WGU D490 Cybersecurity Graduate Capstone Task 2 Most Recent exam
COMPLETE (2026) EXAM Questions and Answers (Verified Answers)
(Latest Update 2026) Graded A+
Question 1
Which of the following best describes the primary purpose of a firewall in network
security?
A) To encrypt all network communications automatically
B) To physically secure servers from unauthorized access
C) To monitor and control incoming and outgoing network traffic based on security rules
D) To perform automatic vulnerability scanning of applications
Rationale: Firewalls act as a barrier between trusted and untrusted networks, filtering traffic
based on defined security rules. They do not inherently encrypt or scan applications.
Question 2
A company wants to implement multi-factor authentication (MFA) for remote employees.
Which combination is considered MFA?
A) Password + username
B) Fingerprint scan + password
C) Security question + username
D) Password only
Rationale: MFA requires at least two of the following: something you know (password),
something you have (token), or something you are (biometrics). Fingerprint + password satisfies
this.
Question 3
Which of the following is the most secure method for storing passwords in a database?
,A) Base64 encoding
B) AES encryption without a key rotation policy
C) Salted hash with a strong hashing algorithm like bcrypt
D) Plain text with limited access
Rationale: Storing passwords as salted hashes ensures that even if the database is compromised,
raw passwords are not retrievable. Encryption without salt or storing in plain text is insecure.
Question 4
You are designing a network and want to segment traffic to reduce risk from compromised
devices. Which approach is best?
A) Place all devices on a single VLAN
B) Implement VLANs for segmentation
C) Use a single flat IP address space
D) Disable routing between subnets
Rationale: VLANs separate network traffic logically, minimizing lateral movement if a device
is compromised. Flat networks increase risk.
Question 5
Which type of attack involves intercepting and potentially altering communications
between two parties without their knowledge?
A) Phishing
B) SQL Injection
C) Man-in-the-Middle (MITM)
D) Denial of Service
Rationale: MITM attacks intercept communication between two parties. Phishing tricks users,
SQL injection targets databases, and DoS overwhelms systems.
Question 6
During a penetration test, a tester uses publicly available information to identify potential
vulnerabilities without touching the network. This phase is called:
, A) Exploitation
B) Reconnaissance
C) Post-exploitation
D) Privilege escalation
Rationale: Reconnaissance involves gathering information (OSINT) to plan further attacks.
Exploitation occurs after identifying vulnerabilities.
Question 7
Which of the following is an example of a physical security control?
A) Biometric access to a server room
B) Firewall configuration
C) Antivirus software
D) Intrusion detection system
Rationale: Physical controls protect hardware and facilities. Firewalls, antivirus, and IDS are
technical controls.
Question 8
What is the primary purpose of a Security Information and Event Management (SIEM)
system?
A) To collect, analyze, and correlate security events across systems
B) To patch operating systems automatically
C) To perform encryption of sensitive data
D) To provide endpoint antivirus protection
Rationale: SIEM systems aggregate logs from multiple sources to detect patterns indicative of
security incidents.
Question 9
An organization wants to comply with NIST SP 800-53. Which of the following is true?
A) It provides a catalog of security and privacy controls for federal information systems
B) It mandates the use of a specific firewall vendor
COMPLETE (2026) EXAM Questions and Answers (Verified Answers)
(Latest Update 2026) Graded A+
Question 1
Which of the following best describes the primary purpose of a firewall in network
security?
A) To encrypt all network communications automatically
B) To physically secure servers from unauthorized access
C) To monitor and control incoming and outgoing network traffic based on security rules
D) To perform automatic vulnerability scanning of applications
Rationale: Firewalls act as a barrier between trusted and untrusted networks, filtering traffic
based on defined security rules. They do not inherently encrypt or scan applications.
Question 2
A company wants to implement multi-factor authentication (MFA) for remote employees.
Which combination is considered MFA?
A) Password + username
B) Fingerprint scan + password
C) Security question + username
D) Password only
Rationale: MFA requires at least two of the following: something you know (password),
something you have (token), or something you are (biometrics). Fingerprint + password satisfies
this.
Question 3
Which of the following is the most secure method for storing passwords in a database?
,A) Base64 encoding
B) AES encryption without a key rotation policy
C) Salted hash with a strong hashing algorithm like bcrypt
D) Plain text with limited access
Rationale: Storing passwords as salted hashes ensures that even if the database is compromised,
raw passwords are not retrievable. Encryption without salt or storing in plain text is insecure.
Question 4
You are designing a network and want to segment traffic to reduce risk from compromised
devices. Which approach is best?
A) Place all devices on a single VLAN
B) Implement VLANs for segmentation
C) Use a single flat IP address space
D) Disable routing between subnets
Rationale: VLANs separate network traffic logically, minimizing lateral movement if a device
is compromised. Flat networks increase risk.
Question 5
Which type of attack involves intercepting and potentially altering communications
between two parties without their knowledge?
A) Phishing
B) SQL Injection
C) Man-in-the-Middle (MITM)
D) Denial of Service
Rationale: MITM attacks intercept communication between two parties. Phishing tricks users,
SQL injection targets databases, and DoS overwhelms systems.
Question 6
During a penetration test, a tester uses publicly available information to identify potential
vulnerabilities without touching the network. This phase is called:
, A) Exploitation
B) Reconnaissance
C) Post-exploitation
D) Privilege escalation
Rationale: Reconnaissance involves gathering information (OSINT) to plan further attacks.
Exploitation occurs after identifying vulnerabilities.
Question 7
Which of the following is an example of a physical security control?
A) Biometric access to a server room
B) Firewall configuration
C) Antivirus software
D) Intrusion detection system
Rationale: Physical controls protect hardware and facilities. Firewalls, antivirus, and IDS are
technical controls.
Question 8
What is the primary purpose of a Security Information and Event Management (SIEM)
system?
A) To collect, analyze, and correlate security events across systems
B) To patch operating systems automatically
C) To perform encryption of sensitive data
D) To provide endpoint antivirus protection
Rationale: SIEM systems aggregate logs from multiple sources to detect patterns indicative of
security incidents.
Question 9
An organization wants to comply with NIST SP 800-53. Which of the following is true?
A) It provides a catalog of security and privacy controls for federal information systems
B) It mandates the use of a specific firewall vendor
