WGU D329 — NETWORK AND SECURITY – APPLICATIONS | COMPREHENSIVE OBJECTIVE ASSESSMENT | STUDY GUIDE | LATEST UPDATE 2026/2027 | PRACTICE QUESTIONS AND ANSWERS | EXAM REVIEW

WGU D684 | 1

WGU D329 — NETWORK AND SECURITY – APPLICATIONS
| COMPREHENSIVE OBJECTIVE ASSESSMENT | STUDY
GUIDE | LATEST UPDATE 2026/2027 | PRACTICE
QUESTIONS AND ANSWERS | EXAM REVIEW
Table of Contents
1. General Security Concepts and Threat Actors
2. Access Control and Authentication Methods
3. Security for Network Infrastructure
4. Encryption and Cryptography
5. Security for Organizational Operations
6. Security Assessments, Audits, and Risk Management
7. Threats, Vulnerabilities, and Attack Vectors
8. Secure Architecture Design and Zero Trust
9. Incident Response and Monitoring
10. Governance, Risk, and Compliance
11. Application and Cloud Security
12. Emerging Technologies and Security Implications

, WGU D684 | 2

Question 1: Which security principle ensures that data has not been altered or destroyed in an
unauthorized manner?
A. Confidentiality
B. Integrity
C. Availability
D. Non-repudiation

Correct Answer: B. Integrity
Integrity ensures that data remains accurate and unaltered unless modified by authorized
parties. Confidentiality protects data from unauthorized disclosure, availability ensures
timely access, and non-repudiation prevents denial of an action. Integrity is verified through
hashing and digital signatures.

Question 2: A company stores customer credit card data. Which regulation specifically
governs the protection of this data?
A. HIPAA
B. PCI DSS
C. FERPA
D. SOX

Correct Answer: B. PCI DSS
The Payment Card Industry Data Security Standard (PCI DSS) governs the protection of
credit card data. HIPAA covers health information, FERPA covers educational records, and
SOX governs financial reporting for public companies.

Question 3: Which type of threat actor is characterized by long-term, persistent access to a
network with the goal of espionage or data exfiltration?
A. Script kiddie
B. Hacktivist
C. Advanced Persistent Threat (APT)
D. Insider threat

Correct Answer: C. Advanced Persistent Threat (APT)
APTs are well-funded, sophisticated threat actors who maintain long-term, covert access to
networks for espionage, data theft, or disruption. Script kiddies use existing tools, hacktivists
are ideologically motivated, and insiders are trusted individuals who abuse access.

, WGU D684 | 3

Question 4: What is the difference between a vulnerability and a threat?
A. A vulnerability is a potential cause of harm; a threat is a weakness.
B. A vulnerability is a weakness; a threat is any potential cause of harm that exploits the
weakness.
C. They are the same thing.
D. A threat is internal; a vulnerability is external.

Correct Answer: B. A vulnerability is a weakness; a threat is any potential cause of
harm that exploits the weakness.
A vulnerability is a flaw or weakness in a system. A threat is any circumstance or event that
can exploit a vulnerability to cause harm. Risk is the potential for loss when a threat exploits
a vulnerability.

Question 5: Which authentication factor is based on something the user knows?
A. Something you have
B. Something you are
C. Something you know
D. Somewhere you are

Correct Answer: C. Something you know
Authentication factors include something you know (password, PIN), something you have
(token, smart card), something you are (biometrics), and somewhere you are (location). A
password is the classic "something you know" factor.

Question 6: What is the primary purpose of multifactor authentication (MFA)?
A. To make passwords longer
B. To require two or more different types of authentication factors
C. To replace passwords entirely
D. To encrypt network traffic

Correct Answer: B. To require two or more different types of authentication factors
MFA enhances security by requiring credentials from multiple categories (knowledge,
possession, inherence). This makes unauthorized access significantly harder, even if one
factor is compromised. Using two passwords is not MFA; it must be different factor types.

Question 7: In a role-based access control (RBAC) model, permissions are assigned based on:
A. Individual user identity

, WGU D684 | 4

B. The user's role within the organization
C. Data sensitivity labels
D. Time of day

Correct Answer: B. The user's role within the organization
RBAC assigns permissions to roles, and users are assigned to roles. This simplifies
administration and enforces least privilege. It contrasts with discretionary access control
(DAC), where owners set permissions, and mandatory access control (MAC), which uses
labels.

Question 8: Which access control model uses security labels and clearances to determine
access?
A. Discretionary Access Control (DAC)
B. Mandatory Access Control (MAC)
C. Role-Based Access Control (RBAC)
D. Rule-Based Access Control

Correct Answer: B. Mandatory Access Control (MAC)
MAC uses security labels (e.g., Top Secret, Confidential) on objects and clearances on
subjects. Access is granted only when the subject's clearance dominates the object's label.
This model is common in government and military environments.

Question 9: What is the principle of least privilege?
A. Users should have all permissions they might need.
B. Users should have only the minimum permissions necessary to perform their job.
C. Administrators should have no restrictions.
D. All users should have the same permissions.

Correct Answer: B. Users should have only the minimum permissions necessary to
perform their job.
Least privilege limits access rights to the minimum needed for a user to complete their tasks.
This reduces the attack surface and limits the damage from compromised accounts. It is a
fundamental security principle.

Question 10: A firewall that inspects traffic based on the state of the connection (e.g.,
established, related) is called:
A. Packet-filtering firewall