WGU D488 Cybersecurity Architecture and
Engineering Prep Exam Version 1 | 2026/2027 - 300
TRULY UNIQUE ORIGINAL QUESTIONS x 300
UNIQUE DESIGNS - SMART WORK
Question 1 [Design-1]
SABSA Q1: SABSA framework layer - Business Attributes to Technical components traceability
for scenario 1 with 10 users
A. Correct: SABSA 6 layers - B. Incorrect B: Only technical layer
Contextual (business), Conceptual
(architect), Logical (designer),
Physical (builder), Component
(tradesman), Operational (facility
manager), with 6 questions what
why how who where when, ensures
business-driven traceability
C. Incorrect C: No business D. Incorrect D: Only network layer
alignment
Answer: A - SABSA 6 layers contextual to operational with 6 interrogatives
ensures traceability
Rationale: SABSA (Sherwood Applied Business Security Architecture): Business-driven, 6 layers from
business view to operational, each with assets, motivation, process, people, location, time. Provides
traceability from business requirements to technical implementation.
Question 2 [Design-2]
NIST RMF Q2: Step 3 of NIST Risk Management Framework RMF for system categorization
scenario 2
■ A. Correct: RMF 7 steps - Prepare, Categorize (FIPS 199 impact), Select (NIST
800-53 controls), Implement, Assess, Authorize, Monitor continuously
■ B. Incorrect B: Only 3 steps
■ C. Incorrect C: No categorize
■ D. Incorrect D: No monitoring
Answer: A - RMF 7 steps Prepare Categorize Select Implement Assess
Authorize Monitor
Rationale: NIST SP 800-37 RMF: Prepare organization, Categorize system impact (Low Mod High per
FIPS 199 confidentiality integrity availability), Select controls from SP 800-53, Implement, Assess
effectiveness, Authorize (ATO), Monitor continuously with ISCM.
,Question 3 [Design-3]
TOGAF Q3: TOGAF ADM phase for security architecture scenario 3 with 3 stakeholders
→ A) Correct: TOGAF ADM includes security in all phases, Phase A vision, B
business, C data/application, D technology, E opportunities, F migration, G
governance, H change, Requirements Management, with security as cross-cutting
concern
→ B) Incorrect B: Security only in Phase D
→ C) Incorrect C: No ADM
→ D) Incorrect D: Only Phase A
Answer: A - Security integrated across all TOGAF ADM phases as
cross-cutting concern
Rationale: TOGAF Architecture Development Method integrates security throughout. SABSA can be
plugged into TOGAF. Security architecture is cross-cutting, not single phase.
Question 4 [Design-4]
Architecture Q4: Enterprise moving to Zero Trust Architecture per NIST SP 800-207. User 4 from
untrusted network requests access to financial app. What is core Zero Trust principle?
A. Correct: Never trust, always verify - assume breach, verify explicitly every request,
least privilege, micro-segmentation, identity-centric, device health, dynamic policy
B. Incorrect B: Trust internal network automatically
C. Incorrect C: Only perimeter firewall needed
D. Incorrect D: Trust all authenticated users forever
Answer: A - Never trust, always verify, least privilege, micro-segmentation
Rationale: Zero Trust per NIST 800-207: never trust, always verify, assume breach, least privilege,
verify explicitly, use least privilege, micro-segmentation, identity as perimeter, device health, dynamic
risk-based policy. No implicit trust based on network location.
,Question 5 [Design-5]
SABSA Q5: SABSA framework layer - Business Attributes to Technical components traceability
for scenario 5 with 50 users
A. Correct: SABSA 6 layers - B. Incorrect B: Only technical layer
Contextual (business), Conceptual
(architect), Logical (designer),
Physical (builder), Component
(tradesman), Operational (facility
manager), with 6 questions what
why how who where when, ensures
business-driven traceability
C. Incorrect C: No business D. Incorrect D: Only network layer
alignment
Answer: A - SABSA 6 layers contextual to operational with 6 interrogatives
ensures traceability
Rationale: SABSA (Sherwood Applied Business Security Architecture): Business-driven, 6 layers from
business view to operational, each with assets, motivation, process, people, location, time. Provides
traceability from business requirements to technical implementation.
Question 6 [Design-6]
NIST RMF Q6: Step 7 of NIST Risk Management Framework RMF for system categorization
scenario 6
■ A. Correct: RMF 7 steps - Prepare, Categorize (FIPS 199 impact), Select (NIST
800-53 controls), Implement, Assess, Authorize, Monitor continuously
■ B. Incorrect B: Only 3 steps
■ C. Incorrect C: No categorize
■ D. Incorrect D: No monitoring
Answer: A - RMF 7 steps Prepare Categorize Select Implement Assess
Authorize Monitor
Rationale: NIST SP 800-37 RMF: Prepare organization, Categorize system impact (Low Mod High per
FIPS 199 confidentiality integrity availability), Select controls from SP 800-53, Implement, Assess
effectiveness, Authorize (ATO), Monitor continuously with ISCM.
, Question 7 [Design-7]
TOGAF Q7: TOGAF ADM phase for security architecture scenario 7 with 7 stakeholders
Reference: NIST SP 800-207 Zero Trust, SP 800-53 controls, ISO 27001, SABSA
→ A) Correct: TOGAF ADM includes security in all phases, Phase A vision, B
business, C data/application, D technology, E opportunities, F migration, G
governance, H change, Requirements Management, with security as cross-cutting
concern
→ B) Incorrect B: Security only in Phase D
→ C) Incorrect C: No ADM
→ D) Incorrect D: Only Phase A
Answer: A - Security integrated across all TOGAF ADM phases as
cross-cutting concern
Rationale: TOGAF Architecture Development Method integrates security throughout. SABSA can be
plugged into TOGAF. Security architecture is cross-cutting, not single phase.
Question 8 [Design-8]
Architecture Q8: Enterprise moving to Zero Trust Architecture per NIST SP 800-207. User 8 from
untrusted network requests access to financial app. What is core Zero Trust principle?
A. Correct: Never trust, always verify - assume breach, verify explicitly every request,
least privilege, micro-segmentation, identity-centric, device health, dynamic policy
B. Incorrect B: Trust internal network automatically
C. Incorrect C: Only perimeter firewall needed
D. Incorrect D: Trust all authenticated users forever
Answer: A - Never trust, always verify, least privilege, micro-segmentation
Rationale: Zero Trust per NIST 800-207: never trust, always verify, assume breach, least privilege,
verify explicitly, use least privilege, micro-segmentation, identity as perimeter, device health, dynamic
risk-based policy. No implicit trust based on network location.
Engineering Prep Exam Version 1 | 2026/2027 - 300
TRULY UNIQUE ORIGINAL QUESTIONS x 300
UNIQUE DESIGNS - SMART WORK
Question 1 [Design-1]
SABSA Q1: SABSA framework layer - Business Attributes to Technical components traceability
for scenario 1 with 10 users
A. Correct: SABSA 6 layers - B. Incorrect B: Only technical layer
Contextual (business), Conceptual
(architect), Logical (designer),
Physical (builder), Component
(tradesman), Operational (facility
manager), with 6 questions what
why how who where when, ensures
business-driven traceability
C. Incorrect C: No business D. Incorrect D: Only network layer
alignment
Answer: A - SABSA 6 layers contextual to operational with 6 interrogatives
ensures traceability
Rationale: SABSA (Sherwood Applied Business Security Architecture): Business-driven, 6 layers from
business view to operational, each with assets, motivation, process, people, location, time. Provides
traceability from business requirements to technical implementation.
Question 2 [Design-2]
NIST RMF Q2: Step 3 of NIST Risk Management Framework RMF for system categorization
scenario 2
■ A. Correct: RMF 7 steps - Prepare, Categorize (FIPS 199 impact), Select (NIST
800-53 controls), Implement, Assess, Authorize, Monitor continuously
■ B. Incorrect B: Only 3 steps
■ C. Incorrect C: No categorize
■ D. Incorrect D: No monitoring
Answer: A - RMF 7 steps Prepare Categorize Select Implement Assess
Authorize Monitor
Rationale: NIST SP 800-37 RMF: Prepare organization, Categorize system impact (Low Mod High per
FIPS 199 confidentiality integrity availability), Select controls from SP 800-53, Implement, Assess
effectiveness, Authorize (ATO), Monitor continuously with ISCM.
,Question 3 [Design-3]
TOGAF Q3: TOGAF ADM phase for security architecture scenario 3 with 3 stakeholders
→ A) Correct: TOGAF ADM includes security in all phases, Phase A vision, B
business, C data/application, D technology, E opportunities, F migration, G
governance, H change, Requirements Management, with security as cross-cutting
concern
→ B) Incorrect B: Security only in Phase D
→ C) Incorrect C: No ADM
→ D) Incorrect D: Only Phase A
Answer: A - Security integrated across all TOGAF ADM phases as
cross-cutting concern
Rationale: TOGAF Architecture Development Method integrates security throughout. SABSA can be
plugged into TOGAF. Security architecture is cross-cutting, not single phase.
Question 4 [Design-4]
Architecture Q4: Enterprise moving to Zero Trust Architecture per NIST SP 800-207. User 4 from
untrusted network requests access to financial app. What is core Zero Trust principle?
A. Correct: Never trust, always verify - assume breach, verify explicitly every request,
least privilege, micro-segmentation, identity-centric, device health, dynamic policy
B. Incorrect B: Trust internal network automatically
C. Incorrect C: Only perimeter firewall needed
D. Incorrect D: Trust all authenticated users forever
Answer: A - Never trust, always verify, least privilege, micro-segmentation
Rationale: Zero Trust per NIST 800-207: never trust, always verify, assume breach, least privilege,
verify explicitly, use least privilege, micro-segmentation, identity as perimeter, device health, dynamic
risk-based policy. No implicit trust based on network location.
,Question 5 [Design-5]
SABSA Q5: SABSA framework layer - Business Attributes to Technical components traceability
for scenario 5 with 50 users
A. Correct: SABSA 6 layers - B. Incorrect B: Only technical layer
Contextual (business), Conceptual
(architect), Logical (designer),
Physical (builder), Component
(tradesman), Operational (facility
manager), with 6 questions what
why how who where when, ensures
business-driven traceability
C. Incorrect C: No business D. Incorrect D: Only network layer
alignment
Answer: A - SABSA 6 layers contextual to operational with 6 interrogatives
ensures traceability
Rationale: SABSA (Sherwood Applied Business Security Architecture): Business-driven, 6 layers from
business view to operational, each with assets, motivation, process, people, location, time. Provides
traceability from business requirements to technical implementation.
Question 6 [Design-6]
NIST RMF Q6: Step 7 of NIST Risk Management Framework RMF for system categorization
scenario 6
■ A. Correct: RMF 7 steps - Prepare, Categorize (FIPS 199 impact), Select (NIST
800-53 controls), Implement, Assess, Authorize, Monitor continuously
■ B. Incorrect B: Only 3 steps
■ C. Incorrect C: No categorize
■ D. Incorrect D: No monitoring
Answer: A - RMF 7 steps Prepare Categorize Select Implement Assess
Authorize Monitor
Rationale: NIST SP 800-37 RMF: Prepare organization, Categorize system impact (Low Mod High per
FIPS 199 confidentiality integrity availability), Select controls from SP 800-53, Implement, Assess
effectiveness, Authorize (ATO), Monitor continuously with ISCM.
, Question 7 [Design-7]
TOGAF Q7: TOGAF ADM phase for security architecture scenario 7 with 7 stakeholders
Reference: NIST SP 800-207 Zero Trust, SP 800-53 controls, ISO 27001, SABSA
→ A) Correct: TOGAF ADM includes security in all phases, Phase A vision, B
business, C data/application, D technology, E opportunities, F migration, G
governance, H change, Requirements Management, with security as cross-cutting
concern
→ B) Incorrect B: Security only in Phase D
→ C) Incorrect C: No ADM
→ D) Incorrect D: Only Phase A
Answer: A - Security integrated across all TOGAF ADM phases as
cross-cutting concern
Rationale: TOGAF Architecture Development Method integrates security throughout. SABSA can be
plugged into TOGAF. Security architecture is cross-cutting, not single phase.
Question 8 [Design-8]
Architecture Q8: Enterprise moving to Zero Trust Architecture per NIST SP 800-207. User 8 from
untrusted network requests access to financial app. What is core Zero Trust principle?
A. Correct: Never trust, always verify - assume breach, verify explicitly every request,
least privilege, micro-segmentation, identity-centric, device health, dynamic policy
B. Incorrect B: Trust internal network automatically
C. Incorrect C: Only perimeter firewall needed
D. Incorrect D: Trust all authenticated users forever
Answer: A - Never trust, always verify, least privilege, micro-segmentation
Rationale: Zero Trust per NIST 800-207: never trust, always verify, assume breach, least privilege,
verify explicitly, use least privilege, micro-segmentation, identity as perimeter, device health, dynamic
risk-based policy. No implicit trust based on network location.
