WGU D488 Cybersecurity Architecture & Engineering
Objective Assessment Practice Review 2025|2026
Complete Test Bank & Assessment Guide | Graded A+ | Verified
50 Practice Questions | 2026/2027 Aligned
Alignment Frameworks:
WGU D488 Competency Framework
NIST CSF 2.0 & SP 800-160/207
SABSA & TOGAF Security Architecture Models
ISO/IEC 27000 Series
Zero Trust, DevSecOps & Cloud Security Standards
Sec Content Area Q#
1 Security Architecture Foundations: Principles, Reference Models & Frameworks 1-10
2 Threat Modeling, Risk Assessment & Security Control Engineering 11-20
3 Secure Systems Design, SDLC & DevSecOps Integration 21-30
4 Cloud, Network & Zero Trust Architecture Implementation 31-40
5 Governance, Compliance, Cryptography & Professional Practice 41-50
Cognitive Distribution: 30% Recall | 50% Application | 20% Analysis
Question Style: 75% Scenario-Based | 25% Direct Knowledge
, Section 1: Security Architecture Foundations: Principles, Reference Models & Framework
Alignment (Q1-Q10)
Q1: Which security architecture principle states that a system should default to the most secure configuration,
requiring explicit action to reduce restrictions?
A. A. Least privilege
B. B. Defense in depth
C. C. Fail-safe defaults [CORRECT]
D. D. Separation of duties
Correct Answer: C
Rationale: Fail-safe defaults means a system defaults to a secure state, requiring explicit action to grant access or reduce
restrictions. Least privilege (A) grants minimum necessary access. Defense in depth (B) layers multiple controls. Separation of
duties (D) divides critical functions across roles.
Q2: An enterprise security architect must align security requirements with business objectives using TOGAF.
Which TOGAF ADM phase is MOST relevant for defining security architecture requirements?
A. A. Preliminary Phase
B. B. Phase A: Architecture Vision
C. C. Phase B: Business Architecture
D. D. Phase C: Information Systems Architecture (including Security Architecture) [CORRECT]
Correct Answer: D
Rationale: Phase C of the TOGAF ADM addresses Information Systems Architecture, encompassing applications and data
security architecture. Security requirements are formally captured and mapped here. Phase A (B) establishes scope and vision.
Phase C is where security architecture deliverables are produced as part of the technology architecture development.
Q3: In the SABSA layered model, which layer addresses 'what' questions and defines business attributes that
need protection?
A. A. Contextual layer (Why)
B. B. Conceptual layer (What) [CORRECT]
C. C. Logical layer (How)
D. D. Physical layer (With what)
Correct Answer: B
Rationale: SABSA's Conceptual layer answers 'What' questions, defining business assets, attributes, and the security attributes
(confidentiality, integrity, availability, accountability, etc.) applied to business objects. The Contextual layer (A) addresses business
motivation ('Why'). The Logical layer (C) addresses security services ('How'). The Physical layer (D) addresses implementation
('With what').
Q4: A security architect is designing a defense-in-depth strategy for a critical database. Which approach BEST
exemplifies defense in depth?
A. A. Implementing a single, robust next-generation firewall at the network perimeter
B. B. Layering multiple independent security controls including network segmentation, encryption at rest,
database activity monitoring, and role-based access controls [CORRECT]
C. C. Encrypting all data using AES-256 as the sole protective measure
D. D. Deploying anti-malware software on all endpoints
Correct Answer: B
Rationale: Defense in depth uses multiple layered, independent controls so that if one control fails, others still provide protection.
Option B demonstrates this by combining network, data, monitoring, and access controls. Single controls (A, C, D) create single
points of failure regardless of their individual strength.
Q5: NIST SP 800-160 Volume 1 defines a systems security engineering approach aligned with which
international standard for systems and software engineering lifecycle processes?
A. A. ISO 27001
B. B. ISO/IEC/IEEE 15288 (Systems Engineering) and ISO/IEC/IEEE 12207 (Software Engineering) [CORRECT]
C. C. NIST SP 800-53
D. D. ISO 27014
Correct Answer: B
Rationale: NIST SP 800-160 Vol. 1 integrates systems security engineering into ISO/IEC/IEEE 15288 (systems lifecycle) and
12207 (software lifecycle), embedding security as a fundamental engineering concern throughout the acquisition and supply
processes. ISO 27001 (A) is an ISMS framework. SP 800-53 (C) is a controls catalog. ISO 27014 (D) is governance guidance.
Objective Assessment Practice Review 2025|2026
Complete Test Bank & Assessment Guide | Graded A+ | Verified
50 Practice Questions | 2026/2027 Aligned
Alignment Frameworks:
WGU D488 Competency Framework
NIST CSF 2.0 & SP 800-160/207
SABSA & TOGAF Security Architecture Models
ISO/IEC 27000 Series
Zero Trust, DevSecOps & Cloud Security Standards
Sec Content Area Q#
1 Security Architecture Foundations: Principles, Reference Models & Frameworks 1-10
2 Threat Modeling, Risk Assessment & Security Control Engineering 11-20
3 Secure Systems Design, SDLC & DevSecOps Integration 21-30
4 Cloud, Network & Zero Trust Architecture Implementation 31-40
5 Governance, Compliance, Cryptography & Professional Practice 41-50
Cognitive Distribution: 30% Recall | 50% Application | 20% Analysis
Question Style: 75% Scenario-Based | 25% Direct Knowledge
, Section 1: Security Architecture Foundations: Principles, Reference Models & Framework
Alignment (Q1-Q10)
Q1: Which security architecture principle states that a system should default to the most secure configuration,
requiring explicit action to reduce restrictions?
A. A. Least privilege
B. B. Defense in depth
C. C. Fail-safe defaults [CORRECT]
D. D. Separation of duties
Correct Answer: C
Rationale: Fail-safe defaults means a system defaults to a secure state, requiring explicit action to grant access or reduce
restrictions. Least privilege (A) grants minimum necessary access. Defense in depth (B) layers multiple controls. Separation of
duties (D) divides critical functions across roles.
Q2: An enterprise security architect must align security requirements with business objectives using TOGAF.
Which TOGAF ADM phase is MOST relevant for defining security architecture requirements?
A. A. Preliminary Phase
B. B. Phase A: Architecture Vision
C. C. Phase B: Business Architecture
D. D. Phase C: Information Systems Architecture (including Security Architecture) [CORRECT]
Correct Answer: D
Rationale: Phase C of the TOGAF ADM addresses Information Systems Architecture, encompassing applications and data
security architecture. Security requirements are formally captured and mapped here. Phase A (B) establishes scope and vision.
Phase C is where security architecture deliverables are produced as part of the technology architecture development.
Q3: In the SABSA layered model, which layer addresses 'what' questions and defines business attributes that
need protection?
A. A. Contextual layer (Why)
B. B. Conceptual layer (What) [CORRECT]
C. C. Logical layer (How)
D. D. Physical layer (With what)
Correct Answer: B
Rationale: SABSA's Conceptual layer answers 'What' questions, defining business assets, attributes, and the security attributes
(confidentiality, integrity, availability, accountability, etc.) applied to business objects. The Contextual layer (A) addresses business
motivation ('Why'). The Logical layer (C) addresses security services ('How'). The Physical layer (D) addresses implementation
('With what').
Q4: A security architect is designing a defense-in-depth strategy for a critical database. Which approach BEST
exemplifies defense in depth?
A. A. Implementing a single, robust next-generation firewall at the network perimeter
B. B. Layering multiple independent security controls including network segmentation, encryption at rest,
database activity monitoring, and role-based access controls [CORRECT]
C. C. Encrypting all data using AES-256 as the sole protective measure
D. D. Deploying anti-malware software on all endpoints
Correct Answer: B
Rationale: Defense in depth uses multiple layered, independent controls so that if one control fails, others still provide protection.
Option B demonstrates this by combining network, data, monitoring, and access controls. Single controls (A, C, D) create single
points of failure regardless of their individual strength.
Q5: NIST SP 800-160 Volume 1 defines a systems security engineering approach aligned with which
international standard for systems and software engineering lifecycle processes?
A. A. ISO 27001
B. B. ISO/IEC/IEEE 15288 (Systems Engineering) and ISO/IEC/IEEE 12207 (Software Engineering) [CORRECT]
C. C. NIST SP 800-53
D. D. ISO 27014
Correct Answer: B
Rationale: NIST SP 800-160 Vol. 1 integrates systems security engineering into ISO/IEC/IEEE 15288 (systems lifecycle) and
12207 (software lifecycle), embedding security as a fundamental engineering concern throughout the acquisition and supply
processes. ISO 27001 (A) is an ISMS framework. SP 800-53 (C) is a controls catalog. ISO 27014 (D) is governance guidance.
