WGU Cybersecurity Architecture and
Engineering (KFO1/D488) EXAM STUDY
GUIDE 2026/2027 ACCURATE QUESTIONS
WITH CORRECT DETAILED SOLUTIONS ||
100% GUARANTEED PASS
<NEWEST VERSION>
1. The security team recently enabled public access to a web application hosted
on a server inside the corporate network. The developers of the application
report that the server has received several structured query language (SQL)
injection attacks in the past several days. The team needs to deploy a
solution that will block the SQL injection attacks. Which solution fulfills
these requirements?
A - Virtual private network (VPN)
B - Security information and event management (SIEM)
C - Web application firewall (WAF)
D - Secure Socket Shell (SSH) - ANSWER ✔ C - Web application firewall
(WAF)
2. An IT security team has been notified that external contractors are using
their personal laptops to gain access to the corporate network. The team
needs to recommend a solution that will prevent unapproved devices from
accessing the network. Which solution fulfills these requirements?
A - Implementing a demilitarized zone (DMZ)
B - Installing a hardware security module
C - Implementing port security
D - Deploying a software firewall - ANSWER ✔ C - Implementing port
security
3. The chief technology officer for a small publishing company has been tasked
with improving the company's security posture. As part of a network
upgrade, the company has decided to implement intrusion detection, spam
, filtering, content filtering, and antivirus controls. The project needs to be
completed using the least amount of infrastructure while meeting all
requirements. Which solution fulfills these requirements?
A - Deploying an anti-spam gateway
B - Deploying a proxy server
C - Deploying a unified threat management (UTM) appliance
D - Deploying a web application firewall (WAF) - ANSWER ✔ C -
Deploying a unified threat management (UTM) appliance
4. While the system is operational, an industrial control systems engineer
assesses analyses on packet capture and traffic analysis. What type of
analysis is this?
A - Static
B - Dynamic
C - Reverse engineering
D - Side-channel - ANSWER ✔ D - Side-channel
5. Side-channel analysis describes inspections of a system and software as it
operates. An example of side-channel analysis includes packet capture and
traffic analysis.
A sysadmin can perform static analysis in a variety of ways. One method
involves manual inspection of source code to identify vulnerabilities in
programming techniques.
A dynamic analysis approach requires the evaluation of a system or software
while it is running.
Reverse engineering describes deconstructing software and hardware to
determine how it works. Reverse engineering's objective is to determine how
much information a sysadmin can extract from the delivered software.
6. A forensics investigator is experiencing a problem where the state of the
item checked changes after the initial check. What is it called after it
changes?
A - TOU
B - TOC
C - Atomic execution
D - Cron - ANSWER ✔ A - TOU (Time of Use)
,The Time of Use (TOU) issue arises when the system checks the state of a
resource, for example, but the resource's state changes after the initial check.
The Time of Check (TOC) issue occurs when the system checks the state of a
resource, for example, to verify its state, and then based on that check, the
system performs an action that may be invalid.
Atomic execution describes the capability for a task to run with exclusive
access to resources. In contrast, a lack of atomic execution means that more
than one task can access or modify critical resources.
Cron performs several automated tasks, including system maintenance or status
checks, and many times, it will trigger scripts to run.
7. A security professional has some spare time to do research on the corporate
network and wants to set up a system configured to carefully monitor and
log interactions. Which of the following should the security professional set
up?
A - Honeynet
B - Honeypot
C - Simulator
D - Decoy files - ANSWER ✔ B - Honeypot
8. A honeypot mimics a genuine system, and a sysadmin configures it to
carefully monitor and log interactions. Any interactions with a honeypot
warrant closer inspection as the honeypot does not provide services to
regular staff or employees.
A honeynet contains several honeypots attached to a tightly controlled and
heavily monitored network.
A simulator is generally less complicated to deploy than other deceptive
technologies but can serve a similar purpose.
Decoy files can include honeytokens or canary traps. These decoy files contain
data that would be appealing to an adversary, such as user credentials, email
addresses, and account numbers.
, 9. A system administrator wants to harden the organization's servers. Which of
the following would best help to harden the servers?
A - SCAP scan
B - Vulnerability scan
C - Protocol analyzer
D - Port scan - ANSWER ✔ A - SCAP scan
A Security Content Automation Protocol (SCAP) scanner can compare a target,
a computer/software configuration, and patch level against pre-determined
settings contained within a SCAP content baseline.
Vulnerability scanners can assess endpoint devices, such as computers, network
equipment, and mobile devices, including the applications installed on them.
Protocol analyzers capture traffic in a networked environment, and a sysadmin
often configures them to store captured traffic for further analysis using other
software tools.
A port scanner is for network discovery tasks and security auditing. Port
scanners provide a useful way to quickly assess inventory systems and software
running in a networked environment.
10.A security administrator has a server environment where most files don't
change much, and the administrator wants to implement a solution that
monitors for changes. What should the security administrator implement?
A - FIM
B - DLP
C - IDS
D - SIEM - ANSWER ✔ A - FIM
Another use for hashing is to prove file integrity monitoring (FIM). The hash
value for an operating system and legitimate application binaries are
comparable to the list of known file hashes.
Data loss (leak) prevention (DLP) products automate the discovery and
classification of data types and enforce rules so that data is not viewed or
transferred without proper authorization.
Engineering (KFO1/D488) EXAM STUDY
GUIDE 2026/2027 ACCURATE QUESTIONS
WITH CORRECT DETAILED SOLUTIONS ||
100% GUARANTEED PASS
<NEWEST VERSION>
1. The security team recently enabled public access to a web application hosted
on a server inside the corporate network. The developers of the application
report that the server has received several structured query language (SQL)
injection attacks in the past several days. The team needs to deploy a
solution that will block the SQL injection attacks. Which solution fulfills
these requirements?
A - Virtual private network (VPN)
B - Security information and event management (SIEM)
C - Web application firewall (WAF)
D - Secure Socket Shell (SSH) - ANSWER ✔ C - Web application firewall
(WAF)
2. An IT security team has been notified that external contractors are using
their personal laptops to gain access to the corporate network. The team
needs to recommend a solution that will prevent unapproved devices from
accessing the network. Which solution fulfills these requirements?
A - Implementing a demilitarized zone (DMZ)
B - Installing a hardware security module
C - Implementing port security
D - Deploying a software firewall - ANSWER ✔ C - Implementing port
security
3. The chief technology officer for a small publishing company has been tasked
with improving the company's security posture. As part of a network
upgrade, the company has decided to implement intrusion detection, spam
, filtering, content filtering, and antivirus controls. The project needs to be
completed using the least amount of infrastructure while meeting all
requirements. Which solution fulfills these requirements?
A - Deploying an anti-spam gateway
B - Deploying a proxy server
C - Deploying a unified threat management (UTM) appliance
D - Deploying a web application firewall (WAF) - ANSWER ✔ C -
Deploying a unified threat management (UTM) appliance
4. While the system is operational, an industrial control systems engineer
assesses analyses on packet capture and traffic analysis. What type of
analysis is this?
A - Static
B - Dynamic
C - Reverse engineering
D - Side-channel - ANSWER ✔ D - Side-channel
5. Side-channel analysis describes inspections of a system and software as it
operates. An example of side-channel analysis includes packet capture and
traffic analysis.
A sysadmin can perform static analysis in a variety of ways. One method
involves manual inspection of source code to identify vulnerabilities in
programming techniques.
A dynamic analysis approach requires the evaluation of a system or software
while it is running.
Reverse engineering describes deconstructing software and hardware to
determine how it works. Reverse engineering's objective is to determine how
much information a sysadmin can extract from the delivered software.
6. A forensics investigator is experiencing a problem where the state of the
item checked changes after the initial check. What is it called after it
changes?
A - TOU
B - TOC
C - Atomic execution
D - Cron - ANSWER ✔ A - TOU (Time of Use)
,The Time of Use (TOU) issue arises when the system checks the state of a
resource, for example, but the resource's state changes after the initial check.
The Time of Check (TOC) issue occurs when the system checks the state of a
resource, for example, to verify its state, and then based on that check, the
system performs an action that may be invalid.
Atomic execution describes the capability for a task to run with exclusive
access to resources. In contrast, a lack of atomic execution means that more
than one task can access or modify critical resources.
Cron performs several automated tasks, including system maintenance or status
checks, and many times, it will trigger scripts to run.
7. A security professional has some spare time to do research on the corporate
network and wants to set up a system configured to carefully monitor and
log interactions. Which of the following should the security professional set
up?
A - Honeynet
B - Honeypot
C - Simulator
D - Decoy files - ANSWER ✔ B - Honeypot
8. A honeypot mimics a genuine system, and a sysadmin configures it to
carefully monitor and log interactions. Any interactions with a honeypot
warrant closer inspection as the honeypot does not provide services to
regular staff or employees.
A honeynet contains several honeypots attached to a tightly controlled and
heavily monitored network.
A simulator is generally less complicated to deploy than other deceptive
technologies but can serve a similar purpose.
Decoy files can include honeytokens or canary traps. These decoy files contain
data that would be appealing to an adversary, such as user credentials, email
addresses, and account numbers.
, 9. A system administrator wants to harden the organization's servers. Which of
the following would best help to harden the servers?
A - SCAP scan
B - Vulnerability scan
C - Protocol analyzer
D - Port scan - ANSWER ✔ A - SCAP scan
A Security Content Automation Protocol (SCAP) scanner can compare a target,
a computer/software configuration, and patch level against pre-determined
settings contained within a SCAP content baseline.
Vulnerability scanners can assess endpoint devices, such as computers, network
equipment, and mobile devices, including the applications installed on them.
Protocol analyzers capture traffic in a networked environment, and a sysadmin
often configures them to store captured traffic for further analysis using other
software tools.
A port scanner is for network discovery tasks and security auditing. Port
scanners provide a useful way to quickly assess inventory systems and software
running in a networked environment.
10.A security administrator has a server environment where most files don't
change much, and the administrator wants to implement a solution that
monitors for changes. What should the security administrator implement?
A - FIM
B - DLP
C - IDS
D - SIEM - ANSWER ✔ A - FIM
Another use for hashing is to prove file integrity monitoring (FIM). The hash
value for an operating system and legitimate application binaries are
comparable to the list of known file hashes.
Data loss (leak) prevention (DLP) products automate the discovery and
classification of data types and enforce rules so that data is not viewed or
transferred without proper authorization.
