WGU C845 VUN1
Task 3 & SSCP
(2026/2027): The
Elite Test Bank
PART 0: THE NAVIGATOR
● PART I: THE PRIMER
● PART II: THE ELITE TEST BANK
○ Foundational Syntax & Application (Questions 1–15): Mastering the Tripartite
Risk Definition, Due Care vs. Due Diligence, Quantitative Risk Modeling, and UT
Austin Information Resources Use and Security Policy (IRUSP) standards.
○ Professional Simulation (Questions 16–40): FinSecure Case Application, FIPS
140-3 Transition Logistics, and NIST SP 800-53 Rev 5.2.0 Practical
Implementation.
○ Grandmaster Synthesis (Questions 41–66): Zero Trust Architecture (NIST
800-207), Post-Quantum Cryptography (CNSA 2.0), SEC Item 106 Disclosures,
and High-Stakes Incident Response.
PART I: THE PRIMER
Mastering the WGU C845 performance assessment and the SSCP Computerized Adaptive
Testing (CAT) examination requires transcending academic theory to forge a defensible,
operational security mindset. Elite practitioners do not merely memorize controls; they architect
mathematically justifiable risk mitigations aligned with stringent, modern compliance
frameworks.
● The Risk Tripartite Rule: Always articulate risk as a strict, compound statement of Event
(threat exploiting a vulnerability), Likelihood (probability based on existing controls), and
Impact (quantifiable business consequence).
● ALE Formula: Annualized Loss Expectancy (ALE) = Single Loss Expectancy (SLE) ×
Annual Rate of Occurrence (ARO).
● Due Care vs. Due Diligence: Due Diligence is the pre-decision investigation; Due Care
is the ongoing, continuous maintenance of implemented security controls.
, ● Regulatory Horizon 2026: FIPS 140-2 validations are moved to the historical list on
September 21, 2026; unconditionally prioritize FIPS 140-3 validated cryptographic
modules.
Metric / Framework 2026/2027 Elite Standard Core Objective
NIST SP 800-53 Rev 5.2.0 SA-15, SA-24, SI-02(07) Root cause analysis for
patches, standardized logging,
cyber resiliency.
FIPS 140-3 Sept 21, 2026 Deadline Sunsets 140-2; mandates
ISO/IEC 19790 alignment.
HIPAA 2027 72-Hour RTO Mandatory restoration of ePHI
systems within 72 hours.
CNSA 2.0 2026 Networking Milestone Transition VPNs and routers to
Post-Quantum Cryptography.
PART II: THE ELITE TEST BANK
Q1: A WGU C845 candidate is evaluating a hospital's on-premises network. The candidate
notes that unpatched legacy software is used on workstations. To properly define a "risk" under
the VUN1 Task 3 rubric, which tripartite statement is the MOST ACCURATE representation? A)
The use of unpatched software constitutes a high risk of cyberattack resulting in the loss of
patient data. B) Hackers may exploit the unpatched software, leading to a ransomware infection
and operational downtime. C) The event of an external actor exploiting unpatched software to
exfiltrate electronic Protected Health Information (ePHI) has a High likelihood and a Critical
impact due to regulatory fines. D) The vulnerability of unpatched software combined with the
threat of external actors equals a high probability of data breach.
● The Answer: C (The event of an external actor exploiting unpatched software to exfiltrate
electronic Protected Health Information (ePHI) has a High likelihood and a Critical impact
due to regulatory fines.)
● Distractor Analysis:
○ A is incorrect: This is a generic statement that fails to separate the event, likelihood,
and impact.
○ B is incorrect: This describes a threat and a consequence but lacks the defined
probability (likelihood) required by the rubric.
○ D is incorrect: This defines the risk equation conceptually but fails to state the
specific event and measurable impact.
The Mentor's Analysis: The WGU VUN1 Task 3 rubric explicitly rejects generic threat lists.
Risk must be articulated using the precise syntax of Event, Likelihood, and Impact.
Professional Intuition: If you cannot quantify the likelihood and tie the impact directly to a
business objective or penalty, you have identified a vulnerability, not a risk.
Q2: A financial institution evaluates a third-party cloud service provider (CSP) by reviewing their
SOC 2 Type II report and conducting a penetration test prior to signing the contract. Which
principle does this action BEST represent? A) Due Care B) Due Diligence C) Risk Transference
D) Quantitative Risk Analysis
● The Answer: B (Due Diligence)
● Distractor Analysis:
○ A is incorrect: Due care involves the ongoing maintenance of security practices, not
the initial investigation.
○ C is incorrect: While signing the contract may transfer some risk, the act of
, investigating the vendor is not risk transference.
○ D is incorrect: Reviewing reports and testing are qualitative investigative actions,
not mathematical calculations of financial loss.
The Mentor's Analysis: Due diligence is "doing your homework" before making a business
decision. Due care is "doing the right thing" continuously thereafter. Professional Intuition:
Diligence precedes the signature; Care maintains the perimeter.
Q3: The Chief Information Security Officer (CISO) mandates annual security awareness training
for all employees to maintain compliance with industry standards. If the training is neglected and
a breach occurs via phishing, the organization has failed to exercise: A) Due Diligence B) Risk
Avoidance C) Due Care D) Threat Modeling
● The Answer: C (Due Care)
● Distractor Analysis:
○ A is incorrect: Diligence is the initial research; maintaining an established training
program falls under ongoing operational maintenance.
○ B is incorrect: Avoiding risk means eliminating the activity entirely (e.g.,
disconnecting from the internet), which is not applicable here.
○ D is incorrect: Threat modeling is a design-phase exercise to identify vulnerabilities,
not an ongoing operational compliance mandate.
The Mentor's Analysis: Implementing and maintaining established policies, such as mandatory
training or routine patching, is the legal standard of due care. Professional Intuition: Failing to
maintain due care directly exposes the organization to claims of legal negligence.
Q4: A corporation anticipates a server hardware failure that will cost $50,000 in replacement
and downtime (SLE). Historical data indicates this specific failure occurs once every four years.
What is the CORRECT Annualized Loss Expectancy (ALE)? A) $12,500 B) $50,000 C)
$200,000 D) $25,000
● The Answer: A ($12,500)
● Distractor Analysis:
○ B is incorrect: This is the Single Loss Expectancy (SLE), not the annualized value.
○ C is incorrect: This multiplies the SLE by the 4-year span instead of the annualized
rate (1/4 or 0.25).
○ D is incorrect: This assumes an ARO of 0.5 (once every two years), which
contradicts the provided data.
The Mentor's Analysis: ALE = SLE × ARO. The Annual Rate of Occurrence (ARO) for an
event happening once every four years is 0.25. Therefore, $50,000 × 0.25 = $12,500.
Professional Intuition: Never spend more on an annual mitigation control than the ALE
dictates; security must make financial sense.
Q5: According to the NIST 800-30 framework, an organization is currently evaluating threat
sources, vulnerabilities, and potential impacts. Which step of the risk assessment process are
they CURRENTLY performing? A) Prepare for Assessment B) Conduct Assessment C)
Communicate Results D) Maintain Assessment
● The Answer: B (Conduct Assessment)
● Distractor Analysis:
○ A is incorrect: Preparation involves defining the scope, governance, and asset
inventory, not analyzing the threats and impacts.
○ C is incorrect: Communication occurs after the analysis yields a risk register.
○ D is incorrect: Maintenance involves continuous monitoring after the initial
assessment is complete.
The Mentor's Analysis: NIST 800-30 strictly delineates the execution phase (Conducting) as
Task 3 & SSCP
(2026/2027): The
Elite Test Bank
PART 0: THE NAVIGATOR
● PART I: THE PRIMER
● PART II: THE ELITE TEST BANK
○ Foundational Syntax & Application (Questions 1–15): Mastering the Tripartite
Risk Definition, Due Care vs. Due Diligence, Quantitative Risk Modeling, and UT
Austin Information Resources Use and Security Policy (IRUSP) standards.
○ Professional Simulation (Questions 16–40): FinSecure Case Application, FIPS
140-3 Transition Logistics, and NIST SP 800-53 Rev 5.2.0 Practical
Implementation.
○ Grandmaster Synthesis (Questions 41–66): Zero Trust Architecture (NIST
800-207), Post-Quantum Cryptography (CNSA 2.0), SEC Item 106 Disclosures,
and High-Stakes Incident Response.
PART I: THE PRIMER
Mastering the WGU C845 performance assessment and the SSCP Computerized Adaptive
Testing (CAT) examination requires transcending academic theory to forge a defensible,
operational security mindset. Elite practitioners do not merely memorize controls; they architect
mathematically justifiable risk mitigations aligned with stringent, modern compliance
frameworks.
● The Risk Tripartite Rule: Always articulate risk as a strict, compound statement of Event
(threat exploiting a vulnerability), Likelihood (probability based on existing controls), and
Impact (quantifiable business consequence).
● ALE Formula: Annualized Loss Expectancy (ALE) = Single Loss Expectancy (SLE) ×
Annual Rate of Occurrence (ARO).
● Due Care vs. Due Diligence: Due Diligence is the pre-decision investigation; Due Care
is the ongoing, continuous maintenance of implemented security controls.
, ● Regulatory Horizon 2026: FIPS 140-2 validations are moved to the historical list on
September 21, 2026; unconditionally prioritize FIPS 140-3 validated cryptographic
modules.
Metric / Framework 2026/2027 Elite Standard Core Objective
NIST SP 800-53 Rev 5.2.0 SA-15, SA-24, SI-02(07) Root cause analysis for
patches, standardized logging,
cyber resiliency.
FIPS 140-3 Sept 21, 2026 Deadline Sunsets 140-2; mandates
ISO/IEC 19790 alignment.
HIPAA 2027 72-Hour RTO Mandatory restoration of ePHI
systems within 72 hours.
CNSA 2.0 2026 Networking Milestone Transition VPNs and routers to
Post-Quantum Cryptography.
PART II: THE ELITE TEST BANK
Q1: A WGU C845 candidate is evaluating a hospital's on-premises network. The candidate
notes that unpatched legacy software is used on workstations. To properly define a "risk" under
the VUN1 Task 3 rubric, which tripartite statement is the MOST ACCURATE representation? A)
The use of unpatched software constitutes a high risk of cyberattack resulting in the loss of
patient data. B) Hackers may exploit the unpatched software, leading to a ransomware infection
and operational downtime. C) The event of an external actor exploiting unpatched software to
exfiltrate electronic Protected Health Information (ePHI) has a High likelihood and a Critical
impact due to regulatory fines. D) The vulnerability of unpatched software combined with the
threat of external actors equals a high probability of data breach.
● The Answer: C (The event of an external actor exploiting unpatched software to exfiltrate
electronic Protected Health Information (ePHI) has a High likelihood and a Critical impact
due to regulatory fines.)
● Distractor Analysis:
○ A is incorrect: This is a generic statement that fails to separate the event, likelihood,
and impact.
○ B is incorrect: This describes a threat and a consequence but lacks the defined
probability (likelihood) required by the rubric.
○ D is incorrect: This defines the risk equation conceptually but fails to state the
specific event and measurable impact.
The Mentor's Analysis: The WGU VUN1 Task 3 rubric explicitly rejects generic threat lists.
Risk must be articulated using the precise syntax of Event, Likelihood, and Impact.
Professional Intuition: If you cannot quantify the likelihood and tie the impact directly to a
business objective or penalty, you have identified a vulnerability, not a risk.
Q2: A financial institution evaluates a third-party cloud service provider (CSP) by reviewing their
SOC 2 Type II report and conducting a penetration test prior to signing the contract. Which
principle does this action BEST represent? A) Due Care B) Due Diligence C) Risk Transference
D) Quantitative Risk Analysis
● The Answer: B (Due Diligence)
● Distractor Analysis:
○ A is incorrect: Due care involves the ongoing maintenance of security practices, not
the initial investigation.
○ C is incorrect: While signing the contract may transfer some risk, the act of
, investigating the vendor is not risk transference.
○ D is incorrect: Reviewing reports and testing are qualitative investigative actions,
not mathematical calculations of financial loss.
The Mentor's Analysis: Due diligence is "doing your homework" before making a business
decision. Due care is "doing the right thing" continuously thereafter. Professional Intuition:
Diligence precedes the signature; Care maintains the perimeter.
Q3: The Chief Information Security Officer (CISO) mandates annual security awareness training
for all employees to maintain compliance with industry standards. If the training is neglected and
a breach occurs via phishing, the organization has failed to exercise: A) Due Diligence B) Risk
Avoidance C) Due Care D) Threat Modeling
● The Answer: C (Due Care)
● Distractor Analysis:
○ A is incorrect: Diligence is the initial research; maintaining an established training
program falls under ongoing operational maintenance.
○ B is incorrect: Avoiding risk means eliminating the activity entirely (e.g.,
disconnecting from the internet), which is not applicable here.
○ D is incorrect: Threat modeling is a design-phase exercise to identify vulnerabilities,
not an ongoing operational compliance mandate.
The Mentor's Analysis: Implementing and maintaining established policies, such as mandatory
training or routine patching, is the legal standard of due care. Professional Intuition: Failing to
maintain due care directly exposes the organization to claims of legal negligence.
Q4: A corporation anticipates a server hardware failure that will cost $50,000 in replacement
and downtime (SLE). Historical data indicates this specific failure occurs once every four years.
What is the CORRECT Annualized Loss Expectancy (ALE)? A) $12,500 B) $50,000 C)
$200,000 D) $25,000
● The Answer: A ($12,500)
● Distractor Analysis:
○ B is incorrect: This is the Single Loss Expectancy (SLE), not the annualized value.
○ C is incorrect: This multiplies the SLE by the 4-year span instead of the annualized
rate (1/4 or 0.25).
○ D is incorrect: This assumes an ARO of 0.5 (once every two years), which
contradicts the provided data.
The Mentor's Analysis: ALE = SLE × ARO. The Annual Rate of Occurrence (ARO) for an
event happening once every four years is 0.25. Therefore, $50,000 × 0.25 = $12,500.
Professional Intuition: Never spend more on an annual mitigation control than the ALE
dictates; security must make financial sense.
Q5: According to the NIST 800-30 framework, an organization is currently evaluating threat
sources, vulnerabilities, and potential impacts. Which step of the risk assessment process are
they CURRENTLY performing? A) Prepare for Assessment B) Conduct Assessment C)
Communicate Results D) Maintain Assessment
● The Answer: B (Conduct Assessment)
● Distractor Analysis:
○ A is incorrect: Preparation involves defining the scope, governance, and asset
inventory, not analyzing the threats and impacts.
○ C is incorrect: Communication occurs after the analysis yields a risk register.
○ D is incorrect: Maintenance involves continuous monitoring after the initial
assessment is complete.
The Mentor's Analysis: NIST 800-30 strictly delineates the execution phase (Conducting) as
