WGU D488 Cybersecurity Architecture and
Engineering Final Exam 2026/2027 | 150 Verified
Questions & Answers | Western Governors
University Prep | Instant Download
1. Which security architecture framework focuses on business-driven security and uses layers of
abstraction?
A) Zachman Framework
B) SABSA
C) TOGAF
D) COBIT
Answer: B
Rationale: SABSA is a business-driven security architecture framework with layers from business to
technology.
2. What principle ensures users have only the minimum access needed to perform their jobs?
A) Separation of duties
B) Least privilege
C) Defense in depth
D) Zero trust
Answer: B
Rationale: Least privilege limits access rights to the minimum necessary for job functions.
3. Which model assumes no implicit trust and verifies every access request?
A) Perimeter security
B) Zero trust
C) Defense in depth
,D) Castle-and-moat
Answer: B
Rationale: Zero trust continuously verifies users, devices, and transactions regardless of location.
4. In defense in depth, how many layers of security should be implemented?
A) One
B) Two
C) Multiple
D) None
Answer: C
Rationale: Defense in depth uses multiple overlapping controls to protect assets.
5. Which cryptographic method uses the same key for encryption and decryption?
A) Asymmetric
B) Symmetric
C) Hashing
D) Digital signature
Answer: B
Rationale: Symmetric encryption uses a shared secret key for both encryption and decryption.
6. Which algorithm is an example of asymmetric encryption?
A) AES
B) DES
C) RSA
D) 3DES
Answer: C
Rationale: RSA is a public-key (asymmetric) algorithm using a public and private key pair.
2
,7. What is the primary purpose of a hash function?
A) Encrypt data
B) Verify data integrity
C) Compress data
D) Transmit data
Answer: B
Rationale: Hash functions produce a fixed-size digest used to detect changes to data.
8. Which protocol provides secure web communication using TLS?
A) HTTP
B) FTP
C) HTTPS
D) Telnet
Answer: C
Rationale: HTTPS uses TLS to encrypt HTTP traffic between client and server.
9. What does a digital signature provide?
A) Confidentiality only
B) Authentication, integrity, and non-repudiation
C) Availability
D) Compression
Answer: B
Rationale: Digital signatures verify origin, integrity, and prevent denial of signing.
10. In PKI, what is a certificate authority (CA) responsible for?
A) Encrypting all traffic
B) Issuing and managing digital certificates
3
, C) Storing private keys for users
D) Routing network packets
Answer: B
Rationale: A CA validates identities and issues signed digital certificates.
11. Which firewall type inspects traffic based on application-layer data?
A) Packet filter
B) Stateful inspection
C) Next-generation firewall (NGFW)
D) Circuit-level gateway
Answer: C
Rationale: NGFWs include application awareness, intrusion prevention, and deep packet inspection.
12. What is the primary function of an IDS?
A) Block malicious traffic
B) Detect and alert on suspicious activity
C) Encrypt network traffic
D) Route packets
Answer: B
Rationale: IDS monitors and alerts; IPS can block.
13. Which network segmentation strategy isolates public-facing services from internal networks?
A) VLAN
B) DMZ
C) VPN
D) NAT
Answer: B
Rationale: A DMZ is a buffer zone between external and internal networks.
4
Engineering Final Exam 2026/2027 | 150 Verified
Questions & Answers | Western Governors
University Prep | Instant Download
1. Which security architecture framework focuses on business-driven security and uses layers of
abstraction?
A) Zachman Framework
B) SABSA
C) TOGAF
D) COBIT
Answer: B
Rationale: SABSA is a business-driven security architecture framework with layers from business to
technology.
2. What principle ensures users have only the minimum access needed to perform their jobs?
A) Separation of duties
B) Least privilege
C) Defense in depth
D) Zero trust
Answer: B
Rationale: Least privilege limits access rights to the minimum necessary for job functions.
3. Which model assumes no implicit trust and verifies every access request?
A) Perimeter security
B) Zero trust
C) Defense in depth
,D) Castle-and-moat
Answer: B
Rationale: Zero trust continuously verifies users, devices, and transactions regardless of location.
4. In defense in depth, how many layers of security should be implemented?
A) One
B) Two
C) Multiple
D) None
Answer: C
Rationale: Defense in depth uses multiple overlapping controls to protect assets.
5. Which cryptographic method uses the same key for encryption and decryption?
A) Asymmetric
B) Symmetric
C) Hashing
D) Digital signature
Answer: B
Rationale: Symmetric encryption uses a shared secret key for both encryption and decryption.
6. Which algorithm is an example of asymmetric encryption?
A) AES
B) DES
C) RSA
D) 3DES
Answer: C
Rationale: RSA is a public-key (asymmetric) algorithm using a public and private key pair.
2
,7. What is the primary purpose of a hash function?
A) Encrypt data
B) Verify data integrity
C) Compress data
D) Transmit data
Answer: B
Rationale: Hash functions produce a fixed-size digest used to detect changes to data.
8. Which protocol provides secure web communication using TLS?
A) HTTP
B) FTP
C) HTTPS
D) Telnet
Answer: C
Rationale: HTTPS uses TLS to encrypt HTTP traffic between client and server.
9. What does a digital signature provide?
A) Confidentiality only
B) Authentication, integrity, and non-repudiation
C) Availability
D) Compression
Answer: B
Rationale: Digital signatures verify origin, integrity, and prevent denial of signing.
10. In PKI, what is a certificate authority (CA) responsible for?
A) Encrypting all traffic
B) Issuing and managing digital certificates
3
, C) Storing private keys for users
D) Routing network packets
Answer: B
Rationale: A CA validates identities and issues signed digital certificates.
11. Which firewall type inspects traffic based on application-layer data?
A) Packet filter
B) Stateful inspection
C) Next-generation firewall (NGFW)
D) Circuit-level gateway
Answer: C
Rationale: NGFWs include application awareness, intrusion prevention, and deep packet inspection.
12. What is the primary function of an IDS?
A) Block malicious traffic
B) Detect and alert on suspicious activity
C) Encrypt network traffic
D) Route packets
Answer: B
Rationale: IDS monitors and alerts; IPS can block.
13. Which network segmentation strategy isolates public-facing services from internal networks?
A) VLAN
B) DMZ
C) VPN
D) NAT
Answer: B
Rationale: A DMZ is a buffer zone between external and internal networks.
4
