WGU D488 Cybersecurity Architecture & Engineering
OA EXAM LATEST 230 QUESTIONS AND 100% Verified
ANSWERS JUST RELEASED
A developer is looking for a solution that will help to detect flaws, bugs, errors, and defects in
applications running in production environments. What is this method called?
A - Continuous integration
B - Continuous delivery
C - Continuous deployment
D - Continuous monitoring - answer>>D - Continuous monitoring
Continuous monitoring mechanisms detect flaws, bugs, errors, and defects. Although often used for
security, developers could use it to look for issues while generating new code.
Continuous integration (CI) is the principle that developers should commit and test updates often,
every day, or sometimes even more frequently.
Continuous delivery is about testing all of the infrastructures that support the application, including
networking, database functionality, client software, and security.
Continuous deployment is the separate process of making changes to the production environment
using configuration management platforms to support the newly updated application.
A security engineer is looking at various methods to use identity proofing. Which of the following are
identity proofing methods? Select 3 answers.
A - Diameter
B - 2FA
C - Out-of-band mechanisms
,D - TOTP - answer>>B, C & D; 2FA, Out of band mechanisms, & TOTP
Two-Factor Authentication (2FA) is an identity proofing method that combines either an ownership-
based smart card or biometric identifier with something a user knows, such as a password or PIN.
Out-of-band mechanisms are another identity proofing method that generates a software token on a
server and sends it to a resource assumed to be safely controlled by the user.
The Time-based One-time Password (TOTP) is a proofing method that is a refinement of the Hashed
Message Authentication Code One-time Password (HOTP).
Diameter improves upon Remote Authentication Dial-in User Service (RADIUS) by strengthening some
of its weaknesses. Diameter is a stronger protocol in many ways but is not as widespread in its
implementation due to the lack of products using it.
A vulnerability manager is onboarding developers to the vulnerability management program and wants
to focus on integrating security from the very beginning. What is the first step of the software
development lifecycle the manager should integrate?
A - Requirements gathering
B - Solution design
C - Test formulation
D - Code testing - answer>>A - Requirements gathering
Planning and requirements gathering is the first step of the software development life cycle (SDLC). It
identifies policy, standard, and regulatory requirements that govern how software operates.
Solution design is the second step incorporating secure coding patterns and best practice guidance
from organizations, such as the Open Web Application Security Project (OWASP).
Formulation of tests and coding is the third step. This step uses Static Code Analysis tools, software
linters, and automated unit tests to identify vulnerabilities while writing code.
,Testing and evaluation of code is the fourth step. It uses Dynamic Code Analysis tools to evaluate
application security and test for the existence of known vulnerabilities.
The vulnerability management lead has been enhancing the security posture year after year and is
looking at security coding standards. What are some sources the management lead could recommend
to the organization? (Select all that apply.)
A - NIST 800-53
B - Carnegie-Mellon Software Engineering Institute
C - OWASP
D - COBIT - answer>>B & C; Carnegie-Mellon Software Engineering Institute & OWASP
A site developer has recently experienced issues with Cross-Site Script Inclusion attacks. Which of the
following response headers could the site developer use to mitigate this attack?
A - COOP
B - COEP
C - CORP
D - XFO - answer>>C - CORP
A developer can set security options in the response header returned by a web server to a client. Such
is the case with Cross-Origin-Resource-Policy (CORP), which protects against speculative execution
(such as Spectre) and Cross-Site Script (XSS) Inclusion attacks.
Cross-Origin-Opener-Policy (COOP) changes the way documents load to prevent cross-origin attacks.
The CORP header would help to prevent XSS Inclusion attacks.
Cross-Origin-Embedder-Policy (COEP) limits documents from loading from origins other than the
source. This would not help against XSS Inclusion attacks.
X-Frame-Options (XFO) defines whether content can be displayed using frames to defend against
clickjacking attacks. This also would not help against XSS Inclusion attacks.
, A security manager is looking for a solution that contains software to monitor and report the day-to-
day operations of an enterprise and the status of various resources and activities. Which of the
following should the security manager consider?
A - CMDB
B - CMS
C - ERP
D - CRM - answer>>C - ERP (Enterprise Resource Planning)
An enterprise resource planning (ERP) solution contains software that monitors the daily operations of
an enterprise. The ERP also reports on the status of various resources and activities.
A configuration management database (CMDB) is a database that contains information on assets and
components within an enterprise's IT environment.
A content management system (CMS) enables non-technical users with the ability to create, manage
and modify content on a website.
A customer relationship management (CRM) system is a platform that enables a company to more
easily work with customers, that includes the data about the customers.
A storage administrator is evaluating various components of the data life cycle to refine processes and
enhance security. What are the first three steps of the data life cycle? (Select all that apply.)
A - Create
B - Store
C - Archive
D - Use - answer>>A, B, & D; Create, Store, and Use
A data center administrator for a small manufacturer has heard a lot of information about 3D printers
and is considering whether one would be useful. What are some of the benefits? Select 3 answers.
OA EXAM LATEST 230 QUESTIONS AND 100% Verified
ANSWERS JUST RELEASED
A developer is looking for a solution that will help to detect flaws, bugs, errors, and defects in
applications running in production environments. What is this method called?
A - Continuous integration
B - Continuous delivery
C - Continuous deployment
D - Continuous monitoring - answer>>D - Continuous monitoring
Continuous monitoring mechanisms detect flaws, bugs, errors, and defects. Although often used for
security, developers could use it to look for issues while generating new code.
Continuous integration (CI) is the principle that developers should commit and test updates often,
every day, or sometimes even more frequently.
Continuous delivery is about testing all of the infrastructures that support the application, including
networking, database functionality, client software, and security.
Continuous deployment is the separate process of making changes to the production environment
using configuration management platforms to support the newly updated application.
A security engineer is looking at various methods to use identity proofing. Which of the following are
identity proofing methods? Select 3 answers.
A - Diameter
B - 2FA
C - Out-of-band mechanisms
,D - TOTP - answer>>B, C & D; 2FA, Out of band mechanisms, & TOTP
Two-Factor Authentication (2FA) is an identity proofing method that combines either an ownership-
based smart card or biometric identifier with something a user knows, such as a password or PIN.
Out-of-band mechanisms are another identity proofing method that generates a software token on a
server and sends it to a resource assumed to be safely controlled by the user.
The Time-based One-time Password (TOTP) is a proofing method that is a refinement of the Hashed
Message Authentication Code One-time Password (HOTP).
Diameter improves upon Remote Authentication Dial-in User Service (RADIUS) by strengthening some
of its weaknesses. Diameter is a stronger protocol in many ways but is not as widespread in its
implementation due to the lack of products using it.
A vulnerability manager is onboarding developers to the vulnerability management program and wants
to focus on integrating security from the very beginning. What is the first step of the software
development lifecycle the manager should integrate?
A - Requirements gathering
B - Solution design
C - Test formulation
D - Code testing - answer>>A - Requirements gathering
Planning and requirements gathering is the first step of the software development life cycle (SDLC). It
identifies policy, standard, and regulatory requirements that govern how software operates.
Solution design is the second step incorporating secure coding patterns and best practice guidance
from organizations, such as the Open Web Application Security Project (OWASP).
Formulation of tests and coding is the third step. This step uses Static Code Analysis tools, software
linters, and automated unit tests to identify vulnerabilities while writing code.
,Testing and evaluation of code is the fourth step. It uses Dynamic Code Analysis tools to evaluate
application security and test for the existence of known vulnerabilities.
The vulnerability management lead has been enhancing the security posture year after year and is
looking at security coding standards. What are some sources the management lead could recommend
to the organization? (Select all that apply.)
A - NIST 800-53
B - Carnegie-Mellon Software Engineering Institute
C - OWASP
D - COBIT - answer>>B & C; Carnegie-Mellon Software Engineering Institute & OWASP
A site developer has recently experienced issues with Cross-Site Script Inclusion attacks. Which of the
following response headers could the site developer use to mitigate this attack?
A - COOP
B - COEP
C - CORP
D - XFO - answer>>C - CORP
A developer can set security options in the response header returned by a web server to a client. Such
is the case with Cross-Origin-Resource-Policy (CORP), which protects against speculative execution
(such as Spectre) and Cross-Site Script (XSS) Inclusion attacks.
Cross-Origin-Opener-Policy (COOP) changes the way documents load to prevent cross-origin attacks.
The CORP header would help to prevent XSS Inclusion attacks.
Cross-Origin-Embedder-Policy (COEP) limits documents from loading from origins other than the
source. This would not help against XSS Inclusion attacks.
X-Frame-Options (XFO) defines whether content can be displayed using frames to defend against
clickjacking attacks. This also would not help against XSS Inclusion attacks.
, A security manager is looking for a solution that contains software to monitor and report the day-to-
day operations of an enterprise and the status of various resources and activities. Which of the
following should the security manager consider?
A - CMDB
B - CMS
C - ERP
D - CRM - answer>>C - ERP (Enterprise Resource Planning)
An enterprise resource planning (ERP) solution contains software that monitors the daily operations of
an enterprise. The ERP also reports on the status of various resources and activities.
A configuration management database (CMDB) is a database that contains information on assets and
components within an enterprise's IT environment.
A content management system (CMS) enables non-technical users with the ability to create, manage
and modify content on a website.
A customer relationship management (CRM) system is a platform that enables a company to more
easily work with customers, that includes the data about the customers.
A storage administrator is evaluating various components of the data life cycle to refine processes and
enhance security. What are the first three steps of the data life cycle? (Select all that apply.)
A - Create
B - Store
C - Archive
D - Use - answer>>A, B, & D; Create, Store, and Use
A data center administrator for a small manufacturer has heard a lot of information about 3D printers
and is considering whether one would be useful. What are some of the benefits? Select 3 answers.
