WGU D488 Cybersecurity Architecture and
Engineering Final Exam 2026/2027 | 350 Verified
Questions & Answers | Western Governors
University Prep | Instant Download
1. Which principle states that a user should be given only the minimum access necessary to
perform their job?
A) Defense in depth
B) Least privilege
C) Separation of duties
D) Zero trust
Answer: B
Rationale: Least privilege limits access rights to only what is required for the job function.
2. What does the principle of "defense in depth" refer to?
A) Using a single strong firewall
B) Layered security controls across multiple levels
C) Encrypting all data at rest
D) Implementing zero trust
Answer: B
Rationale: Defense in depth uses multiple layers so that if one fails, others still protect.
3. Which security model assumes no implicit trust and verifies every access request?
A) Perimeter security
B) Zero trust
C) Defense in depth
D) Demilitarized zone
,Answer: B
Rationale: Zero trust continuously verifies and never trusts by default.
4. What is the primary purpose of a DMZ in network architecture?
A) To host internal databases
B) To isolate external-facing services from the internal network
C) To provide VPN access
D) To store backups
Answer: B
Rationale: DMZ adds a layer of security between the internet and internal networks.
5. Which type of firewall tracks the state of active connections?
A) Packet-filtering firewall
B) Stateful inspection firewall
C) Proxy firewall
D) Next-generation firewall
Answer: B
Rationale: Stateful firewalls monitor connection states and make decisions based on context.
6. What does an IDS primarily do?
A) Block malicious traffic
B) Detect and alert on suspicious activity
C) Encrypt network traffic
D) Authenticate users
Answer: B
Rationale: IDS detects and alerts; IPS can block.
2
,7. What is the key difference between IDS and IPS?
A) IDS is hardware, IPS is software
B) IPS can block traffic, IDS only alerts
C) IDS is for cloud, IPS is on-prem
D) IDS uses signatures, IPS uses anomalies
Answer: B
Rationale: IPS actively prevents intrusions; IDS passively monitors.
8. Which VPN protocol is considered secure and widely used?
A) PPTP
B) L2TP without IPsec
C) IPsec
D) Telnet
Answer: C
Rationale: IPsec provides strong encryption and authentication for VPNs.
9. What is network segmentation?
A) Combining all networks into one
B) Dividing a network into smaller, isolated segments
C) Encrypting all traffic
D) Using only wireless
Answer: B
Rationale: Segmentation limits lateral movement and contains breaches.
10. Which protocol is used for secure web browsing?
A) HTTP
B) FTP
C) HTTPS
3
, D) Telnet
Answer: C
Rationale: HTTPS uses TLS to encrypt web traffic.
11. What does TLS provide?
A) Only encryption
B) Encryption, authentication, and integrity
C) Only authentication
D) Only integrity
Answer: B
Rationale: TLS secures communications with confidentiality, integrity, and authentication.
12. Which cryptographic method uses the same key for encryption and decryption?
A) Asymmetric
B) Symmetric
C) Hashing
D) Digital signature
Answer: B
Rationale: Symmetric encryption uses a shared secret key.
13. Which asymmetric algorithm is widely used for key exchange?
A) AES
B) RSA
C) SHA-256
D) MD5
Answer: B
Rationale: RSA is a public-key cryptosystem used for encryption and key exchange.
4
Engineering Final Exam 2026/2027 | 350 Verified
Questions & Answers | Western Governors
University Prep | Instant Download
1. Which principle states that a user should be given only the minimum access necessary to
perform their job?
A) Defense in depth
B) Least privilege
C) Separation of duties
D) Zero trust
Answer: B
Rationale: Least privilege limits access rights to only what is required for the job function.
2. What does the principle of "defense in depth" refer to?
A) Using a single strong firewall
B) Layered security controls across multiple levels
C) Encrypting all data at rest
D) Implementing zero trust
Answer: B
Rationale: Defense in depth uses multiple layers so that if one fails, others still protect.
3. Which security model assumes no implicit trust and verifies every access request?
A) Perimeter security
B) Zero trust
C) Defense in depth
D) Demilitarized zone
,Answer: B
Rationale: Zero trust continuously verifies and never trusts by default.
4. What is the primary purpose of a DMZ in network architecture?
A) To host internal databases
B) To isolate external-facing services from the internal network
C) To provide VPN access
D) To store backups
Answer: B
Rationale: DMZ adds a layer of security between the internet and internal networks.
5. Which type of firewall tracks the state of active connections?
A) Packet-filtering firewall
B) Stateful inspection firewall
C) Proxy firewall
D) Next-generation firewall
Answer: B
Rationale: Stateful firewalls monitor connection states and make decisions based on context.
6. What does an IDS primarily do?
A) Block malicious traffic
B) Detect and alert on suspicious activity
C) Encrypt network traffic
D) Authenticate users
Answer: B
Rationale: IDS detects and alerts; IPS can block.
2
,7. What is the key difference between IDS and IPS?
A) IDS is hardware, IPS is software
B) IPS can block traffic, IDS only alerts
C) IDS is for cloud, IPS is on-prem
D) IDS uses signatures, IPS uses anomalies
Answer: B
Rationale: IPS actively prevents intrusions; IDS passively monitors.
8. Which VPN protocol is considered secure and widely used?
A) PPTP
B) L2TP without IPsec
C) IPsec
D) Telnet
Answer: C
Rationale: IPsec provides strong encryption and authentication for VPNs.
9. What is network segmentation?
A) Combining all networks into one
B) Dividing a network into smaller, isolated segments
C) Encrypting all traffic
D) Using only wireless
Answer: B
Rationale: Segmentation limits lateral movement and contains breaches.
10. Which protocol is used for secure web browsing?
A) HTTP
B) FTP
C) HTTPS
3
, D) Telnet
Answer: C
Rationale: HTTPS uses TLS to encrypt web traffic.
11. What does TLS provide?
A) Only encryption
B) Encryption, authentication, and integrity
C) Only authentication
D) Only integrity
Answer: B
Rationale: TLS secures communications with confidentiality, integrity, and authentication.
12. Which cryptographic method uses the same key for encryption and decryption?
A) Asymmetric
B) Symmetric
C) Hashing
D) Digital signature
Answer: B
Rationale: Symmetric encryption uses a shared secret key.
13. Which asymmetric algorithm is widely used for key exchange?
A) AES
B) RSA
C) SHA-256
D) MD5
Answer: B
Rationale: RSA is a public-key cryptosystem used for encryption and key exchange.
4
