WGU D488 Final Exam Test Bank (2026/2027) — Cybersecurity Architecture & Engineering
WGU D488 FINAL EXAM TEST BANK (LATEST UPDATE
)
CYBERSECURITY ARCHITECTURE AND ENGINEERING
QUESTIONS AND ANSWERS | GRADE A | 100% CORRECT (VERIFIED SOLUTIONS)
Total Questions: 150 | Sections: 8 | Format: Multiple Choice (4 options) | Aligned to NIST CSF 2.0, NIST SP 800-37/53/207,
ISO/IEC 27001/27002, and CIS Controls v8
Section 1: Security Architecture Fundamentals
Q1: What is the PRIMARY purpose of security architecture in enterprise engineering?
A. To enforce compliance with regulatory mandates such as PCI DSS and HIPAA across business units.
B. To translate business requirements and risk tolerance into a structured set of security controls aligned across
people, process, and technology. *[CORRECT]*
C. To select and deploy vendor-specific security products within the data center perimeter.
D. To replace the organization's IT governance framework with a security-first model.
Correct Answer: B
Rationale: Security architecture aligns security investments with business objectives and risk appetite through structured control
selection spanning people, process, and technology. Compliance (A) is a downstream outcome, not the primary purpose. Vendor
selection (C) is procurement-driven, and governance replacement (D) mischaracterizes architecture's role as a complement—not
a replacement—to IT governance frameworks such as COBIT.
Q2: Which security architecture framework is BEST known for its business-driven, layered methodology that
maps security services to business requirements through contextual, conceptual, logical, physical, and
component views?
A. TOGAF
B. Zachman Framework
C. SABSA (Sherwood Applied Business Security Architecture) *[CORRECT]*
D. COBIT
Correct Answer: C
Rationale: SABSA is a security-specific architecture framework built around a six-layer model (contextual through component)
that traces security services back to business drivers. TOGAF (A) is a general enterprise architecture framework, Zachman (B)
is a classification taxonomy—not a methodology—and COBIT (D) addresses IT governance and management objectives rather
than architectural layering.
Q3: An architect is selecting an enterprise architecture framework. Which statement BEST distinguishes
TOGAF from the Zachman Framework?
A. TOGAF is a classification taxonomy; Zachman is a development methodology.
B. TOGAF provides the Architecture Development Method (ADM); Zachman provides a classification schema for
architectural artifacts. *[CORRECT]*
C. TOGAF focuses exclusively on security architecture; Zachman focuses on business architecture.
D. TOGAF is security-specific; Zachman is IT governance-focused.
Page 1
,WGU D488 Final Exam Test Bank (2026/2027) — Cybersecurity Architecture & Engineering
Correct Answer: B
Rationale: TOGAF's defining feature is the Architecture Development Method (ADM), a step-by-step process for developing
enterprise architectures. Zachman is a classification taxonomy organizing artifacts by perspective (planner, owner, builder) and
aspect (what, how, where, who, when, why). The other options either reverse or mischaracterize these distinctions.
Q4: Defense in depth is BEST described as:
A. A single, robust perimeter control that deters all known threat vectors.
B. The deployment of multiple, independent security controls across layered domains so that failure of one control
does not compromise the asset. *[CORRECT]*
C. A vulnerability management program that prioritizes patching depth-first by CVSS score.
D. A management framework for outsourcing defense to a managed security service provider.
Correct Answer: B
Rationale: Defense in depth layers independent controls across people, process, technology, and physical/logical domains so
single-control failure does not expose the asset. A single perimeter (A) is the opposite of defense in depth. CVSS prioritization
(C) is patch management, and outsourcing (D) is a sourcing decision unrelated to the architectural concept.
Q5: How does 'defense in breadth' differ from 'defense in depth'?
A. Breadth focuses on chaining controls vertically across OSI layers; depth focuses on horizontal coverage.
B. Breadth emphasizes coordinating controls across multiple attack surfaces, threat vectors, and domains; depth
emphasizes layered controls within a single vector. *[CORRECT]*
C. Breadth is a network-only concept; depth is an endpoint-only concept.
D. Breadth is a NIST-specific term; depth is an ISO-specific term.
Correct Answer: B
Rationale: Defense in breadth addresses coverage across multiple attack surfaces, threat vectors, and operational domains,
complementing the vertical layering of defense in depth. The vertical/horizontal OSI description (A) inverts the standard
definition. Options C and D mischaracterize the terms as scope- or framework-specific rather than architectural concepts.
Q6: An enterprise is migrating a monolithic application to microservices. Architects identify that the new
design introduces 47 inter-service API calls versus the previous 3 internal calls. What is the MOST significant
architectural implication?
A. Network bandwidth will increase and require upgraded switching.
B. The number of trust boundaries has increased, expanding the attack surface and requiring service-to-service
authentication, authorization, and encryption. *[CORRECT]*
C. The deployment pipeline must switch from CI to CD.
D. Patch management cadence must be increased to weekly.
Correct Answer: B
Rationale: Each inter-service call across privilege or workload domains introduces a new trust boundary that requires
authentication, authorization, and encryption—directly expanding the attack surface. Bandwidth (A) is a side effect but not the
security-citical implication. CI/CD (C) and patch cadence (D) are operational concerns unrelated to the trust-boundary
expansion.
Q7: A junior DBA is granted a service account with full sysadmin rights on the production database 'to
reduce ticket volume.' Which security principle is most directly violated, and what is the appropriate
remediation?
Page 2
,WGU D488 Final Exam Test Bank (2026/2027) — Cybersecurity Architecture & Engineering
A. Separation of duties; rotate the credential quarterly.
B. Least privilege; grant only the DBA-scoped permissions required for the task and require just-in-time elevation for
exceptional operations. *[CORRECT]*
C. Fail-safe defaults; deny all access until a manager approves each query.
D. Psychological acceptability; replace the DBA with a self-service portal.
Correct Answer: B
Rationale: Granting sysadmin rights to a junior DBA violates least privilege; remediation is to scope permissions to the actual
DBA role and use just-in-time elevation for exceptional tasks. Separation of duties (A) concerns splitting high-risk tasks across
roles, not over-granting. Fail-safe defaults (C) and psychological acceptability (D) describe different principles and are not the
primary violation.
Q8: An access control system experiences a database connection failure mid-request. Which behavior reflects
'fail-safe defaults'?
A. Cache the last successful authorization decision and apply it until the database returns.
B. Deny the access attempt, log the failure, and alert operations. *[CORRECT]*
C. Allow read-only access until the connection is restored.
D. Prompt the user to retry once and proceed if the second attempt also fails.
Correct Answer: B
Rationale: Fail-safe defaults require that, upon error, the system defaults to denial—preserving confidentiality and integrity
over availability for the privileged path. Caching the prior decision (A) risks stale authorization, allowing read-only (C) violates
least privilege, and retry-then-proceed (D) permits a bypass on persistence failure.
Q9: An application caches the result of an authorization check for 15 minutes to improve response time. A
user's role is revoked mid-window. Which security principle is most directly compromised?
A. Economy of mechanism.
B. Complete mediation. *[CORRECT]*
C. Least common mechanism.
D. Open design.
Correct Answer: B
Rationale: Complete mediation requires that every access be checked against the current authorization state; caching
authorization decisions violates this by acting on stale state. Economy of mechanism (A) is a complexity-minimization principle,
least common mechanism (C) concerns shared channels, and open design (D) concerns transparency—none directly relates to
per-request authorization.
Q10: A developer requests the ability to both push code to production AND approve the change ticket. Which
principle prevents granting this combined privilege?
A. Least privilege.
B. Separation of duties. *[CORRECT]*
C. Psychological acceptability.
D. Defense in depth.
Correct Answer: B
Rationale: Separation of duties prevents a single individual from controlling all steps of a high-risk process, ensuring the
developer cannot both push and approve the change. Least privilege (A) limits scope but does not require splitting tasks;
psychological acceptability (C) and defense in depth (D) address usability and layering respectively, not the dual-control
Page 3
, WGU D488 Final Exam Test Bank (2026/2027) — Cybersecurity Architecture & Engineering
requirement.
Q11: A security team mandates 20-character passwords rotated every 30 days. Users begin storing passwords
in plaintext spreadsheets. Which principle was neglected?
A. Psychological acceptability. *[CORRECT]*
B. Defense in breadth.
C. Open design.
D. Complete mediation.
Correct Answer: A
Rationale: Psychological acceptability requires that security mechanisms be usable; unrealistic password policies drive users to
insecure workarounds. Defense in breadth (B), open design (C), and complete mediation (D) do not address the
usability-security tradeoff that produced the workaround behavior.
Q12: A web application exposes 12 administrative endpoints on the public internet 'for remote support.'
Which is the BEST architectural action to reduce attack surface?
A. Add a WAF in front of the endpoints.
B. Move the endpoints behind a VPN and remove them from the public internet, then enforce MFA on the VPN.
*[CORRECT]*
C. Rotate the admin credentials every 24 hours.
D. Implement CAPTCHA on each endpoint.
Correct Answer: B
Rationale: Removing the endpoints from the public internet and gating them behind a VPN with MFA directly shrinks the public
attack surface. WAF (A), credential rotation (C), and CAPTCHA (D) are compensating controls that leave the surface
unchanged—the endpoints remain reachable from the public internet.
Q13: A startup is designing its first security architecture. Which artifact BEST accelerates delivery while
remaining aligned to industry practice?
A. A vendor white paper.
B. A reference architecture published by NIST or CIS mapped to the organization's threat model. *[CORRECT]*
C. A penetration test report from a previous employer.
D. A SOC 2 Type I report from a comparable competitor.
Correct Answer: B
Rationale: Reference architectures distill industry consensus into reusable patterns aligned with frameworks such as NIST SP
800-53 or CIS Controls while remaining tailorable to the organization's threat model. Vendor white papers (A) are
product-biased, penetration reports (C) are point-in-time findings, and a SOC 2 report (D) describes control effectiveness rather
than a design.
Q14: An engineering team repeatedly bypasses the security architecture review board to ship features faster.
Which is the MOST effective governance response?
A. Add a security checkbox to the deployment pipeline.
B. Embed security architects in product teams and require an architecture exception waiver, time-bounded and
reviewed quarterly, for any deviation. *[CORRECT]*
C. Block all deployments until security reviews each pull request.
D. Outsource code review to a third party.
Page 4
WGU D488 FINAL EXAM TEST BANK (LATEST UPDATE
)
CYBERSECURITY ARCHITECTURE AND ENGINEERING
QUESTIONS AND ANSWERS | GRADE A | 100% CORRECT (VERIFIED SOLUTIONS)
Total Questions: 150 | Sections: 8 | Format: Multiple Choice (4 options) | Aligned to NIST CSF 2.0, NIST SP 800-37/53/207,
ISO/IEC 27001/27002, and CIS Controls v8
Section 1: Security Architecture Fundamentals
Q1: What is the PRIMARY purpose of security architecture in enterprise engineering?
A. To enforce compliance with regulatory mandates such as PCI DSS and HIPAA across business units.
B. To translate business requirements and risk tolerance into a structured set of security controls aligned across
people, process, and technology. *[CORRECT]*
C. To select and deploy vendor-specific security products within the data center perimeter.
D. To replace the organization's IT governance framework with a security-first model.
Correct Answer: B
Rationale: Security architecture aligns security investments with business objectives and risk appetite through structured control
selection spanning people, process, and technology. Compliance (A) is a downstream outcome, not the primary purpose. Vendor
selection (C) is procurement-driven, and governance replacement (D) mischaracterizes architecture's role as a complement—not
a replacement—to IT governance frameworks such as COBIT.
Q2: Which security architecture framework is BEST known for its business-driven, layered methodology that
maps security services to business requirements through contextual, conceptual, logical, physical, and
component views?
A. TOGAF
B. Zachman Framework
C. SABSA (Sherwood Applied Business Security Architecture) *[CORRECT]*
D. COBIT
Correct Answer: C
Rationale: SABSA is a security-specific architecture framework built around a six-layer model (contextual through component)
that traces security services back to business drivers. TOGAF (A) is a general enterprise architecture framework, Zachman (B)
is a classification taxonomy—not a methodology—and COBIT (D) addresses IT governance and management objectives rather
than architectural layering.
Q3: An architect is selecting an enterprise architecture framework. Which statement BEST distinguishes
TOGAF from the Zachman Framework?
A. TOGAF is a classification taxonomy; Zachman is a development methodology.
B. TOGAF provides the Architecture Development Method (ADM); Zachman provides a classification schema for
architectural artifacts. *[CORRECT]*
C. TOGAF focuses exclusively on security architecture; Zachman focuses on business architecture.
D. TOGAF is security-specific; Zachman is IT governance-focused.
Page 1
,WGU D488 Final Exam Test Bank (2026/2027) — Cybersecurity Architecture & Engineering
Correct Answer: B
Rationale: TOGAF's defining feature is the Architecture Development Method (ADM), a step-by-step process for developing
enterprise architectures. Zachman is a classification taxonomy organizing artifacts by perspective (planner, owner, builder) and
aspect (what, how, where, who, when, why). The other options either reverse or mischaracterize these distinctions.
Q4: Defense in depth is BEST described as:
A. A single, robust perimeter control that deters all known threat vectors.
B. The deployment of multiple, independent security controls across layered domains so that failure of one control
does not compromise the asset. *[CORRECT]*
C. A vulnerability management program that prioritizes patching depth-first by CVSS score.
D. A management framework for outsourcing defense to a managed security service provider.
Correct Answer: B
Rationale: Defense in depth layers independent controls across people, process, technology, and physical/logical domains so
single-control failure does not expose the asset. A single perimeter (A) is the opposite of defense in depth. CVSS prioritization
(C) is patch management, and outsourcing (D) is a sourcing decision unrelated to the architectural concept.
Q5: How does 'defense in breadth' differ from 'defense in depth'?
A. Breadth focuses on chaining controls vertically across OSI layers; depth focuses on horizontal coverage.
B. Breadth emphasizes coordinating controls across multiple attack surfaces, threat vectors, and domains; depth
emphasizes layered controls within a single vector. *[CORRECT]*
C. Breadth is a network-only concept; depth is an endpoint-only concept.
D. Breadth is a NIST-specific term; depth is an ISO-specific term.
Correct Answer: B
Rationale: Defense in breadth addresses coverage across multiple attack surfaces, threat vectors, and operational domains,
complementing the vertical layering of defense in depth. The vertical/horizontal OSI description (A) inverts the standard
definition. Options C and D mischaracterize the terms as scope- or framework-specific rather than architectural concepts.
Q6: An enterprise is migrating a monolithic application to microservices. Architects identify that the new
design introduces 47 inter-service API calls versus the previous 3 internal calls. What is the MOST significant
architectural implication?
A. Network bandwidth will increase and require upgraded switching.
B. The number of trust boundaries has increased, expanding the attack surface and requiring service-to-service
authentication, authorization, and encryption. *[CORRECT]*
C. The deployment pipeline must switch from CI to CD.
D. Patch management cadence must be increased to weekly.
Correct Answer: B
Rationale: Each inter-service call across privilege or workload domains introduces a new trust boundary that requires
authentication, authorization, and encryption—directly expanding the attack surface. Bandwidth (A) is a side effect but not the
security-citical implication. CI/CD (C) and patch cadence (D) are operational concerns unrelated to the trust-boundary
expansion.
Q7: A junior DBA is granted a service account with full sysadmin rights on the production database 'to
reduce ticket volume.' Which security principle is most directly violated, and what is the appropriate
remediation?
Page 2
,WGU D488 Final Exam Test Bank (2026/2027) — Cybersecurity Architecture & Engineering
A. Separation of duties; rotate the credential quarterly.
B. Least privilege; grant only the DBA-scoped permissions required for the task and require just-in-time elevation for
exceptional operations. *[CORRECT]*
C. Fail-safe defaults; deny all access until a manager approves each query.
D. Psychological acceptability; replace the DBA with a self-service portal.
Correct Answer: B
Rationale: Granting sysadmin rights to a junior DBA violates least privilege; remediation is to scope permissions to the actual
DBA role and use just-in-time elevation for exceptional tasks. Separation of duties (A) concerns splitting high-risk tasks across
roles, not over-granting. Fail-safe defaults (C) and psychological acceptability (D) describe different principles and are not the
primary violation.
Q8: An access control system experiences a database connection failure mid-request. Which behavior reflects
'fail-safe defaults'?
A. Cache the last successful authorization decision and apply it until the database returns.
B. Deny the access attempt, log the failure, and alert operations. *[CORRECT]*
C. Allow read-only access until the connection is restored.
D. Prompt the user to retry once and proceed if the second attempt also fails.
Correct Answer: B
Rationale: Fail-safe defaults require that, upon error, the system defaults to denial—preserving confidentiality and integrity
over availability for the privileged path. Caching the prior decision (A) risks stale authorization, allowing read-only (C) violates
least privilege, and retry-then-proceed (D) permits a bypass on persistence failure.
Q9: An application caches the result of an authorization check for 15 minutes to improve response time. A
user's role is revoked mid-window. Which security principle is most directly compromised?
A. Economy of mechanism.
B. Complete mediation. *[CORRECT]*
C. Least common mechanism.
D. Open design.
Correct Answer: B
Rationale: Complete mediation requires that every access be checked against the current authorization state; caching
authorization decisions violates this by acting on stale state. Economy of mechanism (A) is a complexity-minimization principle,
least common mechanism (C) concerns shared channels, and open design (D) concerns transparency—none directly relates to
per-request authorization.
Q10: A developer requests the ability to both push code to production AND approve the change ticket. Which
principle prevents granting this combined privilege?
A. Least privilege.
B. Separation of duties. *[CORRECT]*
C. Psychological acceptability.
D. Defense in depth.
Correct Answer: B
Rationale: Separation of duties prevents a single individual from controlling all steps of a high-risk process, ensuring the
developer cannot both push and approve the change. Least privilege (A) limits scope but does not require splitting tasks;
psychological acceptability (C) and defense in depth (D) address usability and layering respectively, not the dual-control
Page 3
, WGU D488 Final Exam Test Bank (2026/2027) — Cybersecurity Architecture & Engineering
requirement.
Q11: A security team mandates 20-character passwords rotated every 30 days. Users begin storing passwords
in plaintext spreadsheets. Which principle was neglected?
A. Psychological acceptability. *[CORRECT]*
B. Defense in breadth.
C. Open design.
D. Complete mediation.
Correct Answer: A
Rationale: Psychological acceptability requires that security mechanisms be usable; unrealistic password policies drive users to
insecure workarounds. Defense in breadth (B), open design (C), and complete mediation (D) do not address the
usability-security tradeoff that produced the workaround behavior.
Q12: A web application exposes 12 administrative endpoints on the public internet 'for remote support.'
Which is the BEST architectural action to reduce attack surface?
A. Add a WAF in front of the endpoints.
B. Move the endpoints behind a VPN and remove them from the public internet, then enforce MFA on the VPN.
*[CORRECT]*
C. Rotate the admin credentials every 24 hours.
D. Implement CAPTCHA on each endpoint.
Correct Answer: B
Rationale: Removing the endpoints from the public internet and gating them behind a VPN with MFA directly shrinks the public
attack surface. WAF (A), credential rotation (C), and CAPTCHA (D) are compensating controls that leave the surface
unchanged—the endpoints remain reachable from the public internet.
Q13: A startup is designing its first security architecture. Which artifact BEST accelerates delivery while
remaining aligned to industry practice?
A. A vendor white paper.
B. A reference architecture published by NIST or CIS mapped to the organization's threat model. *[CORRECT]*
C. A penetration test report from a previous employer.
D. A SOC 2 Type I report from a comparable competitor.
Correct Answer: B
Rationale: Reference architectures distill industry consensus into reusable patterns aligned with frameworks such as NIST SP
800-53 or CIS Controls while remaining tailorable to the organization's threat model. Vendor white papers (A) are
product-biased, penetration reports (C) are point-in-time findings, and a SOC 2 report (D) describes control effectiveness rather
than a design.
Q14: An engineering team repeatedly bypasses the security architecture review board to ship features faster.
Which is the MOST effective governance response?
A. Add a security checkbox to the deployment pipeline.
B. Embed security architects in product teams and require an architecture exception waiver, time-bounded and
reviewed quarterly, for any deviation. *[CORRECT]*
C. Block all deployments until security reviews each pull request.
D. Outsource code review to a third party.
Page 4
