WGU C845 VUN1 Task 1: Managing Security
Operations and Access Controls | 100% Guaranteed
Pass || Complete A+ Guide
1. In a zero-trust architecture, which access control model is most appropriate for dynamically
granting access based on user attributes, device health, location, and real-time risk score?
A. Discretionary Access Control (DAC)
B. Mandatory Access Control (MAC)
C. Role-Based Access Control (RBAC)
D. Attribute-Based Access Control (ABAC)
Answer: D
Rationale: ABAC evaluates multiple attributes (user, device, environment) to make dynamic access
decisions, aligning with zero-trust principles. DAC relies on user discretion, MAC uses fixed labels, and
RBAC uses static roles, none of which adapt to real-time context.
2. During a forensic investigation, you discover that an attacker used a stolen Kerberos
ticket-granting ticket (TGT) to authenticate as a domain admin. Which technique did the attacker
likely employ?
A. Pass-the-Hash
B. Golden Ticket Attack
C. Silver Ticket Attack
D. Overpass-the-Hash
Answer: B
Rationale: A Golden Ticket attack forges a TGT using the KRBTGT account hash, granting domain-wide
access. Pass-the-Hash uses NTLM hashes, Silver Ticket forges service tickets, and Overpass-the-Hash
uses Kerberos with NTLM hashes.
3. An organization uses SAML 2.0 for single sign-on (SSO). Which security concern is most critical
when the identity provider (IdP) and service provider (SP) do not properly validate the Assertion
Consumer Service (ACS) URL?
A. XML Signature Wrapping
B. Session Fixation
C. Cross-Site Request Forgery (CSRF)
D. SAML Response Interception
Answer: A
Rationale: Improper ACS URL validation can allow XML Signature Wrapping attacks, where an attacker
modifies the SAML assertion while preserving the signature. Session Fixation and CSRF are web
application issues, and interception is mitigated by encryption.
Page 1
,4. In a multi-factor authentication deployment, which biometric modality is LEAST susceptible to
presentation attacks (spoofing) when used in a high-security access control system?
A. Fingerprint recognition
B. Facial recognition (2D camera)
C. Iris recognition
D. Voice recognition
Answer: C
Rationale: Iris recognition uses unique patterns in the iris and is difficult to spoof without a high-quality
replica. Fingerprints can be lifted, 2D facial recognition can be bypassed with photos, and voice can be
recorded.
5. A security operations center (SOC) analyst receives an alert indicating a large number of failed
authentication attempts from a single IP address within one minute. Which type of attack is most
likely occurring?
A. Password Spraying
B. Brute Force Attack
C. Credential Stuffing
D. Dictionary Attack
Answer: B
Rationale: A brute force attack tries many passwords against a single username (or many usernames) in
rapid succession from one IP. Password spraying uses few passwords across many accounts; credential
stuffing uses leaked credentials; dictionary attacks use a wordlist.
6. In the context of identity and access management (IAM), what is the primary purpose of a
just-in-time (JIT) privileged access management (PAM) solution?
A. To rotate passwords for service accounts on a scheduled basis
B. To provide temporary elevated privileges only when needed and automatically revoke them
C. To enforce multi-factor authentication for all administrative users
D. To monitor and record all privileged user sessions in real time
Answer: B
Rationale: JIT PAM grants privileged access for a limited time and automatically revokes it, reducing the
attack surface. Password rotation (A) and MFA (C) are complementary, and session monitoring (D) is a
separate feature.
7. An organization implements an OAuth 2.0 authorization framework for delegated access to
APIs. Which grant type is most appropriate for a mobile application that needs to securely obtain
an access token without exposing the client secret?
A. Authorization Code Grant
B. Implicit Grant
C. Client Credentials Grant
D. Resource Owner Password Credentials Grant
Answer: A
Page 2
,Rationale: The Authorization Code Grant with PKCE (Proof Key for Code Exchange) is recommended for mobile apps; it
uses a code exchange and prevents secret exposure. Implicit Grant is deprecated, Client Credentials is for server-to-server,
and Password Grant is discouraged.
8. During an incident response, a forensic analyst examines a Windows system and finds that the
security event log was cleared. Which event ID is typically recorded when the security log is
cleared?
A. Event ID 1102
B. Event ID 4624
C. Event ID 4670
D. Event ID 7036
Answer: A
Rationale: Event ID 1102 (formerly 517) indicates the security log was cleared. 4624 is a successful
logon, 4670 is permissions change, and 7036 is service state change.
9. In a Role-Based Access Control (RBAC) system, an accountant is assigned to the 'Accountant'
role, which has 'Read' and 'Write' permissions to financial records. The user also has the 'Auditor'
role, which has 'Read' permission to financial records but explicitly denies 'Write'. Under a strict
denial override policy, what is the user's effective permission to financial records?
A. Read and Write
B. Read only
C. No access
D. Write only
Answer: B
Rationale: In a denial override policy, explicit deny (from Auditor role) overrides allow. However, the
user still has Read from both roles, so Read is granted; Write is denied. Thus effective permission is
Read only.
10. An organization is implementing a cloud-based identity provider (IdP) that supports OpenID
Connect (OIDC) for authentication. Which token is used by the client to obtain user identity
information after successful authentication?
A. Access Token
B. Refresh Token
C. ID Token
D. Authorization Code
Answer: C
Rationale: The ID Token is a JSON Web Token (JWT) containing claims about the user's identity, such as
name and email. Access Token is for API access, Refresh Token obtains new access tokens, and
Authorization Code is exchanged for tokens.
Page 3
, 11. A security analyst is reviewing the access control model for a multinational corporation's
cloud-based document management system. The system must support dynamic, attribute-based
access decisions that consider user location, device security posture, and document classification.
Which access control model is most appropriate, and what is its primary advantage over
traditional models in this context?
A. Role-Based Access Control (RBAC); it simplifies administration by assigning permissions to roles.
B. Attribute-Based Access Control (ABAC); it allows fine-grained, context-aware policies using multiple
attributes.
C. Discretionary Access Control (DAC); it enables data owners to delegate permissions dynamically.
D. Mandatory Access Control (MAC); it enforces system-wide policies that cannot be overridden.
Answer: B
Rationale: ABAC uses attributes (user, resource, environment) to evaluate policies, providing flexible,
context-aware decisions. RBAC is role-centric and less granular. DAC allows owner discretion but lacks
centralized control. MAC is rigid and not attribute-driven.
12. During a security audit, an organization discovers that an employee's account was used to
access sensitive financial records from an unauthorized IP address at 3 AM. The account had
multifactor authentication (MFA) enabled. Which of the following best describes the likely attack
vector, and what control could have prevented it?
A. Session hijacking; implement token binding.
B. Credential theft via phishing; enforce hardware-based MFA.
C. MFA fatigue attack; implement rate-limiting on MFA push notifications.
D. Privilege escalation; apply least privilege principles.
Answer: C
Rationale: MFA fatigue attacks involve repeated push notifications until the user accepts, bypassing MFA.
Rate-limiting or requiring number matching mitigates this. Session hijacking and phishing are possible
but less likely given MFA. Privilege escalation does not explain MFA bypass.
13. A security engineer is designing a privileged access management (PAM) solution for a hybrid
IT environment. The solution must support just-in-time (JIT) elevation, session recording, and
credential rotation. Which of the following architectures best meets these requirements?
A. Deploy a bastion host with SSH keys and audit logging.
B. Implement a password vault with manual checkout and approval workflow.
C. Use a dedicated PAM appliance that integrates with Active Directory and provides proxy-based access.
D. Configure group policies in Active Directory to restrict local admin rights.
Answer: C
Rationale: A dedicated PAM appliance offers JIT elevation, session recording, and automatic credential
rotation via a proxy. Bastion hosts lack credential rotation. Password vaults may not provide JIT. Group
policies do not cover session recording or rotation.
Page 4
Operations and Access Controls | 100% Guaranteed
Pass || Complete A+ Guide
1. In a zero-trust architecture, which access control model is most appropriate for dynamically
granting access based on user attributes, device health, location, and real-time risk score?
A. Discretionary Access Control (DAC)
B. Mandatory Access Control (MAC)
C. Role-Based Access Control (RBAC)
D. Attribute-Based Access Control (ABAC)
Answer: D
Rationale: ABAC evaluates multiple attributes (user, device, environment) to make dynamic access
decisions, aligning with zero-trust principles. DAC relies on user discretion, MAC uses fixed labels, and
RBAC uses static roles, none of which adapt to real-time context.
2. During a forensic investigation, you discover that an attacker used a stolen Kerberos
ticket-granting ticket (TGT) to authenticate as a domain admin. Which technique did the attacker
likely employ?
A. Pass-the-Hash
B. Golden Ticket Attack
C. Silver Ticket Attack
D. Overpass-the-Hash
Answer: B
Rationale: A Golden Ticket attack forges a TGT using the KRBTGT account hash, granting domain-wide
access. Pass-the-Hash uses NTLM hashes, Silver Ticket forges service tickets, and Overpass-the-Hash
uses Kerberos with NTLM hashes.
3. An organization uses SAML 2.0 for single sign-on (SSO). Which security concern is most critical
when the identity provider (IdP) and service provider (SP) do not properly validate the Assertion
Consumer Service (ACS) URL?
A. XML Signature Wrapping
B. Session Fixation
C. Cross-Site Request Forgery (CSRF)
D. SAML Response Interception
Answer: A
Rationale: Improper ACS URL validation can allow XML Signature Wrapping attacks, where an attacker
modifies the SAML assertion while preserving the signature. Session Fixation and CSRF are web
application issues, and interception is mitigated by encryption.
Page 1
,4. In a multi-factor authentication deployment, which biometric modality is LEAST susceptible to
presentation attacks (spoofing) when used in a high-security access control system?
A. Fingerprint recognition
B. Facial recognition (2D camera)
C. Iris recognition
D. Voice recognition
Answer: C
Rationale: Iris recognition uses unique patterns in the iris and is difficult to spoof without a high-quality
replica. Fingerprints can be lifted, 2D facial recognition can be bypassed with photos, and voice can be
recorded.
5. A security operations center (SOC) analyst receives an alert indicating a large number of failed
authentication attempts from a single IP address within one minute. Which type of attack is most
likely occurring?
A. Password Spraying
B. Brute Force Attack
C. Credential Stuffing
D. Dictionary Attack
Answer: B
Rationale: A brute force attack tries many passwords against a single username (or many usernames) in
rapid succession from one IP. Password spraying uses few passwords across many accounts; credential
stuffing uses leaked credentials; dictionary attacks use a wordlist.
6. In the context of identity and access management (IAM), what is the primary purpose of a
just-in-time (JIT) privileged access management (PAM) solution?
A. To rotate passwords for service accounts on a scheduled basis
B. To provide temporary elevated privileges only when needed and automatically revoke them
C. To enforce multi-factor authentication for all administrative users
D. To monitor and record all privileged user sessions in real time
Answer: B
Rationale: JIT PAM grants privileged access for a limited time and automatically revokes it, reducing the
attack surface. Password rotation (A) and MFA (C) are complementary, and session monitoring (D) is a
separate feature.
7. An organization implements an OAuth 2.0 authorization framework for delegated access to
APIs. Which grant type is most appropriate for a mobile application that needs to securely obtain
an access token without exposing the client secret?
A. Authorization Code Grant
B. Implicit Grant
C. Client Credentials Grant
D. Resource Owner Password Credentials Grant
Answer: A
Page 2
,Rationale: The Authorization Code Grant with PKCE (Proof Key for Code Exchange) is recommended for mobile apps; it
uses a code exchange and prevents secret exposure. Implicit Grant is deprecated, Client Credentials is for server-to-server,
and Password Grant is discouraged.
8. During an incident response, a forensic analyst examines a Windows system and finds that the
security event log was cleared. Which event ID is typically recorded when the security log is
cleared?
A. Event ID 1102
B. Event ID 4624
C. Event ID 4670
D. Event ID 7036
Answer: A
Rationale: Event ID 1102 (formerly 517) indicates the security log was cleared. 4624 is a successful
logon, 4670 is permissions change, and 7036 is service state change.
9. In a Role-Based Access Control (RBAC) system, an accountant is assigned to the 'Accountant'
role, which has 'Read' and 'Write' permissions to financial records. The user also has the 'Auditor'
role, which has 'Read' permission to financial records but explicitly denies 'Write'. Under a strict
denial override policy, what is the user's effective permission to financial records?
A. Read and Write
B. Read only
C. No access
D. Write only
Answer: B
Rationale: In a denial override policy, explicit deny (from Auditor role) overrides allow. However, the
user still has Read from both roles, so Read is granted; Write is denied. Thus effective permission is
Read only.
10. An organization is implementing a cloud-based identity provider (IdP) that supports OpenID
Connect (OIDC) for authentication. Which token is used by the client to obtain user identity
information after successful authentication?
A. Access Token
B. Refresh Token
C. ID Token
D. Authorization Code
Answer: C
Rationale: The ID Token is a JSON Web Token (JWT) containing claims about the user's identity, such as
name and email. Access Token is for API access, Refresh Token obtains new access tokens, and
Authorization Code is exchanged for tokens.
Page 3
, 11. A security analyst is reviewing the access control model for a multinational corporation's
cloud-based document management system. The system must support dynamic, attribute-based
access decisions that consider user location, device security posture, and document classification.
Which access control model is most appropriate, and what is its primary advantage over
traditional models in this context?
A. Role-Based Access Control (RBAC); it simplifies administration by assigning permissions to roles.
B. Attribute-Based Access Control (ABAC); it allows fine-grained, context-aware policies using multiple
attributes.
C. Discretionary Access Control (DAC); it enables data owners to delegate permissions dynamically.
D. Mandatory Access Control (MAC); it enforces system-wide policies that cannot be overridden.
Answer: B
Rationale: ABAC uses attributes (user, resource, environment) to evaluate policies, providing flexible,
context-aware decisions. RBAC is role-centric and less granular. DAC allows owner discretion but lacks
centralized control. MAC is rigid and not attribute-driven.
12. During a security audit, an organization discovers that an employee's account was used to
access sensitive financial records from an unauthorized IP address at 3 AM. The account had
multifactor authentication (MFA) enabled. Which of the following best describes the likely attack
vector, and what control could have prevented it?
A. Session hijacking; implement token binding.
B. Credential theft via phishing; enforce hardware-based MFA.
C. MFA fatigue attack; implement rate-limiting on MFA push notifications.
D. Privilege escalation; apply least privilege principles.
Answer: C
Rationale: MFA fatigue attacks involve repeated push notifications until the user accepts, bypassing MFA.
Rate-limiting or requiring number matching mitigates this. Session hijacking and phishing are possible
but less likely given MFA. Privilege escalation does not explain MFA bypass.
13. A security engineer is designing a privileged access management (PAM) solution for a hybrid
IT environment. The solution must support just-in-time (JIT) elevation, session recording, and
credential rotation. Which of the following architectures best meets these requirements?
A. Deploy a bastion host with SSH keys and audit logging.
B. Implement a password vault with manual checkout and approval workflow.
C. Use a dedicated PAM appliance that integrates with Active Directory and provides proxy-based access.
D. Configure group policies in Active Directory to restrict local admin rights.
Answer: C
Rationale: A dedicated PAM appliance offers JIT elevation, session recording, and automatic credential
rotation via a proxy. Bastion hosts lack credential rotation. Password vaults may not provide JIT. Group
policies do not cover session recording or rotation.
Page 4
