2026/2027
WGU D827 Information Security
Fundamentals OA Exam 2026/2027
Structured Revision, Quizzes, and
Assessment Practice Workbook
Question 1
Which CIA triad principle is most affected by a fabrication attack, where false data
or processes are introduced into a system?
A. Availability
B. Integrity
C. Confidentiality
D. Integrity and Availability
Correct Answer: B. Integrity
Rationale: Fabrication attacks introduce false or misleading data, processes, or
communications into a system. This directly compromises integrity, as the
trustworthiness and accuracy of information are violated. Confidentiality is not
primarily affected because no unauthorized disclosure is required, and availability is
not necessarily impacted unless the attack also disrupts services.
Question 2
Which CIA triad principle is most affected by an interception attack?
A. Integrity and Availability
B. Confidentiality
C. Availability
D. Integrity
Correct Answer: B. Confidentiality
Rationale: Interception attacks focus on unauthorized access to information, such as
eavesdropping or sniffing. This primarily violates confidentiality because sensitive
data is exposed to unauthorized parties. Integrity and availability remain intact since
the data is not modified or destroyed.
Question 3
,2026/2027
Something that has the potential to cause harm to an asset is known as a:
A. Threat
B. Impact
C. Risk
D. Vulnerability
Correct Answer: A. Threat
Rationale: A threat refers to any potential cause of harm to an asset, such as an
attacker, malware, or natural disaster. Vulnerability is a weakness, while risk is the
likelihood of harm occurring. Impact refers to the consequence of a realized threat.
Question 4
Controls that protect systems, networks, and environments that process data are called:
A. Logical controls
B. Administrative controls
C. Physical controls
D. Procedural controls
Correct Answer: A. Logical controls
Rationale: Logical (technical) controls include firewalls, encryption, authentication
systems, and access controls that protect digital systems. Administrative controls
involve policies and procedures, while physical controls protect physical
environments.
Question 5
What is the first and most important step in the risk management process?
A. Assess risks
B. Mitigate risks
C. Identify threats
D. Identify assets
Correct Answer: D. Identify assets
Rationale: Risk management begins by identifying what needs protection. Without
knowing the assets, it is impossible to evaluate threats, vulnerabilities, or risks
accurately. This step sets the foundation for all further analysis.
Question 6
,2026/2027
Information security is best defined as:
A. Protecting hardware from theft
B. Protecting data only during transmission
C. Protecting information from unauthorized access or modification
D. Preventing system downtime only
Correct Answer: C. Protecting information from unauthorized access or
modification
Rationale: Information security focuses on protecting data in all states—at rest, in
transit, and in use—from unauthorized access, disclosure, modification, or destruction.
Question 7
A weakness that can be exploited by a threat is called:
A. Risk
B. Vulnerability
C. Impact
D. Threat
Correct Answer: B. Vulnerability
Rationale: A vulnerability is a flaw or weakness in a system that can be exploited by a
threat actor to cause harm. It becomes significant only when a relevant threat exists.
Question 8
The likelihood that a harmful event will occur is known as:
A. Threat
B. Risk
C. Vulnerability
D. Exposure
Correct Answer: B. Risk
Rationale: Risk is the probability that a threat will exploit a vulnerability and cause
harm. It combines likelihood and impact.
Question 9
An attack involving tampering with data is called:
, 2026/2027
A. Fabrication
B. Modification
C. Interception
D. Interruption
Correct Answer: B. Modification
Rationale: Modification attacks involve altering data or system behavior without
authorization, directly affecting integrity.
Question 10
A multilayered security approach where multiple defenses work together is called:
A. Defense in depth
B. Capability-based security
C. Least privilege
D. Access control
Correct Answer: A. Defense in depth
Rationale: Defense in depth uses multiple layers of security controls so that if one
layer fails, others continue to provide protection.
Question 11
The principle that restricts users to only the permissions they need is:
A. Least privilege
B. Separation of duties
C. Mandatory access control
D. Accountability
Correct Answer: A. Least privilege
Rationale: The principle of least privilege minimizes risk by ensuring users only have
the access required to perform their duties.
Question 12
Which model allows users to set permissions on resources they own?
A. MAC
B. RBAC
WGU D827 Information Security
Fundamentals OA Exam 2026/2027
Structured Revision, Quizzes, and
Assessment Practice Workbook
Question 1
Which CIA triad principle is most affected by a fabrication attack, where false data
or processes are introduced into a system?
A. Availability
B. Integrity
C. Confidentiality
D. Integrity and Availability
Correct Answer: B. Integrity
Rationale: Fabrication attacks introduce false or misleading data, processes, or
communications into a system. This directly compromises integrity, as the
trustworthiness and accuracy of information are violated. Confidentiality is not
primarily affected because no unauthorized disclosure is required, and availability is
not necessarily impacted unless the attack also disrupts services.
Question 2
Which CIA triad principle is most affected by an interception attack?
A. Integrity and Availability
B. Confidentiality
C. Availability
D. Integrity
Correct Answer: B. Confidentiality
Rationale: Interception attacks focus on unauthorized access to information, such as
eavesdropping or sniffing. This primarily violates confidentiality because sensitive
data is exposed to unauthorized parties. Integrity and availability remain intact since
the data is not modified or destroyed.
Question 3
,2026/2027
Something that has the potential to cause harm to an asset is known as a:
A. Threat
B. Impact
C. Risk
D. Vulnerability
Correct Answer: A. Threat
Rationale: A threat refers to any potential cause of harm to an asset, such as an
attacker, malware, or natural disaster. Vulnerability is a weakness, while risk is the
likelihood of harm occurring. Impact refers to the consequence of a realized threat.
Question 4
Controls that protect systems, networks, and environments that process data are called:
A. Logical controls
B. Administrative controls
C. Physical controls
D. Procedural controls
Correct Answer: A. Logical controls
Rationale: Logical (technical) controls include firewalls, encryption, authentication
systems, and access controls that protect digital systems. Administrative controls
involve policies and procedures, while physical controls protect physical
environments.
Question 5
What is the first and most important step in the risk management process?
A. Assess risks
B. Mitigate risks
C. Identify threats
D. Identify assets
Correct Answer: D. Identify assets
Rationale: Risk management begins by identifying what needs protection. Without
knowing the assets, it is impossible to evaluate threats, vulnerabilities, or risks
accurately. This step sets the foundation for all further analysis.
Question 6
,2026/2027
Information security is best defined as:
A. Protecting hardware from theft
B. Protecting data only during transmission
C. Protecting information from unauthorized access or modification
D. Preventing system downtime only
Correct Answer: C. Protecting information from unauthorized access or
modification
Rationale: Information security focuses on protecting data in all states—at rest, in
transit, and in use—from unauthorized access, disclosure, modification, or destruction.
Question 7
A weakness that can be exploited by a threat is called:
A. Risk
B. Vulnerability
C. Impact
D. Threat
Correct Answer: B. Vulnerability
Rationale: A vulnerability is a flaw or weakness in a system that can be exploited by a
threat actor to cause harm. It becomes significant only when a relevant threat exists.
Question 8
The likelihood that a harmful event will occur is known as:
A. Threat
B. Risk
C. Vulnerability
D. Exposure
Correct Answer: B. Risk
Rationale: Risk is the probability that a threat will exploit a vulnerability and cause
harm. It combines likelihood and impact.
Question 9
An attack involving tampering with data is called:
, 2026/2027
A. Fabrication
B. Modification
C. Interception
D. Interruption
Correct Answer: B. Modification
Rationale: Modification attacks involve altering data or system behavior without
authorization, directly affecting integrity.
Question 10
A multilayered security approach where multiple defenses work together is called:
A. Defense in depth
B. Capability-based security
C. Least privilege
D. Access control
Correct Answer: A. Defense in depth
Rationale: Defense in depth uses multiple layers of security controls so that if one
layer fails, others continue to provide protection.
Question 11
The principle that restricts users to only the permissions they need is:
A. Least privilege
B. Separation of duties
C. Mandatory access control
D. Accountability
Correct Answer: A. Least privilege
Rationale: The principle of least privilege minimizes risk by ensuring users only have
the access required to perform their duties.
Question 12
Which model allows users to set permissions on resources they own?
A. MAC
B. RBAC
