WGU D488 Cybersecurity Architecture &
Engineering – OA Exam Test Bank & Study
Questions
Document 1: WGU D488 Cybersecurity
Architecture & Engineering – OA Exam Test
Bank & Study Questions
Instructions: This practice exam contains 150 questions designed to assess your knowledge of
cybersecurity architecture and engineering. Choose the best answer for each question. Answers are
in bold and rationales are in italic.
1. Which of the following is the PRIMARY goal of a security architecture framework?
A) To ensure 100% prevention of all cyberattacks.
B) To provide a structured approach for aligning security with business strategy.
C) To reduce the total cost of ownership for IT infrastructure.
D) To comply with all international data privacy laws.
Answer: B
Rationale: The primary goal of a security architecture framework is to provide a systematic and
structured approach to align security controls, policies, and technologies with the organization's overall
business goals and risk appetite. While compliance and cost reduction are secondary benefits, the core
purpose is strategic alignment and risk management. (A) is impossible, (C) is a potential outcome, and
(D) is a subset of compliance, not the primary goal.
2. In the context of the SABSA framework, which layer focuses on the "Who" and "Why" of security?
A) Business View
B) Architect's View
C) Builder's View
D) Operational View
Answer: A
Rationale: The SABSA framework consists of six layers. The Business View (Contextual layer) addresses
the business requirements, answering questions like "Why" security is needed and "Who" is involved. The
Architect's View (Conceptual layer) answers "What" and "Where". The Builder's View (Logical layer)
answers "When" and "Who". The Operational View (Physical layer) answers "How".
,3. What is the primary benefit of implementing a Zero Trust architecture?
A) It simplifies network management by eliminating the perimeter.
B) It minimizes the lateral movement of threats within the network.
C) It reduces the need for multi-factor authentication.
D) It allows for unrestricted access from trusted internal networks.
Answer: B
Rationale: Zero Trust operates on the principle of "never trust, always verify." By enforcing strict access
controls and micro-segmentation, it significantly reduces the ability of a threat actor to move laterally
across the network after gaining initial access. (A) is incorrect because Zero Trust often makes network
management more complex. (C) is wrong as it increases the need for strong identity verification like
MFA. (D) is the opposite of Zero Trust principles.
4. Which security control is MOST effective in mitigating SQL injection attacks?
A) Network Intrusion Detection System (NIDS)
B) Web Application Firewall (WAF)
C) Endpoint Detection and Response (EDR)
D) Data Loss Prevention (DLP)
Answer: B
Rationale: A Web Application Firewall (WAF) is specifically designed to monitor and filter HTTP traffic to
and from a web application. It can detect and block malicious SQL queries, making it the most effective
direct control. NIDS can detect some attacks but is less specialized. EDR and DLP are not designed for this
specific application-layer threat.
5. The CIA Triad is a foundational model for information security. Which of the following scenarios
represents a breach of "Integrity"?
A) A server is taken offline by a Distributed Denial-of-Service (DDoS) attack.
B) An employee's password is stolen and used to log in to the system.
C) A database administrator accidentally modifies a customer's account balance to a negative value.
D) A laptop containing unencrypted personnel files is stolen from a car.
Answer: C
Rationale: Integrity refers to the accuracy and completeness of data. An unauthorized or accidental
modification of data, such as changing a customer's account balance, violates integrity. (A) is a breach of
Availability, (B) is a breach of Confidentiality, and (D) is primarily a breach of Confidentiality and
potentially Availability.
6. In a Defense-in-Depth strategy, which layer is designed to protect the data itself, regardless of
where it resides?
A) Physical Security
B) Network Security
C) Endpoint Security
D) Data Security
,Answer: D
Rationale: Data Security is the final layer of defense and focuses on protecting the data at rest and in
transit. This includes encryption, tokenization, and data loss prevention. While other layers provide
perimeter, network, and host protection, the data layer ensures that even if other controls fail, the data
itself remains protected.
7. Which type of cryptographic algorithm is considered asymmetric?
A) AES
B) RSA
C) 3DES
D) ChaCha20
Answer: B
Rationale: RSA (Rivest-Shamir-Adleman) is an asymmetric (public-key) algorithm, meaning it uses a pair
of keys: a public key for encryption and a private key for decryption. AES, 3DES, and ChaCha20 are all
symmetric (shared-key) algorithms.
8. What is the primary purpose of a Certificate Authority (CA) in PKI?
A) To encrypt all network traffic within an organization.
B) To issue and digitally sign digital certificates that bind public keys to identities.
C) To store all private keys for users in a secure database.
D) To provide a fast hashing algorithm for data integrity.
Answer: B
Rationale: The primary role of a Certificate Authority (CA) is to establish trust by vouching for the identity
of an entity (user, device, etc.) and binding their public key to their identity through a digitally signed
certificate. The CA does not generally store private keys (C) or handle encryption for all traffic (A).
Hashing is a different function (D).
9. A Security Information and Event Management (SIEM) system is PRIMARILY used for:
A) Blocking malicious traffic at the network perimeter.
B) Providing real-time analysis of security alerts generated by applications and network hardware.
C) Encrypting data at rest in the organization's databases.
D) Automatically patching operating system vulnerabilities.
Answer: B
Rationale: A SIEM system aggregates and correlates log data from various sources (firewalls, IDS,
servers, applications) to provide a centralized view of an organization's security posture, enabling real-
time analysis of alerts and incident response. (A), (C), and (D) are functions of other specific security
tools.
10. Which of the following is a critical component of an Incident Response (IR) plan during the
"Containment" phase?
, A) Identifying the root cause of the incident.
B) Restoring systems from clean backups.
C) Isolating affected systems to prevent further spread.
D) Informing law enforcement and public relations.
Answer: C
Rationale: The primary goal of the Containment phase is to limit the scope and impact of the incident.
Isolating affected systems (e.g., disconnecting them from the network) is the most critical action to
prevent further spread of the threat. Root cause analysis (A) happens during the Eradication phase;
restoration (B) is part of Recovery; and communication (D) spans the process but is not the primary goal
of containment.
11. What is the main difference between a vulnerability and a threat?
A) A vulnerability is a weakness, while a threat is an adversary.
B) A vulnerability is a potential exploit, while a threat is the likelihood of an exploit.
C) A vulnerability is a weakness that can be exploited by a threat.
D) There is no significant difference; the terms are synonymous.
Answer: C
Rationale: A vulnerability is a flaw or weakness in a system's design, implementation, or operation. A
threat is any potential danger that could exploit that vulnerability. The relationship is that a threat
exploits a vulnerability to cause harm. (A) is partially correct in that a threat can be an adversary, but the
key relationship is that a vulnerability is a weakness, and a threat is a force that can exploit it.
12. Which of the following is an example of "Phishing"?
A) An email that appears to be from a legitimate bank, asking the recipient to click a link and enter their
login credentials.
B) A malicious software that encrypts files and demands a ransom for their release.
C) A hacker who directly asks a helpdesk employee to reset a password over the phone.
D) An attacker who installs a keylogger on a public computer.
Answer: A
Rationale: Phishing is a social engineering attack where an attacker masquerades as a trustworthy entity
via email or other communication to trick victims into revealing sensitive information. (B) is ransomware,
(C) is vishing (or a variation of pretexting), and (D) is a hardware-based attack or physical security
breach.
13. In the context of secure software development, what does "Shift Left" mean?
A) Moving security testing to the right, closer to production.
B) Integrating security practices earlier in the Software Development Life Cycle (SDLC).
C) Focusing only on fixing critical vulnerabilities after the code is deployed.
D) Shifting the responsibility of security entirely to the operations team.
Answer: B
Rationale: "Shift Left" in DevOps and DevSecOps means moving security tasks, such as code analysis,
Engineering – OA Exam Test Bank & Study
Questions
Document 1: WGU D488 Cybersecurity
Architecture & Engineering – OA Exam Test
Bank & Study Questions
Instructions: This practice exam contains 150 questions designed to assess your knowledge of
cybersecurity architecture and engineering. Choose the best answer for each question. Answers are
in bold and rationales are in italic.
1. Which of the following is the PRIMARY goal of a security architecture framework?
A) To ensure 100% prevention of all cyberattacks.
B) To provide a structured approach for aligning security with business strategy.
C) To reduce the total cost of ownership for IT infrastructure.
D) To comply with all international data privacy laws.
Answer: B
Rationale: The primary goal of a security architecture framework is to provide a systematic and
structured approach to align security controls, policies, and technologies with the organization's overall
business goals and risk appetite. While compliance and cost reduction are secondary benefits, the core
purpose is strategic alignment and risk management. (A) is impossible, (C) is a potential outcome, and
(D) is a subset of compliance, not the primary goal.
2. In the context of the SABSA framework, which layer focuses on the "Who" and "Why" of security?
A) Business View
B) Architect's View
C) Builder's View
D) Operational View
Answer: A
Rationale: The SABSA framework consists of six layers. The Business View (Contextual layer) addresses
the business requirements, answering questions like "Why" security is needed and "Who" is involved. The
Architect's View (Conceptual layer) answers "What" and "Where". The Builder's View (Logical layer)
answers "When" and "Who". The Operational View (Physical layer) answers "How".
,3. What is the primary benefit of implementing a Zero Trust architecture?
A) It simplifies network management by eliminating the perimeter.
B) It minimizes the lateral movement of threats within the network.
C) It reduces the need for multi-factor authentication.
D) It allows for unrestricted access from trusted internal networks.
Answer: B
Rationale: Zero Trust operates on the principle of "never trust, always verify." By enforcing strict access
controls and micro-segmentation, it significantly reduces the ability of a threat actor to move laterally
across the network after gaining initial access. (A) is incorrect because Zero Trust often makes network
management more complex. (C) is wrong as it increases the need for strong identity verification like
MFA. (D) is the opposite of Zero Trust principles.
4. Which security control is MOST effective in mitigating SQL injection attacks?
A) Network Intrusion Detection System (NIDS)
B) Web Application Firewall (WAF)
C) Endpoint Detection and Response (EDR)
D) Data Loss Prevention (DLP)
Answer: B
Rationale: A Web Application Firewall (WAF) is specifically designed to monitor and filter HTTP traffic to
and from a web application. It can detect and block malicious SQL queries, making it the most effective
direct control. NIDS can detect some attacks but is less specialized. EDR and DLP are not designed for this
specific application-layer threat.
5. The CIA Triad is a foundational model for information security. Which of the following scenarios
represents a breach of "Integrity"?
A) A server is taken offline by a Distributed Denial-of-Service (DDoS) attack.
B) An employee's password is stolen and used to log in to the system.
C) A database administrator accidentally modifies a customer's account balance to a negative value.
D) A laptop containing unencrypted personnel files is stolen from a car.
Answer: C
Rationale: Integrity refers to the accuracy and completeness of data. An unauthorized or accidental
modification of data, such as changing a customer's account balance, violates integrity. (A) is a breach of
Availability, (B) is a breach of Confidentiality, and (D) is primarily a breach of Confidentiality and
potentially Availability.
6. In a Defense-in-Depth strategy, which layer is designed to protect the data itself, regardless of
where it resides?
A) Physical Security
B) Network Security
C) Endpoint Security
D) Data Security
,Answer: D
Rationale: Data Security is the final layer of defense and focuses on protecting the data at rest and in
transit. This includes encryption, tokenization, and data loss prevention. While other layers provide
perimeter, network, and host protection, the data layer ensures that even if other controls fail, the data
itself remains protected.
7. Which type of cryptographic algorithm is considered asymmetric?
A) AES
B) RSA
C) 3DES
D) ChaCha20
Answer: B
Rationale: RSA (Rivest-Shamir-Adleman) is an asymmetric (public-key) algorithm, meaning it uses a pair
of keys: a public key for encryption and a private key for decryption. AES, 3DES, and ChaCha20 are all
symmetric (shared-key) algorithms.
8. What is the primary purpose of a Certificate Authority (CA) in PKI?
A) To encrypt all network traffic within an organization.
B) To issue and digitally sign digital certificates that bind public keys to identities.
C) To store all private keys for users in a secure database.
D) To provide a fast hashing algorithm for data integrity.
Answer: B
Rationale: The primary role of a Certificate Authority (CA) is to establish trust by vouching for the identity
of an entity (user, device, etc.) and binding their public key to their identity through a digitally signed
certificate. The CA does not generally store private keys (C) or handle encryption for all traffic (A).
Hashing is a different function (D).
9. A Security Information and Event Management (SIEM) system is PRIMARILY used for:
A) Blocking malicious traffic at the network perimeter.
B) Providing real-time analysis of security alerts generated by applications and network hardware.
C) Encrypting data at rest in the organization's databases.
D) Automatically patching operating system vulnerabilities.
Answer: B
Rationale: A SIEM system aggregates and correlates log data from various sources (firewalls, IDS,
servers, applications) to provide a centralized view of an organization's security posture, enabling real-
time analysis of alerts and incident response. (A), (C), and (D) are functions of other specific security
tools.
10. Which of the following is a critical component of an Incident Response (IR) plan during the
"Containment" phase?
, A) Identifying the root cause of the incident.
B) Restoring systems from clean backups.
C) Isolating affected systems to prevent further spread.
D) Informing law enforcement and public relations.
Answer: C
Rationale: The primary goal of the Containment phase is to limit the scope and impact of the incident.
Isolating affected systems (e.g., disconnecting them from the network) is the most critical action to
prevent further spread of the threat. Root cause analysis (A) happens during the Eradication phase;
restoration (B) is part of Recovery; and communication (D) spans the process but is not the primary goal
of containment.
11. What is the main difference between a vulnerability and a threat?
A) A vulnerability is a weakness, while a threat is an adversary.
B) A vulnerability is a potential exploit, while a threat is the likelihood of an exploit.
C) A vulnerability is a weakness that can be exploited by a threat.
D) There is no significant difference; the terms are synonymous.
Answer: C
Rationale: A vulnerability is a flaw or weakness in a system's design, implementation, or operation. A
threat is any potential danger that could exploit that vulnerability. The relationship is that a threat
exploits a vulnerability to cause harm. (A) is partially correct in that a threat can be an adversary, but the
key relationship is that a vulnerability is a weakness, and a threat is a force that can exploit it.
12. Which of the following is an example of "Phishing"?
A) An email that appears to be from a legitimate bank, asking the recipient to click a link and enter their
login credentials.
B) A malicious software that encrypts files and demands a ransom for their release.
C) A hacker who directly asks a helpdesk employee to reset a password over the phone.
D) An attacker who installs a keylogger on a public computer.
Answer: A
Rationale: Phishing is a social engineering attack where an attacker masquerades as a trustworthy entity
via email or other communication to trick victims into revealing sensitive information. (B) is ransomware,
(C) is vishing (or a variation of pretexting), and (D) is a hardware-based attack or physical security
breach.
13. In the context of secure software development, what does "Shift Left" mean?
A) Moving security testing to the right, closer to production.
B) Integrating security practices earlier in the Software Development Life Cycle (SDLC).
C) Focusing only on fixing critical vulnerabilities after the code is deployed.
D) Shifting the responsibility of security entirely to the operations team.
Answer: B
Rationale: "Shift Left" in DevOps and DevSecOps means moving security tasks, such as code analysis,
