WGU D488 FINAL EXAM TEST BANK (2027) Cybersecurity
Architecture & Engineering - Verified Q&A with Rationales -
A+ Graded
1. A security team notices traffic coming from a country where the
organization does not have any business operations. What could this
indicate?
A) High call volume
B) Odd network traffic
C) Geographic anomalies
D) Unauthorized changes
Correct Answer: C) Geographic anomalies
Rationale: Geographic anomalies refer to unexpected traffic patterns
originating from locations where the organization has no legitimate
presence, often signaling reconnaissance, policy violations, or potential
compromise .
2. A network technician needs to block several known malicious IP
addresses. Which type of rule should be created?
A) Signature rules
B) Firewall rules
C) Behavior rules
D) Data loss prevention (DLP) rules
,Correct Answer: B) Firewall rules
Rationale: Firewalls operate by enforcing rules that control incoming and
outgoing network traffic. Blocking traffic from specific malicious IP addresses
is a direct use of firewall functionality .
3. Which security technology automatically encrypts data as it is
written to a storage device?
A) Hardware Security Module (HSM)
B) Self-encrypting drives
C) Two-factor authentication
D) Measured boot
Correct Answer: B) Self-encrypting drives
Rationale: Self-encrypting drives (SEDs) have built-in hardware-based
encryption that automatically encrypts data as it is written to the disk and
decrypts it as it is read, protecting data at rest .
4. Which cryptographic protocol should be used to secure data
transmission in a new application?
A) PPTP with 3DES
B) SSL with DES
C) TLS with AES
D) HTTPS with RSA
Correct Answer: C) TLS with AES
,Rationale: TLS is the modern, secure successor to SSL and is the standard
protocol for encrypting data in transit. AES is a strong, widely adopted
symmetric encryption algorithm for protecting sensitive data .
5. Which emerging technology has the potential to significantly
impact current encryption methods?
A) Blockchain
B) Artificial Intelligence
C) Quantum Computing
D) Internet of Things (IoT)
Correct Answer: C) Quantum Computing
Rationale: Quantum computing has the potential to significantly impact the
security of current encryption methods by making it possible to quickly solve
difficult mathematical problems that underpin many cryptographic
algorithms .
6. How does Output Feedback (OFB) mode operate in cryptography?
A) It uses the previous ciphertext for encryption
B) It turns a block cipher into a synchronous stream cipher
C) It requires padding of the plaintext
D) It does not allow for error propagation
Correct Answer: B) It turns a block cipher into a synchronous stream
cipher
Rationale: Output Feedback (OFB) mode operates by turning a block cipher
into a synchronous stream cipher. It generates keystream blocks independent
of plaintext and ciphertext .
, 7. Which technology should an organization deploy to detect and
respond to advanced persistent threats (APTs)?
A) Antivirus tools
B) Hardware Security Module (HSM)
C) Two-factor authentication
D) Endpoint Detection and Response (EDR)
Correct Answer: D) Endpoint Detection and Response (EDR)
Rationale: EDR solutions go beyond traditional antivirus by continuously
monitoring endpoint activities to detect suspicious behavior indicative of
advanced threats like APTs, providing investigation and automated response
capabilities .
8. A company deployed a web application on a server and has received
SQL injection attacks. Which solution should block these attacks?
A) VPN
B) SIEM
C) Web Application Firewall (WAF)
D) SSH
Correct Answer: C) Web Application Firewall (WAF)
Rationale: A WAF is specifically designed to protect web applications by
filtering and monitoring HTTP traffic between a web application and the
internet. It can block SQL injection attacks and other web-based threats .
Architecture & Engineering - Verified Q&A with Rationales -
A+ Graded
1. A security team notices traffic coming from a country where the
organization does not have any business operations. What could this
indicate?
A) High call volume
B) Odd network traffic
C) Geographic anomalies
D) Unauthorized changes
Correct Answer: C) Geographic anomalies
Rationale: Geographic anomalies refer to unexpected traffic patterns
originating from locations where the organization has no legitimate
presence, often signaling reconnaissance, policy violations, or potential
compromise .
2. A network technician needs to block several known malicious IP
addresses. Which type of rule should be created?
A) Signature rules
B) Firewall rules
C) Behavior rules
D) Data loss prevention (DLP) rules
,Correct Answer: B) Firewall rules
Rationale: Firewalls operate by enforcing rules that control incoming and
outgoing network traffic. Blocking traffic from specific malicious IP addresses
is a direct use of firewall functionality .
3. Which security technology automatically encrypts data as it is
written to a storage device?
A) Hardware Security Module (HSM)
B) Self-encrypting drives
C) Two-factor authentication
D) Measured boot
Correct Answer: B) Self-encrypting drives
Rationale: Self-encrypting drives (SEDs) have built-in hardware-based
encryption that automatically encrypts data as it is written to the disk and
decrypts it as it is read, protecting data at rest .
4. Which cryptographic protocol should be used to secure data
transmission in a new application?
A) PPTP with 3DES
B) SSL with DES
C) TLS with AES
D) HTTPS with RSA
Correct Answer: C) TLS with AES
,Rationale: TLS is the modern, secure successor to SSL and is the standard
protocol for encrypting data in transit. AES is a strong, widely adopted
symmetric encryption algorithm for protecting sensitive data .
5. Which emerging technology has the potential to significantly
impact current encryption methods?
A) Blockchain
B) Artificial Intelligence
C) Quantum Computing
D) Internet of Things (IoT)
Correct Answer: C) Quantum Computing
Rationale: Quantum computing has the potential to significantly impact the
security of current encryption methods by making it possible to quickly solve
difficult mathematical problems that underpin many cryptographic
algorithms .
6. How does Output Feedback (OFB) mode operate in cryptography?
A) It uses the previous ciphertext for encryption
B) It turns a block cipher into a synchronous stream cipher
C) It requires padding of the plaintext
D) It does not allow for error propagation
Correct Answer: B) It turns a block cipher into a synchronous stream
cipher
Rationale: Output Feedback (OFB) mode operates by turning a block cipher
into a synchronous stream cipher. It generates keystream blocks independent
of plaintext and ciphertext .
, 7. Which technology should an organization deploy to detect and
respond to advanced persistent threats (APTs)?
A) Antivirus tools
B) Hardware Security Module (HSM)
C) Two-factor authentication
D) Endpoint Detection and Response (EDR)
Correct Answer: D) Endpoint Detection and Response (EDR)
Rationale: EDR solutions go beyond traditional antivirus by continuously
monitoring endpoint activities to detect suspicious behavior indicative of
advanced threats like APTs, providing investigation and automated response
capabilities .
8. A company deployed a web application on a server and has received
SQL injection attacks. Which solution should block these attacks?
A) VPN
B) SIEM
C) Web Application Firewall (WAF)
D) SSH
Correct Answer: C) Web Application Firewall (WAF)
Rationale: A WAF is specifically designed to protect web applications by
filtering and monitoring HTTP traffic between a web application and the
internet. It can block SQL injection attacks and other web-based threats .
