WGU D488 CYBERSECURITY ARCHITECTURE
AND ENGINEERING FINAL EXAM 2026/2027 |
150 PRACTICE QUESTIONS, ANSWERS &
DETAILED RATIONALES | WESTERN
GOVERNORS UNIVERSITY PREP
WGU D488 Cybersecurity Architecture and Engineering — Practice Exam
Questions 1–150
1. Which principle is most important when designing a secure enterprise architecture?
A. Maximize network connectivity
B. Minimize security controls
C. Apply defense in depth
D. Centralize every system
Answer: C. Defense in depth
Rationale: Defense in depth uses multiple complementary security controls so that failure of
one control does not expose the entire environment.
2. What is the primary objective of a zero-trust architecture?
A. Trust all internal users
B. Eliminate authentication
C. Verify explicitly before granting access
D. Permit unrestricted lateral movement
Answer: C. Verify explicitly before granting access
Rationale: Zero trust assumes that no user, device, or network location should automatically
be trusted.
3. Which security principle limits a user to only the permissions required to perform
assigned duties?
A. Separation of duties
B. Least privilege
C. Availability
D. Federation
Answer: B. Least privilege
,Rationale: Least privilege reduces the potential impact of compromised accounts by
restricting unnecessary permissions.
4. What is the primary purpose of network segmentation?
A. Increase broadcast traffic
B. Reduce security visibility
C. Limit the spread of attacks
D. Eliminate authentication
Answer: C. Limit the spread of attacks
Rationale: Segmentation separates systems into security zones and can restrict unauthorized
lateral movement.
5. Which control is most appropriate for preventing unauthorized inbound traffic from
the internet?
A. Firewall
B. Database index
C. File compression
D. Load balancer only
Answer: A. Firewall
Rationale: Firewalls enforce network traffic rules based on defined criteria such as source,
destination, protocol, and port.
6. Which security architecture component is designed to detect and block malicious
network traffic?
A. IDS
B. IPS
C. DNS resolver
D. DHCP server
Answer: B. IPS
Rationale: An intrusion prevention system can actively block or prevent detected malicious
activity, whereas an IDS primarily detects and alerts.
7. What is the primary function of an intrusion detection system?
A. Detect suspicious activity
B. Encrypt every database
C. Replace authentication
D. Assign IP addresses
Answer: A. Detect suspicious activity
,Rationale: An IDS monitors activity and generates alerts when suspicious or malicious
behavior is detected.
8. Which approach provides security controls at multiple layers of an information
system?
A. Defense in depth
B. Single sign-on
C. Data deduplication
D. Load balancing
Answer: A. Defense in depth
Rationale: Defense in depth places controls at multiple layers, such as physical, network,
application, endpoint, and data layers.
9. Which technology is commonly used to protect web applications from malicious
HTTP requests?
A. WAF
B. DHCP
C. NTP
D. RAID
Answer: A. WAF
Rationale: A Web Application Firewall examines HTTP/HTTPS traffic and can block attacks
such as injection and malicious request patterns.
10. What does secure-by-design mean?
A. Security is added after deployment
B. Security is incorporated throughout system design
C. Security is delegated entirely to users
D. Security applies only to physical devices
Answer: B. Security is incorporated throughout system design
Rationale: Secure-by-design integrates security requirements and controls into the
architecture and development lifecycle from the beginning.
11. Which authentication factor is something the user possesses?
A. Password
B. Fingerprint
C. Hardware security token
D. Security question
Answer: C. Hardware security token
, Rationale: A hardware token is a possession factor, while a password is knowledge and a
fingerprint is inherence.
12. Which authentication method uses two or more different factor categories?
A. Single-factor authentication
B. Multi-factor authentication
C. Anonymous authentication
D. Shared authentication
Answer: B. Multi-factor authentication
Rationale: MFA combines different factor categories such as knowledge, possession, and
inherence.
13. Which security model emphasizes that access should be denied unless explicitly
permitted?
A. Default allow
B. Fail-open
C. Default deny
D. Open trust
Answer: C. Default deny
Rationale: Default deny prevents access unless a specific rule or policy authorizes it.
14. What is the primary security advantage of microsegmentation?
A. It increases unrestricted lateral movement
B. It provides granular isolation between workloads
C. It eliminates the need for authentication
D. It removes firewall requirements
Answer: B. It provides granular isolation between workloads
Rationale: Microsegmentation applies security policies at a granular workload or
application level.
15. Which architectural approach separates public-facing systems from internal
systems?
A. DMZ
B. Flat network
C. Peer-to-peer network
D. Workgroup
Answer: A. DMZ
AND ENGINEERING FINAL EXAM 2026/2027 |
150 PRACTICE QUESTIONS, ANSWERS &
DETAILED RATIONALES | WESTERN
GOVERNORS UNIVERSITY PREP
WGU D488 Cybersecurity Architecture and Engineering — Practice Exam
Questions 1–150
1. Which principle is most important when designing a secure enterprise architecture?
A. Maximize network connectivity
B. Minimize security controls
C. Apply defense in depth
D. Centralize every system
Answer: C. Defense in depth
Rationale: Defense in depth uses multiple complementary security controls so that failure of
one control does not expose the entire environment.
2. What is the primary objective of a zero-trust architecture?
A. Trust all internal users
B. Eliminate authentication
C. Verify explicitly before granting access
D. Permit unrestricted lateral movement
Answer: C. Verify explicitly before granting access
Rationale: Zero trust assumes that no user, device, or network location should automatically
be trusted.
3. Which security principle limits a user to only the permissions required to perform
assigned duties?
A. Separation of duties
B. Least privilege
C. Availability
D. Federation
Answer: B. Least privilege
,Rationale: Least privilege reduces the potential impact of compromised accounts by
restricting unnecessary permissions.
4. What is the primary purpose of network segmentation?
A. Increase broadcast traffic
B. Reduce security visibility
C. Limit the spread of attacks
D. Eliminate authentication
Answer: C. Limit the spread of attacks
Rationale: Segmentation separates systems into security zones and can restrict unauthorized
lateral movement.
5. Which control is most appropriate for preventing unauthorized inbound traffic from
the internet?
A. Firewall
B. Database index
C. File compression
D. Load balancer only
Answer: A. Firewall
Rationale: Firewalls enforce network traffic rules based on defined criteria such as source,
destination, protocol, and port.
6. Which security architecture component is designed to detect and block malicious
network traffic?
A. IDS
B. IPS
C. DNS resolver
D. DHCP server
Answer: B. IPS
Rationale: An intrusion prevention system can actively block or prevent detected malicious
activity, whereas an IDS primarily detects and alerts.
7. What is the primary function of an intrusion detection system?
A. Detect suspicious activity
B. Encrypt every database
C. Replace authentication
D. Assign IP addresses
Answer: A. Detect suspicious activity
,Rationale: An IDS monitors activity and generates alerts when suspicious or malicious
behavior is detected.
8. Which approach provides security controls at multiple layers of an information
system?
A. Defense in depth
B. Single sign-on
C. Data deduplication
D. Load balancing
Answer: A. Defense in depth
Rationale: Defense in depth places controls at multiple layers, such as physical, network,
application, endpoint, and data layers.
9. Which technology is commonly used to protect web applications from malicious
HTTP requests?
A. WAF
B. DHCP
C. NTP
D. RAID
Answer: A. WAF
Rationale: A Web Application Firewall examines HTTP/HTTPS traffic and can block attacks
such as injection and malicious request patterns.
10. What does secure-by-design mean?
A. Security is added after deployment
B. Security is incorporated throughout system design
C. Security is delegated entirely to users
D. Security applies only to physical devices
Answer: B. Security is incorporated throughout system design
Rationale: Secure-by-design integrates security requirements and controls into the
architecture and development lifecycle from the beginning.
11. Which authentication factor is something the user possesses?
A. Password
B. Fingerprint
C. Hardware security token
D. Security question
Answer: C. Hardware security token
, Rationale: A hardware token is a possession factor, while a password is knowledge and a
fingerprint is inherence.
12. Which authentication method uses two or more different factor categories?
A. Single-factor authentication
B. Multi-factor authentication
C. Anonymous authentication
D. Shared authentication
Answer: B. Multi-factor authentication
Rationale: MFA combines different factor categories such as knowledge, possession, and
inherence.
13. Which security model emphasizes that access should be denied unless explicitly
permitted?
A. Default allow
B. Fail-open
C. Default deny
D. Open trust
Answer: C. Default deny
Rationale: Default deny prevents access unless a specific rule or policy authorizes it.
14. What is the primary security advantage of microsegmentation?
A. It increases unrestricted lateral movement
B. It provides granular isolation between workloads
C. It eliminates the need for authentication
D. It removes firewall requirements
Answer: B. It provides granular isolation between workloads
Rationale: Microsegmentation applies security policies at a granular workload or
application level.
15. Which architectural approach separates public-facing systems from internal
systems?
A. DMZ
B. Flat network
C. Peer-to-peer network
D. Workgroup
Answer: A. DMZ
