WGU D488 Cybersecurity Architecture and
Engineering Midterm Exam 2026/2027 | 150
Verified Questions & Answers | Western
Governors University Prep | Instant Download
1. Which security principle states that users should be given only the minimum access necessary to
perform their job?
A) Defense in depth
B) Least privilege
C) Separation of duties
D) Zero trust
Answer: B
Rationale: Least privilege limits access rights to only what is required, reducing attack surface and insider
risk.
2. Which framework provides a voluntary, risk-based set of cybersecurity guidelines organized
into five functions: Identify, Protect, Detect, Respond, Recover?
A) ISO/IEC 27001
B) NIST Cybersecurity Framework (CSF)
C) PCI DSS
D) COBIT
Answer: B
Rationale: NIST CSF is a voluntary framework with five core functions for managing cybersecurity risk.
3. What is the primary purpose of a DMZ in network architecture?
A) To store backups
B) To isolate external-facing services from the internal network
,C) To encrypt all traffic
D) To authenticate users
Answer: B
Rationale: A DMZ adds a layer of security by segregating public services from internal systems.
4. Which type of encryption uses the same key for both encryption and decryption?
A) Asymmetric
B) Symmetric
C) Hashing
D) Digital signature
Answer: B
Rationale: Symmetric encryption uses a shared secret key for both encryption and decryption.
5. In a PKI, what is the role of a Certificate Authority (CA)?
A) Encrypt data
B) Issue and revoke digital certificates
C) Store private keys
D) Perform hashing
Answer: B
Rationale: The CA validates identities and issues digital certificates that bind public keys to entities.
6. Which access control model uses attributes such as user department, time of day, and resource
sensitivity?
A) RBAC
B) ABAC
C) MAC
D) DAC
Answer: B
2
,Rationale: Attribute-Based Access Control evaluates attributes (user, resource, environment) to make
access decisions.
7. What does the STRIDE threat modeling framework stand for?
A) Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege
B) Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege
C) Security, Trust, Risk, Identity, Data, Encryption
D) Scanning, Testing, Reporting, Isolation, Detection, Elimination
Answer: B
Rationale: STRIDE is a Microsoft threat modeling mnemonic for six threat categories.
8. In cloud computing, which model places the greatest security responsibility on the customer?
A) SaaS
B) PaaS
C) IaaS
D) FaaS
Answer: C
Rationale: In IaaS, the customer manages OS, middleware, runtime, and applications, while the provider
secures the infrastructure.
9. What is the primary goal of a Business Impact Analysis (BIA)?
A) Identify vulnerabilities
B) Determine critical business functions and their recovery requirements
C) Test incident response
D) Encrypt data at rest
Answer: B
Rationale: BIA identifies critical processes and establishes RTO/RPO for continuity planning.
3
, 10. Which backup strategy involves copying only changed data since the last full backup?
A) Full backup
B) Incremental backup
C) Differential backup
D) Snapshot
Answer: B
Rationale: Incremental backups capture changes since the last backup of any type, reducing backup
time and storage.
11. What is the purpose of a SIEM system?
A) Encrypt network traffic
B) Aggregate and correlate security events for monitoring and alerting
C) Manage user identities
D) Perform vulnerability scans
Answer: B
Rationale: SIEM collects logs from multiple sources, correlates events, and generates alerts for security
incidents.
12. Which of the following is a symmetric encryption algorithm?
A) RSA
B) AES
C) ECC
D) Diffie-Hellman
Answer: B
Rationale: AES (Advanced Encryption Standard) is a symmetric block cipher. RSA and ECC are
asymmetric.
4
Engineering Midterm Exam 2026/2027 | 150
Verified Questions & Answers | Western
Governors University Prep | Instant Download
1. Which security principle states that users should be given only the minimum access necessary to
perform their job?
A) Defense in depth
B) Least privilege
C) Separation of duties
D) Zero trust
Answer: B
Rationale: Least privilege limits access rights to only what is required, reducing attack surface and insider
risk.
2. Which framework provides a voluntary, risk-based set of cybersecurity guidelines organized
into five functions: Identify, Protect, Detect, Respond, Recover?
A) ISO/IEC 27001
B) NIST Cybersecurity Framework (CSF)
C) PCI DSS
D) COBIT
Answer: B
Rationale: NIST CSF is a voluntary framework with five core functions for managing cybersecurity risk.
3. What is the primary purpose of a DMZ in network architecture?
A) To store backups
B) To isolate external-facing services from the internal network
,C) To encrypt all traffic
D) To authenticate users
Answer: B
Rationale: A DMZ adds a layer of security by segregating public services from internal systems.
4. Which type of encryption uses the same key for both encryption and decryption?
A) Asymmetric
B) Symmetric
C) Hashing
D) Digital signature
Answer: B
Rationale: Symmetric encryption uses a shared secret key for both encryption and decryption.
5. In a PKI, what is the role of a Certificate Authority (CA)?
A) Encrypt data
B) Issue and revoke digital certificates
C) Store private keys
D) Perform hashing
Answer: B
Rationale: The CA validates identities and issues digital certificates that bind public keys to entities.
6. Which access control model uses attributes such as user department, time of day, and resource
sensitivity?
A) RBAC
B) ABAC
C) MAC
D) DAC
Answer: B
2
,Rationale: Attribute-Based Access Control evaluates attributes (user, resource, environment) to make
access decisions.
7. What does the STRIDE threat modeling framework stand for?
A) Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege
B) Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege
C) Security, Trust, Risk, Identity, Data, Encryption
D) Scanning, Testing, Reporting, Isolation, Detection, Elimination
Answer: B
Rationale: STRIDE is a Microsoft threat modeling mnemonic for six threat categories.
8. In cloud computing, which model places the greatest security responsibility on the customer?
A) SaaS
B) PaaS
C) IaaS
D) FaaS
Answer: C
Rationale: In IaaS, the customer manages OS, middleware, runtime, and applications, while the provider
secures the infrastructure.
9. What is the primary goal of a Business Impact Analysis (BIA)?
A) Identify vulnerabilities
B) Determine critical business functions and their recovery requirements
C) Test incident response
D) Encrypt data at rest
Answer: B
Rationale: BIA identifies critical processes and establishes RTO/RPO for continuity planning.
3
, 10. Which backup strategy involves copying only changed data since the last full backup?
A) Full backup
B) Incremental backup
C) Differential backup
D) Snapshot
Answer: B
Rationale: Incremental backups capture changes since the last backup of any type, reducing backup
time and storage.
11. What is the purpose of a SIEM system?
A) Encrypt network traffic
B) Aggregate and correlate security events for monitoring and alerting
C) Manage user identities
D) Perform vulnerability scans
Answer: B
Rationale: SIEM collects logs from multiple sources, correlates events, and generates alerts for security
incidents.
12. Which of the following is a symmetric encryption algorithm?
A) RSA
B) AES
C) ECC
D) Diffie-Hellman
Answer: B
Rationale: AES (Advanced Encryption Standard) is a symmetric block cipher. RSA and ECC are
asymmetric.
4
