WGU - D483 - Security Operations Correct Screenshots with
questions and answers Latest 2026
1. A security analyst routinely examines network traffic, authentication activity,
endpoint behavior, and other telemetry to identify unusual patterns that could
indicate an attack before an alert has been generated. Which security activity is the
analyst performing?
A. Threat hunting
B. Patch management
C. Data classification
D. Disaster recovery
Answer: A
2. A security analyst discovers an unfamiliar executable, unexpected privileged-
account activity, and unusual outbound network traffic on a workstation. Which
term best describes these artifacts when they provide evidence that a compromise
may have occurred?
A. Indicators of compromise
B. Service-level agreements
C. Recovery objectives
D. Configuration baselines
Answer: A
3. An organization wants to reduce the attack surface of its Linux servers by
disabling unnecessary services, removing unused software, restricting privileges,
and applying security updates. Which security practice is being demonstrated?
A. System hardening
B. Data masking
C. Network tunneling
D. Load balancing
Answer: A
,4. An organization adopts a security model in which users and devices are
continuously authenticated and authorized before accessing resources rather than
automatically trusting entities because they are inside the corporate network.
Which architecture is being implemented?
A. Zero Trust Architecture
B. Flat network architecture
C. Perimeter-only security
D. Open-access architecture
Answer: A
5. A company needs a framework and collection of technologies for managing
certificates, establishing trust, and verifying the identities of users and systems
through public-key cryptography. Which technology best meets this requirement?
A. Public Key Infrastructure
B. Security Information and Event Management
C. Network Address Translation
D. Simple Network Management Protocol
Answer: A
6. A SIEM identifies suspicious activity and automatically initiates a predefined
response workflow that isolates an endpoint and creates an incident ticket. Which
technology most directly enables this automated response capability?
A. SOAR
B. DNS
C. DHCP
D. RAID
Answer: A
7. A security team wants to collect logs from firewalls, servers, applications, and
endpoints and correlate events from these different sources to identify potential
attacks. Which technology should the organization deploy?
A. SIEM
B. VPN
,C. Load balancer
D. Hypervisor
Answer: A
8. A security analyst notices that authentication events from multiple servers
appear out of chronological order because the systems have different clock
settings. Which technology should be configured to improve time synchronization?
A. NTP
B. FTP
C. SMTP
D. SNMP
Answer: A
9. An organization wants to discover vulnerabilities by directly interacting with
systems and actively sending probes to determine whether weaknesses exist.
Which scanning method is most appropriate?
A. Active scanning
B. Passive scanning
C. Packet archiving
D. Log normalization
Answer: A
10. A security team analyzes captured network traffic to identify potentially
vulnerable systems without directly probing those systems. Which approach is
being used?
A. Passive scanning
B. Active scanning
C. Exploit development
D. Password spraying
Answer: A
11. A security analyst examines characteristics such as operating-system versions,
open ports, services, and application responses to identify the technology running
on a target system. What activity is this?
, A. Fingerprinting
B. Encryption
C. Tokenization
D. Data destruction
Answer: A
12. A vulnerability scanner identifies a critical vulnerability on a publicly
accessible server. Before immediately taking the server offline, the security team
evaluates exploitability, business impact, and the consequences of downtime. What
principle is being applied?
A. Risk-based vulnerability management
B. Security through obscurity
C. Least functionality without analysis
D. Unrestricted availability
Answer: A
13. A vulnerability is being actively exploited against an organization's internet-
facing systems. Which factor should generally increase the urgency of
remediation?
A. Evidence that the vulnerability is actively being exploited
B. The server's physical color
C. The number of installed monitors
D. The age of the keyboard attached to the system
Answer: A
14. A security analyst discovers that an employee account has suddenly been
granted administrative privileges even though there is no documented business
requirement for the change. Which activity should the analyst consider suspicious?
A. Privilege escalation
B. Normal data backup
C. Routine log rotation
D. Certificate renewal
Answer: A
questions and answers Latest 2026
1. A security analyst routinely examines network traffic, authentication activity,
endpoint behavior, and other telemetry to identify unusual patterns that could
indicate an attack before an alert has been generated. Which security activity is the
analyst performing?
A. Threat hunting
B. Patch management
C. Data classification
D. Disaster recovery
Answer: A
2. A security analyst discovers an unfamiliar executable, unexpected privileged-
account activity, and unusual outbound network traffic on a workstation. Which
term best describes these artifacts when they provide evidence that a compromise
may have occurred?
A. Indicators of compromise
B. Service-level agreements
C. Recovery objectives
D. Configuration baselines
Answer: A
3. An organization wants to reduce the attack surface of its Linux servers by
disabling unnecessary services, removing unused software, restricting privileges,
and applying security updates. Which security practice is being demonstrated?
A. System hardening
B. Data masking
C. Network tunneling
D. Load balancing
Answer: A
,4. An organization adopts a security model in which users and devices are
continuously authenticated and authorized before accessing resources rather than
automatically trusting entities because they are inside the corporate network.
Which architecture is being implemented?
A. Zero Trust Architecture
B. Flat network architecture
C. Perimeter-only security
D. Open-access architecture
Answer: A
5. A company needs a framework and collection of technologies for managing
certificates, establishing trust, and verifying the identities of users and systems
through public-key cryptography. Which technology best meets this requirement?
A. Public Key Infrastructure
B. Security Information and Event Management
C. Network Address Translation
D. Simple Network Management Protocol
Answer: A
6. A SIEM identifies suspicious activity and automatically initiates a predefined
response workflow that isolates an endpoint and creates an incident ticket. Which
technology most directly enables this automated response capability?
A. SOAR
B. DNS
C. DHCP
D. RAID
Answer: A
7. A security team wants to collect logs from firewalls, servers, applications, and
endpoints and correlate events from these different sources to identify potential
attacks. Which technology should the organization deploy?
A. SIEM
B. VPN
,C. Load balancer
D. Hypervisor
Answer: A
8. A security analyst notices that authentication events from multiple servers
appear out of chronological order because the systems have different clock
settings. Which technology should be configured to improve time synchronization?
A. NTP
B. FTP
C. SMTP
D. SNMP
Answer: A
9. An organization wants to discover vulnerabilities by directly interacting with
systems and actively sending probes to determine whether weaknesses exist.
Which scanning method is most appropriate?
A. Active scanning
B. Passive scanning
C. Packet archiving
D. Log normalization
Answer: A
10. A security team analyzes captured network traffic to identify potentially
vulnerable systems without directly probing those systems. Which approach is
being used?
A. Passive scanning
B. Active scanning
C. Exploit development
D. Password spraying
Answer: A
11. A security analyst examines characteristics such as operating-system versions,
open ports, services, and application responses to identify the technology running
on a target system. What activity is this?
, A. Fingerprinting
B. Encryption
C. Tokenization
D. Data destruction
Answer: A
12. A vulnerability scanner identifies a critical vulnerability on a publicly
accessible server. Before immediately taking the server offline, the security team
evaluates exploitability, business impact, and the consequences of downtime. What
principle is being applied?
A. Risk-based vulnerability management
B. Security through obscurity
C. Least functionality without analysis
D. Unrestricted availability
Answer: A
13. A vulnerability is being actively exploited against an organization's internet-
facing systems. Which factor should generally increase the urgency of
remediation?
A. Evidence that the vulnerability is actively being exploited
B. The server's physical color
C. The number of installed monitors
D. The age of the keyboard attached to the system
Answer: A
14. A security analyst discovers that an employee account has suddenly been
granted administrative privileges even though there is no documented business
requirement for the change. Which activity should the analyst consider suspicious?
A. Privilege escalation
B. Normal data backup
C. Routine log rotation
D. Certificate renewal
Answer: A
