1
WGU C845 VUN1 Information Systems Security
Performance Assessment Tasks 1 2 3 Official
Practice Exam Actual Exam 2026/2027 with
Detailed Rationales | Complete Exam-Style
Questions | Pass Guaranteed – A+ Graded
TABLE OF CONTENTS
Section 1 | Task 1 — Access Control Models & Policy Management | Q1 – Q10
Section 2 | Task 1 — Security Operations & Threat Mitigation | Q11 – Q20
Section 3 | Task 2 — Incident Response Analysis | Q21 – Q32
Section 4 | Task 3 — Evaluating & Defending Data Security | Q33 – Q42
Section 5 | NGN-Style Integrated Case Analysis | Q43 – Q50
Instructions: Choose the single best answer. Pass: 40 in 90 minutes.
══════════════════════════════════════
SECTION 1: TASK 1 — ACCESS CONTROL MODELS & POLICY
MANAGEMENT Q1 – Q10
══════════════════════════════════════
Question 1 of 50
FinSecure Corp is transitioning from a discretionary access control model to role-
based access control (RBAC) to centralize permissions. During the transition, the
security team notices that multiple users in the Marketing department possess write
access to financial databases because they previously belonged to a broad
"Employee" group. Assigning database write access based on a generic
,2
organizational group violates the core RBAC principle that permissions should
map strictly to operational roles.
A. Migrating to RBAC requires inheriting existing discretionary permissions to
prevent business disruption during the transition phase.
B. Implementing temporary privilege escalation bridges the gap between
discretionary and role-based models without compromising security.
C. Mapping permissions to broad organizational groups violates the principle of
least privilege by granting access beyond role requirements. ✓ CORRECT
D. Role-based access control mandates that all users receive baseline read access
across all organizational databases to ensure operational continuity.
Correct Answer: C
Rationale: Under the principle of least privilege, a core component of WGU C845's
RBAC competency, permissions must map strictly to specific job functions rather
than broad organizational attributes. The tempting choice A incorrectly assumes
that legacy misconfigurations should be inherited rather than remediated during a
migration. Always use access control transitions as an opportunity to enforce least
privilege and eliminate historical privilege creep.
Question 2 of 50
A senior accountant at FinSecure Corp requests the ability to both create new
vendor profiles in the procurement system and authorize payments to those
vendors. The IT security architect denies the combined request, citing an
fundamental access control policy designed to prevent a single individual from
controlling all phases of a critical transaction.
A. Implementing dual-control authentication ensures that two separate
administrators must approve the creation of every standard vendor profile.
,3
B. Separation of duties mandates that conflicting transactions are assigned to
distinct individuals to prevent fraud and mitigate conflict of interest risks. ✓
CORRECT
C. The principle of least privilege restricts user capabilities to only the minimum
permissions required to authorize financial transactions.
D. Role-based access control inherently prevents any single user from executing
multi-step processes within enterprise resource planning systems.
Correct Answer: B
Rationale: Separation of duties (SoD) explicitly prevents a single user from
performing multiple steps in a critical business process, thereby mitigating the risk
of internal fraud. The tempting choice C misapplies least privilege, which limits
permission scope but does not inherently address the distribution of conflicting
transactional duties. When evaluating access requests, distinguish between
minimizing permission breadth (least privilege) and segmenting conflicting tasks
(SoD).
Question 3 of 50
The IT operations team at a regional hospital uses a shared "SysAdmin" account to
manage critical server infrastructure, allowing any team member to modify system
configurations without individual accountability. An auditor flags this practice as a
severe misalignment with access control principles, noting it obscures exactly who
performed a specific destructive action.
A. Shared administrative accounts streamline incident response by ensuring
uninterrupted access during critical server outages.
B. Privilege escalation vulnerabilities are mitigated when all administrators
authenticate using identical credentials across the server fleet.
, 4
C. Utilizing unique individual credentials for administrative access ensures non-
repudiation and accurate audit trail attribution for configuration changes. ✓
CORRECT
D. Role-based access control requires the creation of universal administrative
groups to properly enforce system-wide configuration policies.
Correct Answer: C
Rationale: WGU C845 access control policies mandate individual accountability
through unique credentials, ensuring audit logs accurately attribute actions to
specific administrators. The tempting choice A prioritizes operational convenience
over security, ignoring that shared accounts destroy non-repudiation and obstruct
forensic investigations. Eliminate shared generic accounts to maintain clear
accountability and comply with regulatory audit requirements.
Question 4 of 50
During a routine access review, FinSecure Corp discovers that a helpdesk
technician was granted temporary Domain Admin privileges to resolve an Active
Directory replication issue three months ago, but the elevated access was never
revoked. This scenario represents a critical failure in managing elevated
permissions and introduces a severe security risk.
A. Orphaned privileged accounts represent a privilege escalation risk that violates
the requirement for timely revocation of temporary access rights. ✓ CORRECT
B. Persistent administrative access violates separation of duties because the
helpdesk technician can now independently override all security controls.
C. Role-based access control models automatically expire temporary privilege
assignments once the associated service ticket is closed in the tracking system.
D. The principle of least privilege permits persistent administrative access if the
technician initially demonstrated a legitimate operational need.
WGU C845 VUN1 Information Systems Security
Performance Assessment Tasks 1 2 3 Official
Practice Exam Actual Exam 2026/2027 with
Detailed Rationales | Complete Exam-Style
Questions | Pass Guaranteed – A+ Graded
TABLE OF CONTENTS
Section 1 | Task 1 — Access Control Models & Policy Management | Q1 – Q10
Section 2 | Task 1 — Security Operations & Threat Mitigation | Q11 – Q20
Section 3 | Task 2 — Incident Response Analysis | Q21 – Q32
Section 4 | Task 3 — Evaluating & Defending Data Security | Q33 – Q42
Section 5 | NGN-Style Integrated Case Analysis | Q43 – Q50
Instructions: Choose the single best answer. Pass: 40 in 90 minutes.
══════════════════════════════════════
SECTION 1: TASK 1 — ACCESS CONTROL MODELS & POLICY
MANAGEMENT Q1 – Q10
══════════════════════════════════════
Question 1 of 50
FinSecure Corp is transitioning from a discretionary access control model to role-
based access control (RBAC) to centralize permissions. During the transition, the
security team notices that multiple users in the Marketing department possess write
access to financial databases because they previously belonged to a broad
"Employee" group. Assigning database write access based on a generic
,2
organizational group violates the core RBAC principle that permissions should
map strictly to operational roles.
A. Migrating to RBAC requires inheriting existing discretionary permissions to
prevent business disruption during the transition phase.
B. Implementing temporary privilege escalation bridges the gap between
discretionary and role-based models without compromising security.
C. Mapping permissions to broad organizational groups violates the principle of
least privilege by granting access beyond role requirements. ✓ CORRECT
D. Role-based access control mandates that all users receive baseline read access
across all organizational databases to ensure operational continuity.
Correct Answer: C
Rationale: Under the principle of least privilege, a core component of WGU C845's
RBAC competency, permissions must map strictly to specific job functions rather
than broad organizational attributes. The tempting choice A incorrectly assumes
that legacy misconfigurations should be inherited rather than remediated during a
migration. Always use access control transitions as an opportunity to enforce least
privilege and eliminate historical privilege creep.
Question 2 of 50
A senior accountant at FinSecure Corp requests the ability to both create new
vendor profiles in the procurement system and authorize payments to those
vendors. The IT security architect denies the combined request, citing an
fundamental access control policy designed to prevent a single individual from
controlling all phases of a critical transaction.
A. Implementing dual-control authentication ensures that two separate
administrators must approve the creation of every standard vendor profile.
,3
B. Separation of duties mandates that conflicting transactions are assigned to
distinct individuals to prevent fraud and mitigate conflict of interest risks. ✓
CORRECT
C. The principle of least privilege restricts user capabilities to only the minimum
permissions required to authorize financial transactions.
D. Role-based access control inherently prevents any single user from executing
multi-step processes within enterprise resource planning systems.
Correct Answer: B
Rationale: Separation of duties (SoD) explicitly prevents a single user from
performing multiple steps in a critical business process, thereby mitigating the risk
of internal fraud. The tempting choice C misapplies least privilege, which limits
permission scope but does not inherently address the distribution of conflicting
transactional duties. When evaluating access requests, distinguish between
minimizing permission breadth (least privilege) and segmenting conflicting tasks
(SoD).
Question 3 of 50
The IT operations team at a regional hospital uses a shared "SysAdmin" account to
manage critical server infrastructure, allowing any team member to modify system
configurations without individual accountability. An auditor flags this practice as a
severe misalignment with access control principles, noting it obscures exactly who
performed a specific destructive action.
A. Shared administrative accounts streamline incident response by ensuring
uninterrupted access during critical server outages.
B. Privilege escalation vulnerabilities are mitigated when all administrators
authenticate using identical credentials across the server fleet.
, 4
C. Utilizing unique individual credentials for administrative access ensures non-
repudiation and accurate audit trail attribution for configuration changes. ✓
CORRECT
D. Role-based access control requires the creation of universal administrative
groups to properly enforce system-wide configuration policies.
Correct Answer: C
Rationale: WGU C845 access control policies mandate individual accountability
through unique credentials, ensuring audit logs accurately attribute actions to
specific administrators. The tempting choice A prioritizes operational convenience
over security, ignoring that shared accounts destroy non-repudiation and obstruct
forensic investigations. Eliminate shared generic accounts to maintain clear
accountability and comply with regulatory audit requirements.
Question 4 of 50
During a routine access review, FinSecure Corp discovers that a helpdesk
technician was granted temporary Domain Admin privileges to resolve an Active
Directory replication issue three months ago, but the elevated access was never
revoked. This scenario represents a critical failure in managing elevated
permissions and introduces a severe security risk.
A. Orphaned privileged accounts represent a privilege escalation risk that violates
the requirement for timely revocation of temporary access rights. ✓ CORRECT
B. Persistent administrative access violates separation of duties because the
helpdesk technician can now independently override all security controls.
C. Role-based access control models automatically expire temporary privilege
assignments once the associated service ticket is closed in the tracking system.
D. The principle of least privilege permits persistent administrative access if the
technician initially demonstrated a legitimate operational need.
