WGU D488 FINAL EXAM TEST BANK (2027)
Cybersecurity Architecture & Engineering | Verified
Q&A with Rationales | A+ Graded
SECTION 1: NETWORK & APPLICATION SECURITY
1. An organization recently suffered a data leak and needs to implement a print
blocking mechanism for documents on a corporate file share. Which solution
should be used?
A) Virtual Desktop Infrastructure (VDI)
B) Remote Desktop Protocol (RDP)
C) Digital Rights Management (DRM)
D) Watermarking
Correct Answer: C) Digital Rights Management (DRM)
Rationale: DRM technologies can implement print blocking controls, restricting the ability
to print sensitive documents and preventing data leakage .
2. A security team has been tasked with performing regular vulnerability scans for
a cloud-based infrastructure. How should these vulnerability scans be conducted
when implementing zero trust security?
A) Manually
B) Annually
C) Automatically
D) As needed
Correct Answer: C) Automatically
,Rationale: In a zero trust architecture, vulnerability scans should be automated and
continuous to ensure ongoing assessment and immediate detection of security weaknesses
in cloud infrastructure .
3. A healthcare company must prevent researchers from inadvertently sharing PHI
data. What is the best solution?
A) Encryption
B) Metadata
C) Anonymization
D) Obfuscation
Correct Answer: C) Anonymization
Rationale: Anonymization removes or de-identifies personal identifiers from medical
records, making it impossible to trace data back to specific individuals. This is the most
effective way to prevent inadvertent PHI sharing while allowing research use .
4. What should be implemented to mitigate the risk of stolen credentials and
isolate privileged account use?
A) Identity and Access Management (IAM)
B) Password policies
C) Privileged Access Management (PAM)
D) Password complexity
Correct Answer: C) Privileged Access Management (PAM)
Rationale: PAM solutions specifically manage and secure privileged accounts, isolating
their use, requiring approval for access, and monitoring activities to mitigate the risk of
credential theft .
,5. Which access control model should be used when end users need different
features based on their location and department?
A) Kerberos
B) Mandatory Access Control (MAC)
C) Attribute-Based Access Control (ABAC)
D) Privileged Access Management (PAM)
Correct Answer: C) Attribute-Based Access Control (ABAC)
Rationale: ABAC grants access based on attributes of the user, resource, and environment.
This allows fine-grained access decisions based on location and department, making it
ideal for dynamic authorization requirements .
6. A team of developers is building a new corporate web application. The security
team requires authentication through two separate channels. Which method
should be included?
A) Single Sign-On (SSO)
B) Multi-Factor Authentication (MFA)
C) Biometric authentication
D) Challenge-Handshake Authentication Protocol (CHAP)
Correct Answer: B) Multi-Factor Authentication (MFA)
Rationale: MFA requires users to provide two or more verification factors from independent
categories of credentials, such as something they know (password) and something they
have (mobile device). This ensures authentication through two separate channels .
7. A financial institution must comply with PCI DSS and uses various software
programs to manage payment card data. Which control ensures software
integrity?
A) Code signing
B) Code scanning
, C) Versioning
D) Regression testing
Correct Answer: A) Code signing
Rationale: Code signing verifies the authenticity and integrity of software, ensuring that
payment card data management programs have not been tampered with. This is critical
for PCI DSS compliance .
8. A security team enabled public access to a web application and has received SQL
injection attacks. Which solution should be deployed?
A) VPN
B) SIEM
C) Web Application Firewall (WAF)
D) SSH
Correct Answer: C) Web Application Firewall (WAF)
Rationale: A WAF is specifically designed to protect web applications by filtering and
monitoring HTTP traffic, blocking SQL injection attacks and other web-based threats .
9. External contractors are using personal laptops to access the corporate network.
How can the organization prevent unapproved devices from connecting?
A) Implementing a DMZ
B) Installing a hardware security module
C) Implementing port security
D) Deploying a software firewall
Correct Answer: C) Implementing port security
Rationale: Port security restricts which devices can connect to a switch port based on MAC
addresses, effectively preventing unapproved devices from accessing the network .
Cybersecurity Architecture & Engineering | Verified
Q&A with Rationales | A+ Graded
SECTION 1: NETWORK & APPLICATION SECURITY
1. An organization recently suffered a data leak and needs to implement a print
blocking mechanism for documents on a corporate file share. Which solution
should be used?
A) Virtual Desktop Infrastructure (VDI)
B) Remote Desktop Protocol (RDP)
C) Digital Rights Management (DRM)
D) Watermarking
Correct Answer: C) Digital Rights Management (DRM)
Rationale: DRM technologies can implement print blocking controls, restricting the ability
to print sensitive documents and preventing data leakage .
2. A security team has been tasked with performing regular vulnerability scans for
a cloud-based infrastructure. How should these vulnerability scans be conducted
when implementing zero trust security?
A) Manually
B) Annually
C) Automatically
D) As needed
Correct Answer: C) Automatically
,Rationale: In a zero trust architecture, vulnerability scans should be automated and
continuous to ensure ongoing assessment and immediate detection of security weaknesses
in cloud infrastructure .
3. A healthcare company must prevent researchers from inadvertently sharing PHI
data. What is the best solution?
A) Encryption
B) Metadata
C) Anonymization
D) Obfuscation
Correct Answer: C) Anonymization
Rationale: Anonymization removes or de-identifies personal identifiers from medical
records, making it impossible to trace data back to specific individuals. This is the most
effective way to prevent inadvertent PHI sharing while allowing research use .
4. What should be implemented to mitigate the risk of stolen credentials and
isolate privileged account use?
A) Identity and Access Management (IAM)
B) Password policies
C) Privileged Access Management (PAM)
D) Password complexity
Correct Answer: C) Privileged Access Management (PAM)
Rationale: PAM solutions specifically manage and secure privileged accounts, isolating
their use, requiring approval for access, and monitoring activities to mitigate the risk of
credential theft .
,5. Which access control model should be used when end users need different
features based on their location and department?
A) Kerberos
B) Mandatory Access Control (MAC)
C) Attribute-Based Access Control (ABAC)
D) Privileged Access Management (PAM)
Correct Answer: C) Attribute-Based Access Control (ABAC)
Rationale: ABAC grants access based on attributes of the user, resource, and environment.
This allows fine-grained access decisions based on location and department, making it
ideal for dynamic authorization requirements .
6. A team of developers is building a new corporate web application. The security
team requires authentication through two separate channels. Which method
should be included?
A) Single Sign-On (SSO)
B) Multi-Factor Authentication (MFA)
C) Biometric authentication
D) Challenge-Handshake Authentication Protocol (CHAP)
Correct Answer: B) Multi-Factor Authentication (MFA)
Rationale: MFA requires users to provide two or more verification factors from independent
categories of credentials, such as something they know (password) and something they
have (mobile device). This ensures authentication through two separate channels .
7. A financial institution must comply with PCI DSS and uses various software
programs to manage payment card data. Which control ensures software
integrity?
A) Code signing
B) Code scanning
, C) Versioning
D) Regression testing
Correct Answer: A) Code signing
Rationale: Code signing verifies the authenticity and integrity of software, ensuring that
payment card data management programs have not been tampered with. This is critical
for PCI DSS compliance .
8. A security team enabled public access to a web application and has received SQL
injection attacks. Which solution should be deployed?
A) VPN
B) SIEM
C) Web Application Firewall (WAF)
D) SSH
Correct Answer: C) Web Application Firewall (WAF)
Rationale: A WAF is specifically designed to protect web applications by filtering and
monitoring HTTP traffic, blocking SQL injection attacks and other web-based threats .
9. External contractors are using personal laptops to access the corporate network.
How can the organization prevent unapproved devices from connecting?
A) Implementing a DMZ
B) Installing a hardware security module
C) Implementing port security
D) Deploying a software firewall
Correct Answer: C) Implementing port security
Rationale: Port security restricts which devices can connect to a switch port based on MAC
addresses, effectively preventing unapproved devices from accessing the network .
