WGU D488
Cybersecurity Architecture and
Engineering
Pre-Assessment Examination
Latest Update 2026/2027 | Questions and Answers | Grade A | 100% Correct
100 Comprehensive Questions with Detailed Rationales
Aligned with WGU Curriculum Standards and Cybersecurity Architecture Competencies
Cognitive Levels: 25% Recall | 55% Application | 20% Analysis
70% Scenario-Based | 20% Direct Recall | 10% Critical Thinking
,Table of Contents
Section 1: Security Architecture and Design Principles 3
Section 2: Access Control and Identity Management 8
Section 3: Cryptography and Encryption 12
Section 4: Network Security Architecture 16
Section 5: Cloud Security and Infrastructure 21
Section 6: Application Security and Vulnerability Management 25
Section 7: Risk Management and Compliance 30
Section 8: Endpoint Security, Hardening, and Incident Response 35
Section 9: Integrated Scenarios and Critical Thinking 37
,WGU D488 Pre-Assessment Exam 2026/2027
Section 1: Security Architecture and Design Principles
Secure Design, Security Models, and Frameworks
Q1: A financial institution is designing its security architecture using a model that enforces
confidentiality by preventing users from reading data at a higher classification level and
preventing users from writing data to a lower classification level. Which security model is
being implemented? [Scenario-Based]
A. Biba Model
B. Bell-LaPadula Model [CORRECT]
C. Clark-Wilson Model
D. Brewer-Nash Model
Correct Answer: B
Rationale: The Bell-LaPadula model is a mandatory access control model focused on confidentiality. It
enforces two key rules: the Simple Security Property (no read up) prevents users from accessing data classified
above their clearance level, and the *-Property (no write down) prevents users from writing sensitive data to a
lower classification level. The Biba model focuses on integrity (no read down, no write up), while
Clark-Wilson addresses integrity through well-formed transactions and separation of duties. The
Brewer-Nash model (Chinese Wall) addresses conflicts of interest, not confidentiality classification
hierarchies.
Q2: An organization has implemented a security principle where each critical task is divided
among multiple individuals so that no single person can complete a sensitive operation alone.
Which secure design principle does this describe? [Scenario-Based]
A. Least Privilege
B. Defense in Depth
C. Separation of Duties [CORRECT]
D. Economy of Mechanism
Correct Answer: C
Rationale: Separation of Duties (SoD) divides critical tasks among multiple individuals, ensuring that no single
person can carry out a fraudulent act or complete a sensitive operation independently. This is a fundamental
secure design principle that prevents insider threats and reduces the risk of errors or malicious activity. Least
Privilege restricts user access to the minimum necessary permissions, while Defense in Depth uses multiple
layers of security controls. Economy of Mechanism advocates for simplicity in security design to reduce
potential vulnerabilities.
Q3: A software development team is performing threat modeling for a new web application
and identifies a threat where an attacker forges another user's identity to gain unauthorized
access. In the STRIDE threat model, which category does this threat fall under?
[Scenario-Based]
A. Tampering
Page 1
, WGU D488 Pre-Assessment Exam 2026/2027
B. Information Disclosure
C. Spoofing [CORRECT]
D. Elevation of Privilege
Correct Answer: C
Rationale: In the STRIDE threat model, Spoofing refers to an attacker impersonating another user, system, or
entity to gain unauthorized access. This aligns with the scenario where an attacker forges a user's identity.
Tampering involves unauthorized modification of data, Information Disclosure involves exposing sensitive
data to unauthorized parties, and Elevation of Privilege involves gaining higher-level access than authorized.
STRIDE is a mnemonic covering six threat categories: Spoofing, Tampering, Repudiation, Information
Disclosure, Denial of Service, and Elevation of Privilege.
Q4: A government contractor is evaluating its process maturity and finds that its security
processes are defined and documented at the organizational level, with most work being
proactive rather than reactive. According to the Capability Maturity Model Integration
(CMMI), at which level is this organization operating? [Scenario-Based]
A. Level 2: Managed
B. Level 3: Defined [CORRECT]
C. Level 4: Quantitatively Managed
D. Level 5: Optimizing
Correct Answer: B
Rationale: CMMI Level 3 (Defined) is characterized by processes that are defined and documented at the
organizational level, with the majority of work being proactive rather than reactive. At this level, processes are
standardized and consistently applied across the organization. Level 2 (Managed) involves defined activities
but remains reactive. Level 4 (Quantitatively Managed) adds measurable metrics and analysis, while Level 5
(Optimizing) involves continuous process improvement based on quantitative data.
Q5: A security architect recommends implementing multiple independent security controls so
that if one control fails, other controls continue to provide protection. Which secure design
principle is being applied? [Scenario-Based]
A. Fail Secure
B. Defense in Depth [CORRECT]
C. Complete Mediation
D. Open Design
Correct Answer: B
Rationale: Defense in Depth is the principle of implementing multiple layers of independent security controls
so that the failure of one control does not compromise the entire security posture. Each layer provides
additional protection, creating a comprehensive defense strategy. Fail Secure ensures that a system defaults to
a secure state when a failure occurs. Complete Mediation requires that every access request be checked against
the access control mechanism. Open Design states that the security of a system should not depend on keeping its
design secret.
Page 2
Cybersecurity Architecture and
Engineering
Pre-Assessment Examination
Latest Update 2026/2027 | Questions and Answers | Grade A | 100% Correct
100 Comprehensive Questions with Detailed Rationales
Aligned with WGU Curriculum Standards and Cybersecurity Architecture Competencies
Cognitive Levels: 25% Recall | 55% Application | 20% Analysis
70% Scenario-Based | 20% Direct Recall | 10% Critical Thinking
,Table of Contents
Section 1: Security Architecture and Design Principles 3
Section 2: Access Control and Identity Management 8
Section 3: Cryptography and Encryption 12
Section 4: Network Security Architecture 16
Section 5: Cloud Security and Infrastructure 21
Section 6: Application Security and Vulnerability Management 25
Section 7: Risk Management and Compliance 30
Section 8: Endpoint Security, Hardening, and Incident Response 35
Section 9: Integrated Scenarios and Critical Thinking 37
,WGU D488 Pre-Assessment Exam 2026/2027
Section 1: Security Architecture and Design Principles
Secure Design, Security Models, and Frameworks
Q1: A financial institution is designing its security architecture using a model that enforces
confidentiality by preventing users from reading data at a higher classification level and
preventing users from writing data to a lower classification level. Which security model is
being implemented? [Scenario-Based]
A. Biba Model
B. Bell-LaPadula Model [CORRECT]
C. Clark-Wilson Model
D. Brewer-Nash Model
Correct Answer: B
Rationale: The Bell-LaPadula model is a mandatory access control model focused on confidentiality. It
enforces two key rules: the Simple Security Property (no read up) prevents users from accessing data classified
above their clearance level, and the *-Property (no write down) prevents users from writing sensitive data to a
lower classification level. The Biba model focuses on integrity (no read down, no write up), while
Clark-Wilson addresses integrity through well-formed transactions and separation of duties. The
Brewer-Nash model (Chinese Wall) addresses conflicts of interest, not confidentiality classification
hierarchies.
Q2: An organization has implemented a security principle where each critical task is divided
among multiple individuals so that no single person can complete a sensitive operation alone.
Which secure design principle does this describe? [Scenario-Based]
A. Least Privilege
B. Defense in Depth
C. Separation of Duties [CORRECT]
D. Economy of Mechanism
Correct Answer: C
Rationale: Separation of Duties (SoD) divides critical tasks among multiple individuals, ensuring that no single
person can carry out a fraudulent act or complete a sensitive operation independently. This is a fundamental
secure design principle that prevents insider threats and reduces the risk of errors or malicious activity. Least
Privilege restricts user access to the minimum necessary permissions, while Defense in Depth uses multiple
layers of security controls. Economy of Mechanism advocates for simplicity in security design to reduce
potential vulnerabilities.
Q3: A software development team is performing threat modeling for a new web application
and identifies a threat where an attacker forges another user's identity to gain unauthorized
access. In the STRIDE threat model, which category does this threat fall under?
[Scenario-Based]
A. Tampering
Page 1
, WGU D488 Pre-Assessment Exam 2026/2027
B. Information Disclosure
C. Spoofing [CORRECT]
D. Elevation of Privilege
Correct Answer: C
Rationale: In the STRIDE threat model, Spoofing refers to an attacker impersonating another user, system, or
entity to gain unauthorized access. This aligns with the scenario where an attacker forges a user's identity.
Tampering involves unauthorized modification of data, Information Disclosure involves exposing sensitive
data to unauthorized parties, and Elevation of Privilege involves gaining higher-level access than authorized.
STRIDE is a mnemonic covering six threat categories: Spoofing, Tampering, Repudiation, Information
Disclosure, Denial of Service, and Elevation of Privilege.
Q4: A government contractor is evaluating its process maturity and finds that its security
processes are defined and documented at the organizational level, with most work being
proactive rather than reactive. According to the Capability Maturity Model Integration
(CMMI), at which level is this organization operating? [Scenario-Based]
A. Level 2: Managed
B. Level 3: Defined [CORRECT]
C. Level 4: Quantitatively Managed
D. Level 5: Optimizing
Correct Answer: B
Rationale: CMMI Level 3 (Defined) is characterized by processes that are defined and documented at the
organizational level, with the majority of work being proactive rather than reactive. At this level, processes are
standardized and consistently applied across the organization. Level 2 (Managed) involves defined activities
but remains reactive. Level 4 (Quantitatively Managed) adds measurable metrics and analysis, while Level 5
(Optimizing) involves continuous process improvement based on quantitative data.
Q5: A security architect recommends implementing multiple independent security controls so
that if one control fails, other controls continue to provide protection. Which secure design
principle is being applied? [Scenario-Based]
A. Fail Secure
B. Defense in Depth [CORRECT]
C. Complete Mediation
D. Open Design
Correct Answer: B
Rationale: Defense in Depth is the principle of implementing multiple layers of independent security controls
so that the failure of one control does not compromise the entire security posture. Each layer provides
additional protection, creating a comprehensive defense strategy. Fail Secure ensures that a system defaults to
a secure state when a failure occurs. Complete Mediation requires that every access request be checked against
the access control mechanism. Open Design states that the security of a system should not depend on keeping its
design secret.
Page 2
