WGU D522 | Task 2 Performance Assessment Python Remediation | DNS | Recovery | Validation
WGU D522 — Task 2 Performance Assessment
Python Network Remediation | DNS Configuration | System Recovery & Validation
Complete 2026/2027 Guide | 110 Questions with Detailed Rationales
Assessment Overview: This 110-question performance assessment exam covers all four domains of the WGU D522
Task 2 Performance Assessment: Python Network Remediation, DNS Configuration and Hardening, System
Recovery, and Validation & Verification Testing. Each question presents a scenario or recall prompt drawn from the
official WGU D522 Task 2 rubric and 2026/2027 industry standards (NIST SP 800-61, BIND 9, dnspython,
Paramiko, CIS Benchmarks). Questions follow the format: A–D options with the correct answer marked
[CORRECT], followed by a 2–4 sentence rationale providing technical justification, best practice alignment, and
reference to the WGU Task 2 requirement. Topics include attack surface reduction, Python
socket/SSH/subprocess/netmiko/scapy/dnspython/ipaddress libraries, zone files,
SOA/NS/A/AAAA/CNAME/MX/TXT records, DNSSEC, RPZ, ACLs, backup restoration, service recovery, patch
deployment, validation testing, evidence collection, GitLab repository management, stakeholder communication, and
rubric-aligned deliverables.
SECTION 1: Network Remediation Fundamentals (Incident Scope, Attack Surface Reduction, &
Remediation Planning)
Q1: During the initial phase of a network remediation task, you discover that an attacker exploited an
exposed SMB port (445) on a public-facing server. What is the FIRST step in your remediation plan?
A. Deploy a new patch management solution across the enterprise
B. Contain the incident by isolating the affected system and closing port 445 at the perimeter firewall
[CORRECT]
C. Notify all users to change their passwords immediately
D. Reimage the server from a known-good baseline
Correct Answer: B
Rationale: Incident response frameworks (NIST SP 800-61, SANS PICERL) mandate containment as the first remediation step
to prevent further attacker activity, lateral movement, or data exfiltration. Closing port 445 at the firewall and isolating the
host stops active exploitation before recovery actions begin. Patching (A), credential resets (C), and reimaging (D) are
recovery-phase activities that come AFTER containment is verified, otherwise the attacker may simply re-exploit during
recovery.
Q2: You are prioritizing remediation actions for three findings: (1) a critical RCE on a public web server, (2)
a low-severity information disclosure on an internal HR portal, and (3) a medium-severity misconfigured
DNS resolver allowing cache poisoning. Which remediation order is CORRECT?
A. Address the low-severity finding first to demonstrate thoroughness, then the medium, then the critical
B. Address the critical RCE first, then the DNS resolver misconfiguration, then the information disclosure
[CORRECT]
C. Address the DNS resolver first because it affects all internal users, then the RCE, then the disclosure
D. Address all three in parallel because they are independent
Correct Answer: B
Rationale: Remediation prioritization follows a risk-based model combining severity (CVSS), exposure (public-facing =
higher), and business impact. A critical RCE on a public web server is the highest risk (immediate exploitation by external
Western Governors University | 2026/2027 Complete Guide | 110-Question Exam Page 1
,WGU D522 | Task 2 Performance Assessment Python Remediation | DNS | Recovery | Validation
actors), followed by the DNS resolver (broad internal impact via cache poisoning), then the low-severity information
disclosure. Parallel remediation (D) is rarely feasible because the same staff must validate each fix and may inadvertently
introduce regressions; sequential prioritization ensures the highest-risk issue is contained first.
Q3: A WGU D522 Task 2 scenario requires you to reduce the attack surface of a Linux server. Which of the
following actions MOST effectively reduces attack surface without breaking legitimate services?
A. Disable the firewall so you can identify which services are running
B. Inventory listening ports with `ss -tlnp` or `netstat`, validate each against the service inventory, and disable or
remove services not required by the server's role [CORRECT]
C. Remove all networking from the server to eliminate remote attack vectors
D. Install every available package so you can later choose which to keep
Correct Answer: B
Rationale: Attack surface reduction follows the principle of least privilege: enumerate listening services, validate each against
business need, and disable/remove unneeded services. `ss -tlnp` lists TCP listening sockets with PID/process names, allowing the
analyst to map ports to services and remove unneeded ones. Option A disables a security control; option C breaks the server's
purpose; option D installs more software, which expands the attack surface rather than reducing it.
Q4: Which of the following is an example of removing a malicious configuration as part of network
remediation?
A. Updating antivirus signatures on the endpoint
B. Deleting an attacker-created cron job that re-launches a reverse shell every 5 minutes, plus removing the
associated authorized_keys entry the attacker added [CORRECT]
C. Rebooting the server to clear any in-memory malware
D. Adding a new firewall rule to block known-bad IPs
Correct Answer: B
Rationale: Removing a malicious configuration means eliminating persistence mechanisms the attacker installed: scheduled
tasks, cron jobs, systemd units, unauthorized SSH keys, and modified startup scripts. Option B removes both the persistence
vector (cron) and the unauthorized access vector (authorized_keys). Option A is signature-based defense; option C clears
volatile memory but persistence will re-launch the malware on reboot; option D is a containment action, not removal of
malicious configuration.
Q5: In a WGU D522 Task 2 scenario, you are asked to document an incident scope. Which of the following
BEST describes "incident scope"?
A. The total dollar cost of the breach
B. The set of systems, users, data, and network segments affected by the incident, including the time window of
attacker activity [CORRECT]
C. The list of patches that were missing on the affected server
D. The total number of alerts generated by the SIEM during the incident
Correct Answer: B
Rationale: Incident scope defines the boundaries of what the attacker accessed, modified, or exfiltrated: affected hosts,
accounts, datastores, network segments, and the temporal window of malicious activity. Scope drives the remediation plan
(what to contain, rebuild, validate) and the regulatory notification analysis (what data was potentially exposed). Cost (A),
missing patches (C), and alert counts (D) are supporting data points but do not constitute scope.
Western Governors University | 2026/2027 Complete Guide | 110-Question Exam Page 2
,WGU D522 | Task 2 Performance Assessment Python Remediation | DNS | Recovery | Validation
Q6: You must close unnecessary ports on a Windows Server 2019 host. Which PowerShell cmdlet should you
use to view currently open firewall rules and which is the correct approach?
A. Get-Service | Stop-Service
B. Get-NetFirewallRule | Where-Object Enabled -eq "True" | Select-Object DisplayName, Direction, Action
[CORRECT]
C. net stop sharedaccess
D. Remove-Item HKLM:\System\CurrentControlSet\Services\Tcpip
Correct Answer: B
Rationale: `Get-NetFirewallRule` enumerates Windows Firewall rules; filtering on Enabled=True and selecting DisplayName,
Direction, and Action lets you identify open inbound rules to evaluate. After validating that a rule is not needed, you disable or
remove it with `Disable-NetFirewallRule` or `Remove-NetFirewallRule`. Option A stops services broadly (and may break
required services); option C stops the ICS service without addressing the firewall rules; option D deletes critical TCP/IP registry
keys, which would break networking entirely.
Q7: Which document SHOULD be created BEFORE executing any remediation actions on a production
system?
A. A press release for customers
B. A remediation plan with rollback steps, change window, responsible parties, and validation criteria
[CORRECT]
C. A budget request for new hardware
D. A marketing announcement of the security improvement
Correct Answer: B
Rationale: A remediation (or change) plan with rollback steps, change window, owners, and validation criteria is required by
ITIL change management and is explicitly evaluated in WGU D522 Task 2. Without a rollback plan, a failed remediation can
cause longer outages than the original incident. The plan must be reviewed and approved before execution, and validation must
confirm the change succeeded. Press releases (A), budget requests (C), and marketing (D) are not pre-execution deliverables for
remediation.
Q8: Your remediation plan calls for disabling the Telnet service on a Linux server. Which command sequence
is correct to disable and verify the service?
A. sudo systemctl disable --now telnet.socket; sudo systemctl status telnet.socket [CORRECT]
B. sudo systemctl start telnet.socket; sudo systemctl is-enabled telnet.socket
C. sudo rm -f /etc/systemd/system/telnet.socket
D. sudo kill -9 $(pgrep telnet)
Correct Answer: A
Rationale: `systemctl disable --now telnet.socket` both stops the currently running socket unit and disables it from starting on
boot in one command. `systemctl status telnet.socket` then verifies the unit is inactive and disabled. Option B starts the service
(the opposite of remediation); option C deletes the unit file but does not stop a running service and can break future updates;
option D kills the process but the unit will restart on next socket connection. The `--now` flag is the correct, atomic way to
disable and stop a systemd unit.
Q9: In attack surface reduction, what is the difference between disabling a service and removing a service?
A. There is no difference; both accomplish the same goal
B. Disabling stops the service from running but leaves the binaries installed (reversible); removing uninstalls the
software entirely (more permanent, smaller attack surface) [CORRECT]
C. Removing leaves the service running but hidden from the service list
Western Governors University | 2026/2027 Complete Guide | 110-Question Exam Page 3
, WGU D522 | Task 2 Performance Assessment Python Remediation | DNS | Recovery | Validation
D. Disabling requires a reboot but removing does not
Correct Answer: B
Rationale: Disabling stops a service from starting but leaves binaries, configuration files, and dependencies in place — useful
when the service may be needed again or when business owners must approve removal. Removing (apt remove, yum erase, dnf
remove) uninstalls the package entirely, eliminating associated binaries, configs, and reducing the patch surface permanently.
In a Defense Information Systems Agency (DISA STIG) baseline and CIS Benchmarks, removal is preferred when the service is
not required, because disabled services can be inadvertently re-enabled.
Q10: Which of the following is the BEST example of risk acceptance (as opposed to remediation, mitigation,
or transference) in a D522 Task 2 remediation plan?
A. Patching a vulnerable application to remove the CVE
B. Installing a web application firewall in front of an unpatched legacy app
C. Documenting that a low-severity finding on an isolated test server will not be remediated because the system
has no production data and is decommissioned in 30 days [CORRECT]
D. Purchasing cybersecurity insurance to cover potential breach costs
Correct Answer: C
Rationale: Risk acceptance is a formal decision to not remediate a known risk, documented with rationale, owner, and review
date. Option C meets all criteria: an explicit decision with documented justification (no production data, decommissioned in 30
days). Option A is remediation (eliminating the vulnerability); option B is mitigation (reducing likelihood/impact without
removing the flaw); option D is transference (shifting financial risk to an insurer). WGU D522 expects students to distinguish
these four risk treatment options in their remediation narrative.
Q11: You are creating a remediation timeline. The change advisory board (CAB) only approves changes
during a Saturday 02:00–06:00 maintenance window, but the vulnerability has a public exploit and is being
actively scanned. What is the BEST course of action?
A. Wait until the next scheduled change window to apply the remediation
B. Submit an emergency change request with risk justification, contain via temporary compensating controls (e.g.,
WAF rule, ACL) immediately, and remediate within the emergency window [CORRECT]
C. Apply the fix immediately without documentation because the risk is too high
D. Notify the attacker that you are aware of the vulnerability
Correct Answer: B
Rationale: When an active exploit exists, ITIL emergency change procedures allow expedited approval with documented risk
justification. Compensating controls (WAF rules, ACLs, IPS signatures) provide immediate containment while the permanent
fix is approved through the emergency process. Option A leaves the organization vulnerable; option C violates change
management and audit controls; option D is nonsensical. WGU D522 evaluates whether students can justify emergency actions
in their written narrative.
Q12: After remediating a vulnerability, you must document the change. Which of the following should be in
the post-change documentation?
A. Only the timestamp of the change
B. Change ID, description, systems affected, validation results, rollback steps used (if any), residual risk, and
approver [CORRECT]
C. Only the technical commands executed
D. Only the name of the person who approved the change
Correct Answer: B
Western Governors University | 2026/2027 Complete Guide | 110-Question Exam Page 4
WGU D522 — Task 2 Performance Assessment
Python Network Remediation | DNS Configuration | System Recovery & Validation
Complete 2026/2027 Guide | 110 Questions with Detailed Rationales
Assessment Overview: This 110-question performance assessment exam covers all four domains of the WGU D522
Task 2 Performance Assessment: Python Network Remediation, DNS Configuration and Hardening, System
Recovery, and Validation & Verification Testing. Each question presents a scenario or recall prompt drawn from the
official WGU D522 Task 2 rubric and 2026/2027 industry standards (NIST SP 800-61, BIND 9, dnspython,
Paramiko, CIS Benchmarks). Questions follow the format: A–D options with the correct answer marked
[CORRECT], followed by a 2–4 sentence rationale providing technical justification, best practice alignment, and
reference to the WGU Task 2 requirement. Topics include attack surface reduction, Python
socket/SSH/subprocess/netmiko/scapy/dnspython/ipaddress libraries, zone files,
SOA/NS/A/AAAA/CNAME/MX/TXT records, DNSSEC, RPZ, ACLs, backup restoration, service recovery, patch
deployment, validation testing, evidence collection, GitLab repository management, stakeholder communication, and
rubric-aligned deliverables.
SECTION 1: Network Remediation Fundamentals (Incident Scope, Attack Surface Reduction, &
Remediation Planning)
Q1: During the initial phase of a network remediation task, you discover that an attacker exploited an
exposed SMB port (445) on a public-facing server. What is the FIRST step in your remediation plan?
A. Deploy a new patch management solution across the enterprise
B. Contain the incident by isolating the affected system and closing port 445 at the perimeter firewall
[CORRECT]
C. Notify all users to change their passwords immediately
D. Reimage the server from a known-good baseline
Correct Answer: B
Rationale: Incident response frameworks (NIST SP 800-61, SANS PICERL) mandate containment as the first remediation step
to prevent further attacker activity, lateral movement, or data exfiltration. Closing port 445 at the firewall and isolating the
host stops active exploitation before recovery actions begin. Patching (A), credential resets (C), and reimaging (D) are
recovery-phase activities that come AFTER containment is verified, otherwise the attacker may simply re-exploit during
recovery.
Q2: You are prioritizing remediation actions for three findings: (1) a critical RCE on a public web server, (2)
a low-severity information disclosure on an internal HR portal, and (3) a medium-severity misconfigured
DNS resolver allowing cache poisoning. Which remediation order is CORRECT?
A. Address the low-severity finding first to demonstrate thoroughness, then the medium, then the critical
B. Address the critical RCE first, then the DNS resolver misconfiguration, then the information disclosure
[CORRECT]
C. Address the DNS resolver first because it affects all internal users, then the RCE, then the disclosure
D. Address all three in parallel because they are independent
Correct Answer: B
Rationale: Remediation prioritization follows a risk-based model combining severity (CVSS), exposure (public-facing =
higher), and business impact. A critical RCE on a public web server is the highest risk (immediate exploitation by external
Western Governors University | 2026/2027 Complete Guide | 110-Question Exam Page 1
,WGU D522 | Task 2 Performance Assessment Python Remediation | DNS | Recovery | Validation
actors), followed by the DNS resolver (broad internal impact via cache poisoning), then the low-severity information
disclosure. Parallel remediation (D) is rarely feasible because the same staff must validate each fix and may inadvertently
introduce regressions; sequential prioritization ensures the highest-risk issue is contained first.
Q3: A WGU D522 Task 2 scenario requires you to reduce the attack surface of a Linux server. Which of the
following actions MOST effectively reduces attack surface without breaking legitimate services?
A. Disable the firewall so you can identify which services are running
B. Inventory listening ports with `ss -tlnp` or `netstat`, validate each against the service inventory, and disable or
remove services not required by the server's role [CORRECT]
C. Remove all networking from the server to eliminate remote attack vectors
D. Install every available package so you can later choose which to keep
Correct Answer: B
Rationale: Attack surface reduction follows the principle of least privilege: enumerate listening services, validate each against
business need, and disable/remove unneeded services. `ss -tlnp` lists TCP listening sockets with PID/process names, allowing the
analyst to map ports to services and remove unneeded ones. Option A disables a security control; option C breaks the server's
purpose; option D installs more software, which expands the attack surface rather than reducing it.
Q4: Which of the following is an example of removing a malicious configuration as part of network
remediation?
A. Updating antivirus signatures on the endpoint
B. Deleting an attacker-created cron job that re-launches a reverse shell every 5 minutes, plus removing the
associated authorized_keys entry the attacker added [CORRECT]
C. Rebooting the server to clear any in-memory malware
D. Adding a new firewall rule to block known-bad IPs
Correct Answer: B
Rationale: Removing a malicious configuration means eliminating persistence mechanisms the attacker installed: scheduled
tasks, cron jobs, systemd units, unauthorized SSH keys, and modified startup scripts. Option B removes both the persistence
vector (cron) and the unauthorized access vector (authorized_keys). Option A is signature-based defense; option C clears
volatile memory but persistence will re-launch the malware on reboot; option D is a containment action, not removal of
malicious configuration.
Q5: In a WGU D522 Task 2 scenario, you are asked to document an incident scope. Which of the following
BEST describes "incident scope"?
A. The total dollar cost of the breach
B. The set of systems, users, data, and network segments affected by the incident, including the time window of
attacker activity [CORRECT]
C. The list of patches that were missing on the affected server
D. The total number of alerts generated by the SIEM during the incident
Correct Answer: B
Rationale: Incident scope defines the boundaries of what the attacker accessed, modified, or exfiltrated: affected hosts,
accounts, datastores, network segments, and the temporal window of malicious activity. Scope drives the remediation plan
(what to contain, rebuild, validate) and the regulatory notification analysis (what data was potentially exposed). Cost (A),
missing patches (C), and alert counts (D) are supporting data points but do not constitute scope.
Western Governors University | 2026/2027 Complete Guide | 110-Question Exam Page 2
,WGU D522 | Task 2 Performance Assessment Python Remediation | DNS | Recovery | Validation
Q6: You must close unnecessary ports on a Windows Server 2019 host. Which PowerShell cmdlet should you
use to view currently open firewall rules and which is the correct approach?
A. Get-Service | Stop-Service
B. Get-NetFirewallRule | Where-Object Enabled -eq "True" | Select-Object DisplayName, Direction, Action
[CORRECT]
C. net stop sharedaccess
D. Remove-Item HKLM:\System\CurrentControlSet\Services\Tcpip
Correct Answer: B
Rationale: `Get-NetFirewallRule` enumerates Windows Firewall rules; filtering on Enabled=True and selecting DisplayName,
Direction, and Action lets you identify open inbound rules to evaluate. After validating that a rule is not needed, you disable or
remove it with `Disable-NetFirewallRule` or `Remove-NetFirewallRule`. Option A stops services broadly (and may break
required services); option C stops the ICS service without addressing the firewall rules; option D deletes critical TCP/IP registry
keys, which would break networking entirely.
Q7: Which document SHOULD be created BEFORE executing any remediation actions on a production
system?
A. A press release for customers
B. A remediation plan with rollback steps, change window, responsible parties, and validation criteria
[CORRECT]
C. A budget request for new hardware
D. A marketing announcement of the security improvement
Correct Answer: B
Rationale: A remediation (or change) plan with rollback steps, change window, owners, and validation criteria is required by
ITIL change management and is explicitly evaluated in WGU D522 Task 2. Without a rollback plan, a failed remediation can
cause longer outages than the original incident. The plan must be reviewed and approved before execution, and validation must
confirm the change succeeded. Press releases (A), budget requests (C), and marketing (D) are not pre-execution deliverables for
remediation.
Q8: Your remediation plan calls for disabling the Telnet service on a Linux server. Which command sequence
is correct to disable and verify the service?
A. sudo systemctl disable --now telnet.socket; sudo systemctl status telnet.socket [CORRECT]
B. sudo systemctl start telnet.socket; sudo systemctl is-enabled telnet.socket
C. sudo rm -f /etc/systemd/system/telnet.socket
D. sudo kill -9 $(pgrep telnet)
Correct Answer: A
Rationale: `systemctl disable --now telnet.socket` both stops the currently running socket unit and disables it from starting on
boot in one command. `systemctl status telnet.socket` then verifies the unit is inactive and disabled. Option B starts the service
(the opposite of remediation); option C deletes the unit file but does not stop a running service and can break future updates;
option D kills the process but the unit will restart on next socket connection. The `--now` flag is the correct, atomic way to
disable and stop a systemd unit.
Q9: In attack surface reduction, what is the difference between disabling a service and removing a service?
A. There is no difference; both accomplish the same goal
B. Disabling stops the service from running but leaves the binaries installed (reversible); removing uninstalls the
software entirely (more permanent, smaller attack surface) [CORRECT]
C. Removing leaves the service running but hidden from the service list
Western Governors University | 2026/2027 Complete Guide | 110-Question Exam Page 3
, WGU D522 | Task 2 Performance Assessment Python Remediation | DNS | Recovery | Validation
D. Disabling requires a reboot but removing does not
Correct Answer: B
Rationale: Disabling stops a service from starting but leaves binaries, configuration files, and dependencies in place — useful
when the service may be needed again or when business owners must approve removal. Removing (apt remove, yum erase, dnf
remove) uninstalls the package entirely, eliminating associated binaries, configs, and reducing the patch surface permanently.
In a Defense Information Systems Agency (DISA STIG) baseline and CIS Benchmarks, removal is preferred when the service is
not required, because disabled services can be inadvertently re-enabled.
Q10: Which of the following is the BEST example of risk acceptance (as opposed to remediation, mitigation,
or transference) in a D522 Task 2 remediation plan?
A. Patching a vulnerable application to remove the CVE
B. Installing a web application firewall in front of an unpatched legacy app
C. Documenting that a low-severity finding on an isolated test server will not be remediated because the system
has no production data and is decommissioned in 30 days [CORRECT]
D. Purchasing cybersecurity insurance to cover potential breach costs
Correct Answer: C
Rationale: Risk acceptance is a formal decision to not remediate a known risk, documented with rationale, owner, and review
date. Option C meets all criteria: an explicit decision with documented justification (no production data, decommissioned in 30
days). Option A is remediation (eliminating the vulnerability); option B is mitigation (reducing likelihood/impact without
removing the flaw); option D is transference (shifting financial risk to an insurer). WGU D522 expects students to distinguish
these four risk treatment options in their remediation narrative.
Q11: You are creating a remediation timeline. The change advisory board (CAB) only approves changes
during a Saturday 02:00–06:00 maintenance window, but the vulnerability has a public exploit and is being
actively scanned. What is the BEST course of action?
A. Wait until the next scheduled change window to apply the remediation
B. Submit an emergency change request with risk justification, contain via temporary compensating controls (e.g.,
WAF rule, ACL) immediately, and remediate within the emergency window [CORRECT]
C. Apply the fix immediately without documentation because the risk is too high
D. Notify the attacker that you are aware of the vulnerability
Correct Answer: B
Rationale: When an active exploit exists, ITIL emergency change procedures allow expedited approval with documented risk
justification. Compensating controls (WAF rules, ACLs, IPS signatures) provide immediate containment while the permanent
fix is approved through the emergency process. Option A leaves the organization vulnerable; option C violates change
management and audit controls; option D is nonsensical. WGU D522 evaluates whether students can justify emergency actions
in their written narrative.
Q12: After remediating a vulnerability, you must document the change. Which of the following should be in
the post-change documentation?
A. Only the timestamp of the change
B. Change ID, description, systems affected, validation results, rollback steps used (if any), residual risk, and
approver [CORRECT]
C. Only the technical commands executed
D. Only the name of the person who approved the change
Correct Answer: B
Western Governors University | 2026/2027 Complete Guide | 110-Question Exam Page 4
