Page 1 of 124
WGU D488 Final Exam Cybersecurity Architecture &
Engineering EXAM QUESTIONS AND CORRECT VERIFIED
SOLUTIONS LATEST UPDATE THIS YEAR – JUST RELEASED
WGU D488 Final Exam: Cybersecurity Architecture & Engineering
10-Line Exam Coverage in Points Form
1. Core Security Architecture – Flaws exist across three primary categories: People,
Process, and Technology . Security architecture integrates these elements to create a
comprehensive defense posture .
2. Cloud Service Models – Software as a Service (SaaS) provides the least administrative
responsibility for customers; Infrastructure as a Service (IaaS) offers storage like block
storage for VM disks; Platform as a Service (PaaS) supports application deployment
without managing underlying infrastructure .
3. Access Control Models – Mandatory Access Control (MAC) is used in government
environments with security labels (Top Secret, Confidential); Attribute-Based Access
Control (ABAC) grants permissions based on user attributes like location and
department; Role-Based Access Control (RBAC) assigns based on job function; Least
Privilege ensures users have minimum access needed for their roles .
4. Risk Management Lifecycle – Four phases in order: Identify (first step), Assess (evaluate
likelihood/impact), Control (implement mitigations), Review (periodically re-evaluate) .
Risk acceptance occurs when vulnerabilities are outside organizational resources; risk
transference is assigning risk to third parties (e.g., insurance policies) .
5. Security Monitoring & Detection – SIEM (Security Information and Event Management)
collects, correlates, and analyzes logs to detect unusual user behaviors and generate
alerts ; Signature-based detection validates inbound threats against a database of known
attack patterns ; Web Application Firewall (WAF) blocks SQL injection attacks .
6. Network Security Controls – Reverse proxies cache static content and add protection
layers; VLANs isolate networks at Layer 2 (e.g., isolating finance from other
departments); DNSSEC digitally signs DNS responses to prevent DNS spoofing and cache
poisoning; Firewall rules block known malicious IP addresses .
7. Identity & Access Management – Multi-Factor Authentication (MFA) uses multiple
factors (password, memorable word, PIN); Privileged Access Management (PAM) isolates
privileged account use and requires requests for mission-critical services; Identity
Federation enables users to use Active Directory credentials across on-premises and
cloud platforms ; Password Auditing compares existing passwords against known weak
passwords/dictionary words .
, Page 2 of 124
8. Cryptography & Data Protection – Output Feedback (OFB) mode turns a block cipher
into a synchronous stream cipher; S/MIME provides non-repudiation for emails using
digital signatures; Copyrights protect software intellectual property; Anonymization
protects PHI data from inadvertent sharing by researchers .
9. Application Security – Regression testing ensures changes don't introduce new defects;
Code signing ensures application builds are trusted by devices; Race conditions occur
when multiple processes execute simultaneously and outcome depends on timing (e.g.,
payment alteration attacks); SQL injection detection involves monitoring for unexpected
symbols and characters in queries .
10. Disaster Recovery & Business Continuity – Warm sites provide partially equipped
facilities for faster recovery than cold sites; DR planners prioritize mission-critical
systems for operational impact; Vendor viability assessment evaluates whether a vendor
will remain in business; Risk register is the most recognized output of risk management
programs .
250 MCQs with Rationales
1. A security consultant is conducting a security assessment and needs to communicate
reasons that flaws may exist. What are the three primary categories in which these flaws
exist?
A) Communication, Documentation, Training
B) People, Process, Technology
C) Hardware, Software, Firmware
D) Design, Implementation, Maintenance
Answer: B
Rationale: According to WGU D488 materials, security flaws exist across three primary
categories: People, Process, and Technology. Understanding these categories helps security
professionals identify vulnerabilities and communicate risks effectively to stakeholders .
, Page 3 of 124
2. A small business is migrating to the cloud but wants as little administration responsibility as
possible. Which cloud service model best suits their needs?
A) Infrastructure as a Service (IaaS)
B) Platform as a Service (PaaS)
C) Software as a Service (SaaS)
D) Disaster Recovery as a Service (DRaaS)
Answer: C
Rationale: SaaS provides the least administrative responsibility because the provider manages
the entire application stack. The customer only needs to use the application without managing
servers, operating systems, or patches .
3. A disaster recovery planner needs to focus prioritization efforts around operational impact.
Which system should receive the highest priority?
A) Demilitarized Zone systems
B) External-facing systems
C) Systems with critical vulnerabilities
D) Mission-critical systems
Answer: D
Rationale: Mission-critical systems have the highest operational impact if unavailable. Disaster
recovery prioritization should focus on systems essential for business operations .
4. Which type of network should be scanned to monitor threats against an organization's
data, credentials, and brand reputation on networks not accessible via search engines?
, Page 4 of 124
A) Wireless fidelity networks
B) Intranet
C) Deep web
D) SCADA networks
Answer: C
Rationale: The deep web consists of content not indexed by search engines and can harbor
threats to organizational data, credentials, and brand reputation. Monitoring the deep web
helps detect potential breaches and threat actor activity .
5. Which security technique should be used to detect weak passwords that may match
common dictionary words?
A) Password spraying
B) Password auditing
C) Password guessing
D) Password history review
Answer: B
Rationale: Password auditing compares existing passwords against known weak passwords and
dictionary words to identify vulnerable credentials. This is a proactive measure to strengthen
authentication security .
6. An organization wants users to provide a password, memorable word, and PIN. What
authentication method should be implemented?
A) Single-factor authentication
WGU D488 Final Exam Cybersecurity Architecture &
Engineering EXAM QUESTIONS AND CORRECT VERIFIED
SOLUTIONS LATEST UPDATE THIS YEAR – JUST RELEASED
WGU D488 Final Exam: Cybersecurity Architecture & Engineering
10-Line Exam Coverage in Points Form
1. Core Security Architecture – Flaws exist across three primary categories: People,
Process, and Technology . Security architecture integrates these elements to create a
comprehensive defense posture .
2. Cloud Service Models – Software as a Service (SaaS) provides the least administrative
responsibility for customers; Infrastructure as a Service (IaaS) offers storage like block
storage for VM disks; Platform as a Service (PaaS) supports application deployment
without managing underlying infrastructure .
3. Access Control Models – Mandatory Access Control (MAC) is used in government
environments with security labels (Top Secret, Confidential); Attribute-Based Access
Control (ABAC) grants permissions based on user attributes like location and
department; Role-Based Access Control (RBAC) assigns based on job function; Least
Privilege ensures users have minimum access needed for their roles .
4. Risk Management Lifecycle – Four phases in order: Identify (first step), Assess (evaluate
likelihood/impact), Control (implement mitigations), Review (periodically re-evaluate) .
Risk acceptance occurs when vulnerabilities are outside organizational resources; risk
transference is assigning risk to third parties (e.g., insurance policies) .
5. Security Monitoring & Detection – SIEM (Security Information and Event Management)
collects, correlates, and analyzes logs to detect unusual user behaviors and generate
alerts ; Signature-based detection validates inbound threats against a database of known
attack patterns ; Web Application Firewall (WAF) blocks SQL injection attacks .
6. Network Security Controls – Reverse proxies cache static content and add protection
layers; VLANs isolate networks at Layer 2 (e.g., isolating finance from other
departments); DNSSEC digitally signs DNS responses to prevent DNS spoofing and cache
poisoning; Firewall rules block known malicious IP addresses .
7. Identity & Access Management – Multi-Factor Authentication (MFA) uses multiple
factors (password, memorable word, PIN); Privileged Access Management (PAM) isolates
privileged account use and requires requests for mission-critical services; Identity
Federation enables users to use Active Directory credentials across on-premises and
cloud platforms ; Password Auditing compares existing passwords against known weak
passwords/dictionary words .
, Page 2 of 124
8. Cryptography & Data Protection – Output Feedback (OFB) mode turns a block cipher
into a synchronous stream cipher; S/MIME provides non-repudiation for emails using
digital signatures; Copyrights protect software intellectual property; Anonymization
protects PHI data from inadvertent sharing by researchers .
9. Application Security – Regression testing ensures changes don't introduce new defects;
Code signing ensures application builds are trusted by devices; Race conditions occur
when multiple processes execute simultaneously and outcome depends on timing (e.g.,
payment alteration attacks); SQL injection detection involves monitoring for unexpected
symbols and characters in queries .
10. Disaster Recovery & Business Continuity – Warm sites provide partially equipped
facilities for faster recovery than cold sites; DR planners prioritize mission-critical
systems for operational impact; Vendor viability assessment evaluates whether a vendor
will remain in business; Risk register is the most recognized output of risk management
programs .
250 MCQs with Rationales
1. A security consultant is conducting a security assessment and needs to communicate
reasons that flaws may exist. What are the three primary categories in which these flaws
exist?
A) Communication, Documentation, Training
B) People, Process, Technology
C) Hardware, Software, Firmware
D) Design, Implementation, Maintenance
Answer: B
Rationale: According to WGU D488 materials, security flaws exist across three primary
categories: People, Process, and Technology. Understanding these categories helps security
professionals identify vulnerabilities and communicate risks effectively to stakeholders .
, Page 3 of 124
2. A small business is migrating to the cloud but wants as little administration responsibility as
possible. Which cloud service model best suits their needs?
A) Infrastructure as a Service (IaaS)
B) Platform as a Service (PaaS)
C) Software as a Service (SaaS)
D) Disaster Recovery as a Service (DRaaS)
Answer: C
Rationale: SaaS provides the least administrative responsibility because the provider manages
the entire application stack. The customer only needs to use the application without managing
servers, operating systems, or patches .
3. A disaster recovery planner needs to focus prioritization efforts around operational impact.
Which system should receive the highest priority?
A) Demilitarized Zone systems
B) External-facing systems
C) Systems with critical vulnerabilities
D) Mission-critical systems
Answer: D
Rationale: Mission-critical systems have the highest operational impact if unavailable. Disaster
recovery prioritization should focus on systems essential for business operations .
4. Which type of network should be scanned to monitor threats against an organization's
data, credentials, and brand reputation on networks not accessible via search engines?
, Page 4 of 124
A) Wireless fidelity networks
B) Intranet
C) Deep web
D) SCADA networks
Answer: C
Rationale: The deep web consists of content not indexed by search engines and can harbor
threats to organizational data, credentials, and brand reputation. Monitoring the deep web
helps detect potential breaches and threat actor activity .
5. Which security technique should be used to detect weak passwords that may match
common dictionary words?
A) Password spraying
B) Password auditing
C) Password guessing
D) Password history review
Answer: B
Rationale: Password auditing compares existing passwords against known weak passwords and
dictionary words to identify vulnerable credentials. This is a proactive measure to strengthen
authentication security .
6. An organization wants users to provide a password, memorable word, and PIN. What
authentication method should be implemented?
A) Single-factor authentication
