WGU D488 CYBERSECURITY ARCHITECTURE AND
ENGINEERING ACTUAL EXAM [QUESTION 1- 200] AND
ANSWERS UPDATED 2026/2027| 100% VERIFIED|DETAILED
RATIONALES –PASS GUARANTEED A+ GRADED |INSTANT
DOWNLOAD
INTRODUCTION
WGU D488, Cybersecurity Architecture and Engineering, is a 4-CU graduate-level
cybersecurity course at Western Governors University focused on designing secure enterprise
architecture, assessing cybersecurity readiness, protecting enterprise data, and implementing
security solutions across organizational environments. WGU's 2026 catalog describes the course
as covering software integration, enterprise data-security controls, cloud and virtualization, threat
and vulnerability analysis, and incident response. (Western Governors University)
The course is intended for cybersecurity professionals and graduate students who need to reason
about security at the enterprise-architecture level rather than simply configure individual security
technologies. Relevant professional backgrounds include cybersecurity engineering, security
architecture, network security, systems administration, cloud security, risk management, and
related information-technology disciplines.
D488 develops the ability to translate security requirements into architectural controls, evaluate
competing technical approaches, recognize weaknesses and attack paths, and align technical
implementations with organizational requirements. These skills are valuable because enterprise
security decisions frequently require balancing security, availability, scalability, interoperability,
operational complexity, and business requirements.
Public WGU materials confirm the course's enterprise-security scope, but WGU does not
publicly publish a complete current OA blueprint specifying an exact percentage distribution,
question count, or duration. Therefore, the content-area distribution below is a study-oriented
approximation, not a claim about confidential WGU assessment specifications. Current third-
party preparation material describes the OA as scenario-driven and aligned with advanced
security-practitioner competencies. (WGU Tutors)
Core Domains Tested in WGU D488 Cybersecurity
Architecture and Engineering
Secure Enterprise Architecture and Design
Network Security Architecture and Segmentation
Identity and Access Management
Cloud and Virtualization Security
Data Security and Cryptography
Threat, Vulnerability, and Risk Management
, Secure Systems and Application Engineering
Security Operations, Monitoring, and Incident Response
Governance, Compliance, and Security Frameworks
Resilience, Business Continuity, and Disaster Recovery
CONTENT AREA TABLE
% of Approx. # of
Content Domain Key Topics Covered
Exam Questions
Secure Enterprise Defense in depth, secure design,
25% 50
Architecture & Design architecture patterns, trust boundaries
Risk, Threat & Threat modeling, vulnerability analysis,
15% 30
Vulnerability Management risk treatment, attack surfaces
Identity & Access IAM, RBAC, ABAC, MFA, federation,
10% 20
Management SSO, privileged access
Network Security Segmentation, firewalls, IDS/IPS,
15% 30
Architecture WAF, VPN, NAC, zero trust
Cloud & Virtualization Shared responsibility, cloud controls,
10% 20
Security virtualization, containers
Data Security & Encryption, PKI, certificates, hashing,
10% 20
Cryptography key management, DLP
Secure Systems & Secure SDLC, DevSecOps, testing,
5% 10
Application Engineering hardening, application controls
Security Operations & SIEM, monitoring, detection, response,
5% 10
Incident Response logging, recovery
Governance, Compliance Policies, standards, compliance, BCP,
5% 10
& Resilience DR, recovery objectives
Note: This table is a preparation framework rather than an official WGU weighting. WGU's
public catalog describes D488's subject matter but does not publish a detailed OA percentage
blueprint. (Western Governors University)
QUESTIONS 1-200
Q1: A multinational organization is redesigning its enterprise network after discovering
that a compromise of a workstation allowed an attacker to reach several critical
application servers. The organization wants a design that limits lateral movement even if
an endpoint is compromised. Which architectural approach BEST satisfies this
requirement?
A) Increase perimeter firewall throughput
B) Implement network segmentation with tightly controlled inter-segment access
,C) Deploy a larger VPN concentrator
D) Replace endpoint antivirus with host-based encryption
Correct Answer: B
Rationale: Network segmentation limits the ability of an attacker who compromises one security
zone to move directly into unrelated systems. Proper segmentation establishes trust boundaries
and restricts traffic between zones according to business requirements. A perimeter firewall
alone primarily protects the boundary and does not sufficiently restrict east-west movement after
an attacker gains internal access. A VPN concentrator addresses remote connectivity rather than
lateral movement, while encryption protects data confidentiality but does not control network
reachability.
Q2: A security architect must protect a public-facing web application from SQL injection
while allowing legitimate HTTP and HTTPS traffic to reach the application. Which control
should be placed closest to the application traffic path?
A) Network intrusion detection system
B) Web application firewall
C) Security information and event management system
D) Network address translation gateway
Correct Answer: B
Rationale: A WAF operates at the application layer and can inspect HTTP/HTTPS requests for
patterns associated with attacks such as SQL injection. An IDS can detect suspicious activity but
generally does not provide the same application-layer blocking function. A SIEM aggregates and
analyzes security events rather than directly filtering application requests. NAT changes address
translation and does not inherently detect SQL injection.
Q3: A company permits employees to access applications from unmanaged devices. The
security architect wants access decisions to consider user identity, device posture,
application sensitivity, location, and time of access. Which access-control model BEST
supports this requirement?
A) Role-based access control
B) Discretionary access control
C) Attribute-based access control
D) Mandatory access control
Correct Answer: C
Rationale: ABAC evaluates attributes associated with subjects, objects, actions, and
environmental conditions, making it suitable for context-sensitive authorization. RBAC primarily
bases decisions on assigned roles and may not naturally incorporate dynamic contextual factors.
DAC generally gives resource owners discretion over access, while MAC relies on centrally
enforced security classifications and clearances rather than a broad collection of contextual
attributes.
, Q4: An organization wants employees to authenticate once and then access several
independent enterprise applications without repeatedly entering credentials. Which
technology BEST addresses this requirement?
A) Network access control
B) Single sign-on
C) Data loss prevention
D) Port security
Correct Answer: B
Rationale: SSO allows a user to authenticate through a trusted identity provider and then access
multiple authorized applications without separately authenticating to each application. NAC
controls network admission, DLP protects sensitive information from unauthorized transfer, and
port security controls device connectivity at network ports.
Q5: A security architect is evaluating a new application that will process confidential
customer information. The development team argues that encryption alone eliminates the
need for application-layer security controls. Which response is MOST appropriate?
A) Encryption eliminates the need for input validation
B) Encryption prevents all unauthorized application actions
C) Encryption protects data confidentiality but does not eliminate application
vulnerabilities
D) Encryption makes authentication unnecessary
Correct Answer: C
Rationale: Encryption can protect confidentiality of data at rest or in transit, but it does not
inherently prevent SQL injection, authorization flaws, insecure business logic, malicious input,
or compromised authenticated accounts. Input validation, authentication, authorization, secure
coding, and monitoring remain necessary. Encryption is therefore one layer of a defense-in-
depth architecture rather than a complete application-security strategy.
Q6: A security team identifies a critical vulnerability in an internet-facing server. The
vendor has released a patch, but applying it immediately could disrupt a revenue-
generating application. What should the architect recommend FIRST?
A) Ignore the vulnerability until the next maintenance window
B) Permanently disable the application
C) Assess risk and implement compensating controls while planning remediation
D) Remove all firewall protections temporarily
Correct Answer: C
Rationale: Security architecture requires balancing risk, availability, and operational
requirements. When immediate patching is not feasible, compensating controls such as
restrictive firewall rules, segmentation, virtual patching, or enhanced monitoring can reduce
exposure while a controlled remediation plan is developed. Ignoring the vulnerability leaves
ENGINEERING ACTUAL EXAM [QUESTION 1- 200] AND
ANSWERS UPDATED 2026/2027| 100% VERIFIED|DETAILED
RATIONALES –PASS GUARANTEED A+ GRADED |INSTANT
DOWNLOAD
INTRODUCTION
WGU D488, Cybersecurity Architecture and Engineering, is a 4-CU graduate-level
cybersecurity course at Western Governors University focused on designing secure enterprise
architecture, assessing cybersecurity readiness, protecting enterprise data, and implementing
security solutions across organizational environments. WGU's 2026 catalog describes the course
as covering software integration, enterprise data-security controls, cloud and virtualization, threat
and vulnerability analysis, and incident response. (Western Governors University)
The course is intended for cybersecurity professionals and graduate students who need to reason
about security at the enterprise-architecture level rather than simply configure individual security
technologies. Relevant professional backgrounds include cybersecurity engineering, security
architecture, network security, systems administration, cloud security, risk management, and
related information-technology disciplines.
D488 develops the ability to translate security requirements into architectural controls, evaluate
competing technical approaches, recognize weaknesses and attack paths, and align technical
implementations with organizational requirements. These skills are valuable because enterprise
security decisions frequently require balancing security, availability, scalability, interoperability,
operational complexity, and business requirements.
Public WGU materials confirm the course's enterprise-security scope, but WGU does not
publicly publish a complete current OA blueprint specifying an exact percentage distribution,
question count, or duration. Therefore, the content-area distribution below is a study-oriented
approximation, not a claim about confidential WGU assessment specifications. Current third-
party preparation material describes the OA as scenario-driven and aligned with advanced
security-practitioner competencies. (WGU Tutors)
Core Domains Tested in WGU D488 Cybersecurity
Architecture and Engineering
Secure Enterprise Architecture and Design
Network Security Architecture and Segmentation
Identity and Access Management
Cloud and Virtualization Security
Data Security and Cryptography
Threat, Vulnerability, and Risk Management
, Secure Systems and Application Engineering
Security Operations, Monitoring, and Incident Response
Governance, Compliance, and Security Frameworks
Resilience, Business Continuity, and Disaster Recovery
CONTENT AREA TABLE
% of Approx. # of
Content Domain Key Topics Covered
Exam Questions
Secure Enterprise Defense in depth, secure design,
25% 50
Architecture & Design architecture patterns, trust boundaries
Risk, Threat & Threat modeling, vulnerability analysis,
15% 30
Vulnerability Management risk treatment, attack surfaces
Identity & Access IAM, RBAC, ABAC, MFA, federation,
10% 20
Management SSO, privileged access
Network Security Segmentation, firewalls, IDS/IPS,
15% 30
Architecture WAF, VPN, NAC, zero trust
Cloud & Virtualization Shared responsibility, cloud controls,
10% 20
Security virtualization, containers
Data Security & Encryption, PKI, certificates, hashing,
10% 20
Cryptography key management, DLP
Secure Systems & Secure SDLC, DevSecOps, testing,
5% 10
Application Engineering hardening, application controls
Security Operations & SIEM, monitoring, detection, response,
5% 10
Incident Response logging, recovery
Governance, Compliance Policies, standards, compliance, BCP,
5% 10
& Resilience DR, recovery objectives
Note: This table is a preparation framework rather than an official WGU weighting. WGU's
public catalog describes D488's subject matter but does not publish a detailed OA percentage
blueprint. (Western Governors University)
QUESTIONS 1-200
Q1: A multinational organization is redesigning its enterprise network after discovering
that a compromise of a workstation allowed an attacker to reach several critical
application servers. The organization wants a design that limits lateral movement even if
an endpoint is compromised. Which architectural approach BEST satisfies this
requirement?
A) Increase perimeter firewall throughput
B) Implement network segmentation with tightly controlled inter-segment access
,C) Deploy a larger VPN concentrator
D) Replace endpoint antivirus with host-based encryption
Correct Answer: B
Rationale: Network segmentation limits the ability of an attacker who compromises one security
zone to move directly into unrelated systems. Proper segmentation establishes trust boundaries
and restricts traffic between zones according to business requirements. A perimeter firewall
alone primarily protects the boundary and does not sufficiently restrict east-west movement after
an attacker gains internal access. A VPN concentrator addresses remote connectivity rather than
lateral movement, while encryption protects data confidentiality but does not control network
reachability.
Q2: A security architect must protect a public-facing web application from SQL injection
while allowing legitimate HTTP and HTTPS traffic to reach the application. Which control
should be placed closest to the application traffic path?
A) Network intrusion detection system
B) Web application firewall
C) Security information and event management system
D) Network address translation gateway
Correct Answer: B
Rationale: A WAF operates at the application layer and can inspect HTTP/HTTPS requests for
patterns associated with attacks such as SQL injection. An IDS can detect suspicious activity but
generally does not provide the same application-layer blocking function. A SIEM aggregates and
analyzes security events rather than directly filtering application requests. NAT changes address
translation and does not inherently detect SQL injection.
Q3: A company permits employees to access applications from unmanaged devices. The
security architect wants access decisions to consider user identity, device posture,
application sensitivity, location, and time of access. Which access-control model BEST
supports this requirement?
A) Role-based access control
B) Discretionary access control
C) Attribute-based access control
D) Mandatory access control
Correct Answer: C
Rationale: ABAC evaluates attributes associated with subjects, objects, actions, and
environmental conditions, making it suitable for context-sensitive authorization. RBAC primarily
bases decisions on assigned roles and may not naturally incorporate dynamic contextual factors.
DAC generally gives resource owners discretion over access, while MAC relies on centrally
enforced security classifications and clearances rather than a broad collection of contextual
attributes.
, Q4: An organization wants employees to authenticate once and then access several
independent enterprise applications without repeatedly entering credentials. Which
technology BEST addresses this requirement?
A) Network access control
B) Single sign-on
C) Data loss prevention
D) Port security
Correct Answer: B
Rationale: SSO allows a user to authenticate through a trusted identity provider and then access
multiple authorized applications without separately authenticating to each application. NAC
controls network admission, DLP protects sensitive information from unauthorized transfer, and
port security controls device connectivity at network ports.
Q5: A security architect is evaluating a new application that will process confidential
customer information. The development team argues that encryption alone eliminates the
need for application-layer security controls. Which response is MOST appropriate?
A) Encryption eliminates the need for input validation
B) Encryption prevents all unauthorized application actions
C) Encryption protects data confidentiality but does not eliminate application
vulnerabilities
D) Encryption makes authentication unnecessary
Correct Answer: C
Rationale: Encryption can protect confidentiality of data at rest or in transit, but it does not
inherently prevent SQL injection, authorization flaws, insecure business logic, malicious input,
or compromised authenticated accounts. Input validation, authentication, authorization, secure
coding, and monitoring remain necessary. Encryption is therefore one layer of a defense-in-
depth architecture rather than a complete application-security strategy.
Q6: A security team identifies a critical vulnerability in an internet-facing server. The
vendor has released a patch, but applying it immediately could disrupt a revenue-
generating application. What should the architect recommend FIRST?
A) Ignore the vulnerability until the next maintenance window
B) Permanently disable the application
C) Assess risk and implement compensating controls while planning remediation
D) Remove all firewall protections temporarily
Correct Answer: C
Rationale: Security architecture requires balancing risk, availability, and operational
requirements. When immediate patching is not feasible, compensating controls such as
restrictive firewall rules, segmentation, virtual patching, or enhanced monitoring can reduce
exposure while a controlled remediation plan is developed. Ignoring the vulnerability leaves
