W G U D 4 8 8 C E R T I F I C A T I O N P R E PA R A T I O N
Cybersecurity
Architecture and
Engineering
OA Test Bank 4
70 comprehensive practice questions with correct answers and detailed
rationales covering all WGU D488 course competencies, aligned with
industry certification standards including CISSP, CISM, CCSP, and Security+.
70 Questions with Rationales
8 Sections: Frameworks, Network Security, IAM, Cloud Security,
Application Security, SecOps, Risk Management, Emerging Tech
Cognitive Levels: 25% Recall | 50% Application | 25% Analysis
Format: 75% Scenario-Based | 25% Direct Recall
T E S T B A N K 4 - O B J E C T I V E A S S E S S M E N T P R E PA R AT I O N
,WGU D488 OA Test Bank 4 - Cybersecurity Architecture and Engineering 70 Questions with Correct Answers and Rationales
Section 1: Security Architecture Fundamentals and Frameworks (Zero Trust,
Defense in Depth, NIST CSF, ISO 27001, and TOGAF)
Q1: A financial services organization is transitioning from a perimeter-based security model to Zero Trust
architecture as defined in NIST SP 800-207. The security architect must identify the foundational principle that
distinguishes Zero Trust from traditional castle-and-moat models. Which statement best describes the core tenet
of Zero Trust architecture?
A. All traffic from within the corporate network is inherently trusted and should be allowed to pass through
internal firewalls without additional authentication checks.
B. Trust is never assumed and must be continuously verified for every user, device, and transaction
regardless of network location, using least-privilege access and real-time security posture evaluation.
[CORRECT]
C. Network segmentation is achieved exclusively through VLANs and access control lists applied at the
network perimeter to isolate trusted internal zones from untrusted external networks.
D. Zero Trust architecture eliminates the need for identity and access management systems by relying
entirely on network-level encryption and IP-based allowlisting.
Correct Answer: B
Rationale: NIST SP 800-207 defines Zero Trust core principle as "never trust, always verify." Every access request must
be authenticated, authorized, and encrypted regardless of origin. Option A describes the traditional perimeter model that
Zero Trust rejects. Option C describes VLAN-based segmentation, a network-level control that does not encompass
continuous verification. Option D is fundamentally incorrect because Zero Trust relies heavily on robust IAM systems.
Q2: A security architect is designing a defense-in-depth strategy for a healthcare organization that processes
electronic protected health information (ePHI). The architect needs to implement multiple overlapping security
controls so that if one control fails, others still provide protection. Which combination best exemplifies the
defense-in-depth principle applied to protecting ePHI at rest?
A. Implementing a single strong AES-256 encryption layer on all database storage volumes without
additional access controls, relying entirely on the encryption key management system.
B. Deploying network-based intrusion prevention at the perimeter only, allowing all internal traffic to flow
unmonitored between application servers and database servers.
C. Applying AES-256 encryption at the database level, implementing role-based access control with least
privilege, enabling database activity monitoring with alerting, and storing encryption keys in a hardware
security module (HSM). [CORRECT]
D. Configuring a web application firewall at the network edge and depending on application layer input
validation as the sole protection mechanism for ePHI data.
Correct Answer: C
Rationale: Defense-in-depth requires multiple independent, overlapping controls across different layers. Option C
implements encryption (data layer), RBAC (access control layer), database monitoring (detection layer), and HSM key
management (key protection layer). Option A relies on a single control. Option B only protects the perimeter. Option D has
only two controls at the edge with no data-level protection.
Page 1
, WGU D488 OA Test Bank 4 - Cybersecurity Architecture and Engineering 70 Questions with Correct Answers and Rationales
Q3: A manufacturing company is implementing the NIST Cybersecurity Framework (CSF) to improve its
security posture. During a gap analysis, the company discovers it has strong perimeter defenses and endpoint
protection but lacks formal incident response procedures and has not tested its backup restoration capabilities.
Which NIST CSF function is most deficient?
A. Identify, because the organization has not identified all its critical assets and business processes
adequately.
B. Protect, because the perimeter defenses and endpoint protection are insufficient for modern threat
landscapes.
C. Detect, because the organization cannot detect incidents without formal monitoring and alerting
procedures.
D. Respond and Recover, because the absence of incident response procedures and untested backup
restoration directly map to these two core functions. [CORRECT]
Correct Answer: D
Rationale: The NIST CSF Respond function includes incident response procedures, while Recover includes testing backups
and restoration. The scenario explicitly states the organization lacks incident response (Respond) and has not tested backup
restoration (Recover). Identify (A) relates to asset management, not the gap described. Protect (B) is incorrect because
protective controls are strong. Detect (C) is not the primary deficiency since detection may exist through existing tools.
Q4: An organization pursuing ISO/IEC 27001 certification must establish an Information Security Management
System (ISMS). During the Plan phase of the PDCA cycle, the organization must perform risk assessment and
treatment planning. Which action is mandatory during the ISO 27001 risk treatment process?
A. Eliminate all identified risks by implementing the most expensive security controls available regardless
of cost-benefit analysis.
B. Select appropriate risk treatment options (mitigate, transfer, accept, or avoid) for each risk based on
acceptance criteria and apply Annex A controls as applicable. [CORRECT]
C. Transfer all information security risks to a third-party cyber insurance provider to achieve certification
without implementing internal controls.
D. Accept all risks that cannot be eliminated and document only high-risk items without implementing
compensating controls.
Correct Answer: B
Rationale: ISO/IEC 27001 Clause 8.3 requires selecting risk treatment options: mitigate, transfer, accept, or avoid.
Controls from Annex A are applied based on risk assessment. Option A is wrong because ISO 27001 requires cost-benefit
analysis. Option C is wrong because transferring all risks is neither feasible nor compliant. Option D is wrong because
accepting risks requires formal approval and compensating controls may still be needed.
Q5: A large enterprise is using TOGAF to develop its enterprise architecture, including security architecture. The
security architect needs to ensure cybersecurity requirements are integrated into the Architecture Development
Method (ADM). In which phase should security architecture considerations first be formally addressed?
A. Phase A: Architecture Vision, where security requirements are identified as part of stakeholder concerns
and architecture work is scoped including security constraints. [CORRECT]
Page 2
Cybersecurity
Architecture and
Engineering
OA Test Bank 4
70 comprehensive practice questions with correct answers and detailed
rationales covering all WGU D488 course competencies, aligned with
industry certification standards including CISSP, CISM, CCSP, and Security+.
70 Questions with Rationales
8 Sections: Frameworks, Network Security, IAM, Cloud Security,
Application Security, SecOps, Risk Management, Emerging Tech
Cognitive Levels: 25% Recall | 50% Application | 25% Analysis
Format: 75% Scenario-Based | 25% Direct Recall
T E S T B A N K 4 - O B J E C T I V E A S S E S S M E N T P R E PA R AT I O N
,WGU D488 OA Test Bank 4 - Cybersecurity Architecture and Engineering 70 Questions with Correct Answers and Rationales
Section 1: Security Architecture Fundamentals and Frameworks (Zero Trust,
Defense in Depth, NIST CSF, ISO 27001, and TOGAF)
Q1: A financial services organization is transitioning from a perimeter-based security model to Zero Trust
architecture as defined in NIST SP 800-207. The security architect must identify the foundational principle that
distinguishes Zero Trust from traditional castle-and-moat models. Which statement best describes the core tenet
of Zero Trust architecture?
A. All traffic from within the corporate network is inherently trusted and should be allowed to pass through
internal firewalls without additional authentication checks.
B. Trust is never assumed and must be continuously verified for every user, device, and transaction
regardless of network location, using least-privilege access and real-time security posture evaluation.
[CORRECT]
C. Network segmentation is achieved exclusively through VLANs and access control lists applied at the
network perimeter to isolate trusted internal zones from untrusted external networks.
D. Zero Trust architecture eliminates the need for identity and access management systems by relying
entirely on network-level encryption and IP-based allowlisting.
Correct Answer: B
Rationale: NIST SP 800-207 defines Zero Trust core principle as "never trust, always verify." Every access request must
be authenticated, authorized, and encrypted regardless of origin. Option A describes the traditional perimeter model that
Zero Trust rejects. Option C describes VLAN-based segmentation, a network-level control that does not encompass
continuous verification. Option D is fundamentally incorrect because Zero Trust relies heavily on robust IAM systems.
Q2: A security architect is designing a defense-in-depth strategy for a healthcare organization that processes
electronic protected health information (ePHI). The architect needs to implement multiple overlapping security
controls so that if one control fails, others still provide protection. Which combination best exemplifies the
defense-in-depth principle applied to protecting ePHI at rest?
A. Implementing a single strong AES-256 encryption layer on all database storage volumes without
additional access controls, relying entirely on the encryption key management system.
B. Deploying network-based intrusion prevention at the perimeter only, allowing all internal traffic to flow
unmonitored between application servers and database servers.
C. Applying AES-256 encryption at the database level, implementing role-based access control with least
privilege, enabling database activity monitoring with alerting, and storing encryption keys in a hardware
security module (HSM). [CORRECT]
D. Configuring a web application firewall at the network edge and depending on application layer input
validation as the sole protection mechanism for ePHI data.
Correct Answer: C
Rationale: Defense-in-depth requires multiple independent, overlapping controls across different layers. Option C
implements encryption (data layer), RBAC (access control layer), database monitoring (detection layer), and HSM key
management (key protection layer). Option A relies on a single control. Option B only protects the perimeter. Option D has
only two controls at the edge with no data-level protection.
Page 1
, WGU D488 OA Test Bank 4 - Cybersecurity Architecture and Engineering 70 Questions with Correct Answers and Rationales
Q3: A manufacturing company is implementing the NIST Cybersecurity Framework (CSF) to improve its
security posture. During a gap analysis, the company discovers it has strong perimeter defenses and endpoint
protection but lacks formal incident response procedures and has not tested its backup restoration capabilities.
Which NIST CSF function is most deficient?
A. Identify, because the organization has not identified all its critical assets and business processes
adequately.
B. Protect, because the perimeter defenses and endpoint protection are insufficient for modern threat
landscapes.
C. Detect, because the organization cannot detect incidents without formal monitoring and alerting
procedures.
D. Respond and Recover, because the absence of incident response procedures and untested backup
restoration directly map to these two core functions. [CORRECT]
Correct Answer: D
Rationale: The NIST CSF Respond function includes incident response procedures, while Recover includes testing backups
and restoration. The scenario explicitly states the organization lacks incident response (Respond) and has not tested backup
restoration (Recover). Identify (A) relates to asset management, not the gap described. Protect (B) is incorrect because
protective controls are strong. Detect (C) is not the primary deficiency since detection may exist through existing tools.
Q4: An organization pursuing ISO/IEC 27001 certification must establish an Information Security Management
System (ISMS). During the Plan phase of the PDCA cycle, the organization must perform risk assessment and
treatment planning. Which action is mandatory during the ISO 27001 risk treatment process?
A. Eliminate all identified risks by implementing the most expensive security controls available regardless
of cost-benefit analysis.
B. Select appropriate risk treatment options (mitigate, transfer, accept, or avoid) for each risk based on
acceptance criteria and apply Annex A controls as applicable. [CORRECT]
C. Transfer all information security risks to a third-party cyber insurance provider to achieve certification
without implementing internal controls.
D. Accept all risks that cannot be eliminated and document only high-risk items without implementing
compensating controls.
Correct Answer: B
Rationale: ISO/IEC 27001 Clause 8.3 requires selecting risk treatment options: mitigate, transfer, accept, or avoid.
Controls from Annex A are applied based on risk assessment. Option A is wrong because ISO 27001 requires cost-benefit
analysis. Option C is wrong because transferring all risks is neither feasible nor compliant. Option D is wrong because
accepting risks requires formal approval and compensating controls may still be needed.
Q5: A large enterprise is using TOGAF to develop its enterprise architecture, including security architecture. The
security architect needs to ensure cybersecurity requirements are integrated into the Architecture Development
Method (ADM). In which phase should security architecture considerations first be formally addressed?
A. Phase A: Architecture Vision, where security requirements are identified as part of stakeholder concerns
and architecture work is scoped including security constraints. [CORRECT]
Page 2
