture.
7. Which NIST Cybersecurity Framework function is responsible for developing and implementing
appropriate activities to identify the occurrence of a cybersecurity event?
A. Identify (ID)
B. Protect (PR)
C. Detect (DE)
D. Respond (RS)
ANSWER: C
ROTIONALE: The Detect (DE) function defines activities to identify the occurrence of a
cybersecurity event, including continuous monitoring and detection processes.
8. A security architect is selecting controls from NIST SP 800-53. Which control family addresses
access control policies and mechanisms?
A. AC (Access Control)
B. AU (Audit and Accountability)
C. CM (Configuration Management)
D. IA (Identification and Authentication)
ANSWER: A
ROTIONALE: The AC (Access Control) family in NIST SP 800-53 addresses access control
policies, procedures, and mechanisms for protecting information systems.
9. Which security design principle states that a system should default to a secure state when it fails?
A. Least privilege
B. Fail-safe defaults
C. Complete mediation
D. Economy of mechanism
ANSWER: B
ROTIONALE: Fail-safe defaults (also called fail-secure) ensure that when a system fails, it defaults
to a secure state, denying access rather than granting it.
, 10. The principle of "complete mediation" requires that:
A. Every access to every object is checked for authorization
B. Users are granted only the minimum access needed
C. The design should be as simple as possible
D. Security should not rely on secrecy of design
ANSWER: A
ROTIONALE: Complete mediation requires that every access request to every object be checked
against the security policy, ensuring no unauthorized access occurs.
11. Which framework provides a six-layer model for enterprise security architecture?
A. TOGAF
B. SABSA
C. Zachman
D. COBIT
ANSWER: B
ROTIONALE: SABSA (Sherwood Applied Business Security Architecture) provides a six-layer
model: Contextual, Conceptual, Logical, Physical, Component, and Operational.
12. In Zero Trust Architecture, what is the role of the Policy Decision Point (PDP)?
A. Enforces access decisions
B. Makes access decisions based on policy
C. Monitors network traffic
D. Manages encryption keys
ANSWER: B
ROTIONALE: The Policy Decision Point (PDP) evaluates access requests against policy and
makes the decision to grant or deny access. The Policy Enforcement Point (PEP) enforces the
decision.
13. Which NIST RMF step involves determining the security category of a system based on the
impact of loss?
A. Prepare
B. Categorize
C. Select
D. Implement
ANSWER: B
