WGU Cybersecurity-Architecture-and-Engineering Practice Test Pdf Exam Material
Cybersecurity-Architecture-and-Engineering Answers Cybersecurity-Architecture-and-Engineering Free Demo Are Based On The Real Exam
NEW QUESTION # 90
How should a security analyst detect a potential structured query language (SQL) injection attack?
- A. By looking for repeated failed login attempts to the database server
- B. By looking for extra and unexpected symbols and characters in certain queries
- C. By looking for administrative command attempts within database log files
- D. By looking for database primary key changes on the production environment
Answer: B
Explanation:
The correct answer is A - By looking for extra and unexpected symbols and characters in certain queries.
According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), SQL injection attacks often include malicious SQL code in input fields, with unusual symbols such as semicolons, apostrophes, or comments (', --, ;). Analysts detect these attacks by monitoring for unexpected or abnormal input patterns in database queries.
Changes to primary keys (B) and repeated login failures (C) are unrelated to SQLi detection. Administrative commands (D) relate more to privilege escalation.
Reference Extract from Study Guide:
"SQL injection attacks typically involve abnormal input that includes special SQL characters or commands; monitoring for such anomalies can reveal attempted injections."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Application and Database Security Threats
NEW QUESTION # 91
A cloud hosting provider is concerned about the potential risks associated with attacks that target the confidentiality and integrity of sensitive data stored on its servers' volatile memory. The provider has decided to implement hardening techniques and endpoint security controls to mitigate the risk.
Which hardening technique will meet the needs of this provider?
- A. Implementing secure encrypted enclaves and AMD Secure Memory Encryption
- B. Conducting regular security awareness training for all employees
- C. Enforcing a strong password complexity policy for all user accounts
- D. Implementing a next-generation antivirus system to detect and prevent malware attacks
Answer: A
Explanation:
To protect datain use(within memory), the provider must implementhardware-level memory encryptionandtrusted execution environments(secure enclaves), which protect against cold boot attacks, memory scraping, and unauthorized access.
NIST SP 800-207A (Hardware-Enabled Security: Enclaves):
"Trusted execution environments and memory encryption mechanisms help ensure that data remains protected even when systems are compromised at lower levels." This is amodern cloud security best practiceespecially useful forconfidential computingenvironments.
#WGU Course Alignment:
Domain:System Security Engineering / Cryptography
Topic:Protect data in use with hardware-based encryption and enclaves
NEW QUESTION # 92
The security team manages a set of legacy firewalls that have been in production for nearly tenyears. The organization recently issued a mandate requiring that all firewalls be configured with intrusion detection controls that alert the team in real time based on known threats.
- A. Replacing the legacy firewalls with next-generation firewalls (NGFWs)
- B. Replacing the legacy firewalls with a reverse proxy
- C. Replacing the legacy firewalls with a load balancer
- D. Replacing the legacy firewalls with a security information and event management (SIEM) appliance
Answer: A
Explanation:
Next-Generation Firewalls (NGFWs)offer a unified solution that includes traditional packet filtering andadvanced detection featureslike Intrusion Detection and Prevention (IDPS). This makes them the most efficient and scalable option for replacing legacy firewalls in modern environments.
NIST SP 800-94 Rev. 1 (Guide to Intrusion Detection and Prevention Systems):
"NGFWs integrate IDS/IPS features with traffic inspection, enabling detection and prevention of attacks in real time."
#WGU Course Alignment:
Domain:Security Operations
Topic:Implement detection and prevention solutions (e.g., NGFWs, IDS/IPS)
NEW QUESTION # 93
What type of a system requirement involves preventing unauthorized access to data?
- A. Security
- B. Accessibility
- C. User needs
- D. Design
Answer: A
Explanation:
A system requirement that involves preventing unauthorized access to data is aSecurityrequirement. Security requirements ensure that the system:
* Protects data integrity: Ensuring data is accurate and unchanged by unauthorized users.
* Maintains confidentiality: Preventing unauthorized access to sensitive information.
* Ensures availability: Making sure that data and resources are available to authorized users when needed.
Security requirements are critical for safeguarding the system against threats and vulnerabilities.
References
* Dieter Gollmann, "Computer Security," Wiley.
* Ross Anderson, "Security Engineering: A Guide to Building Dependable Distributed Systems," Wiley.
NEW QUESTION # 94
What is a common characteristic of a proprietary software license?
- A. A business gains the right to distribute the software freely.
- B. A business gains the right to modify the software's source code.
- C. A business gains the right to use the software.
- D. A business gains the right to own the software.
Answer: C
Explanation:
* Aproprietary software licensetypically grants a business or user theright to usethe software.
* Unlike open-source licenses, proprietary licenses do not usually allow modification, redistribution, or reverse engineering.
* The software remains the property of the company that created it, and the licensee is only granted specific, limited rights.
* Examples:Many enterprise software applications come with proprietary licenses that specify the terms of use.
References:
* "Open Source Licensing: Software Freedom and Intellectual Property Law" by Lawrence Rosen.
* "Proprietary Software Licenses Explained" from Software Engineering Institute.
NEW QUESTION # 95
A healthcare provider is developing a disaster recovery plan and wants to determine the longest duration that its systems or applications can be down before causing significant damage to the business.
What is the term used to describe this metric?
- A. Business Continuity Planning (BCP)
- B. Recovery Time Objective (RTO)
- C. Disaster Recovery (DR)
- D. Business Impact Analysis (BIA)
Answer: B
Explanation:
Recovery Time Objective (RTO)refers to themaximum acceptable amount of timea system or service can be offline after a disasterbefore significant impact occurs.
NIST SP 800-34 Rev. 1:
"RTO is the maximum tolerable length of time that a system or application can be unavailable after an incident before significantly impacting business operations." BIA identifies impacts, while RTO quantifiestime-to-recovery tolerance.
#WGU Course Alignment:
Domain:Business Continuity and Disaster Recovery
Topic:Define and use RTO metrics in disaster planning
NEW QUESTION # 96
The security team has been notified about multiple man-in-the-middle (MITM) attacks happening on the wireless network over the past thirty days. Management has agreed to upgrade the network infrastructure to help eliminate these attacks.
Which solution fulfills these requirements?
- A. Layer 3 switch
- B. Security information and event management (SIEM)
- C. Inline network encryptor
- D. Wireless intrusion prevention system (WIPS)
Answer: D
Explanation:
The correct answer is B - Wireless intrusion prevention system (WIPS).
According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), a WIPS actively monitors wireless networks for unauthorized access points and malicious activity, such as man-in-the-middle (MITM) attacks. It can automatically detect, alert, and prevent wireless threats in real time, which is exactly what the organization requires to counteract MITM attacks on the wireless network.
A SIEM (A) collects logs and generates alerts but does not prevent wireless attacks. An inline encryptor (C) encrypts data but does not prevent wireless attacks. A Layer 3 switch (D) operates at the network layer and does not prevent wireless-specific threats.
Reference Extract from Study Guide:
"A wireless intrusion prevention system (WIPS) detects and prevents unauthorized access points and malicious wireless activity, including man-in-the-middle attacks."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Wireless Security and Threat Prevention
NEW QUESTION # 97
A healthcare organization would like to interoperate with another healthcare organization without needing to maintain individual accounts for members of the other organization.
Which technology concept should the company use?
- A. Multi-Factor Authentication (MFA)
- B. Single Sign-On (SSO)
- C. Federated Authentication
- D. Cloud Identity Provider
Answer: C
Explanation:
Federated authenticationallows two or more organizations to share access credentials based ontrusted identity providers. This enables users from one domain to access systems in another without creating separate accounts.
NIST SP 800-63C (Digital Identity Guidelines - Federation):
"Federated identity allows users to access multiple services across security domains using a single identity, reducing the administrative burden of account duplication." This is essential in B2B or inter-organizational environments likehealthcare information exchange.
#WGU Course Alignment:
Domain:Access Control and Identity Management
Topic:Implement federated identity systems for cross-organizational access
NEW QUESTION # 98
Match the legislative purpose with the corresponding legislation.
Answer options may be used more than once or not at all.
Answer:
Explanation:
Explanation:
DMCA (Digital Millennium Copyright Act)
Purpose: The DMCA makes it illegal to violate copyrights by disseminating digitized material.
The DMCA was enacted in 1998 to address the issues of digital rights management and copyright infringement in the digital age. It provides legal protection to copyright holders against unauthorized copying, sharing, and distribution of their digital works. The legislation criminalizes the production and dissemination of technology, devices, or services intended tocircumvent measures that control access to copyrighted works (commonly known as DRM-Digital Rights Management).
DMCA Overview - U.S. Copyright Office
HIPAA (Health Insurance Portability and Accountability Act)
Purpose: Prohibits agencies from distributing an individual's health information without the individual's consent.
HIPAA, enacted in 1996, is designed to protect individuals' medical records and other personal health information. The Privacy Rule under HIPAA sets standards for the protection of health information by health plans, healthcare clearinghouses, and healthcare providers that conduct certain healthcare transactions electronically. It mandates the protection and confidential handling of protected health information (PHI).
References: HIPAA Privacy Rule - U.S. Department of Health & Human Services FERPA (Family Educational Rights and Privacy Act) Purpose: Gives students the right to access their own educational records and prevents schools from distributing student records without permission.
Explanation: FERPA is a federal law enacted in 1974 that protects the privacy of student education records. It grants parents certain rights with respect to their children's education records, which transfer to the student when they reach 18 years of age or attend a school beyond the high school level. FERPA requires that schools must have written permission from the student or parent to release any information from a student's education record.
References: FERPA Regulations - U.S. Department of Education
NEW QUESTION # 99
What is a function of a proxy server?
- A. It acts as a giant cache of web pages that anyone in the organization has recently retrieved.
- B. It responds to user queries to create, manipulate, and retrieve records from a database.
- C. It responds to HTTP requests and can execute scripts to generate dynamic pages.
- D. It stores files that any user of the network may wish to access.
Answer: A
Explanation:
* Proxy Server Functions:
* Caching: Proxy servers can store copies of web pages and other web resources. This helps to improve load times for frequently accessed resources and reduce bandwidth usage.
* Security: They can provide additional security by anonymizing the user's IP address and filtering unwanted content.
* Correct Function:
* Acting as a cache (B) is one of the primary functions, where it stores web pages that users in the organization have recently accessed.
* Incorrect Functions:
* A: Describes a file server.
* C: Describes a database server.
* D: Describes a web server.
References:
* Proxy servers: Proxy Server
* Caching in proxy servers:Caching Proxy
NEW QUESTION # 100
A small start-up is setting up its first network, and it needs to ensure that its network security is adequate. The start-up is aware of the latest cybersecurity threats and the need for strong security measures. In addition to network security, the start-up wants to ensure that it has a disaster recovery plan in place in case of any unexpected events.
Which approach will meet the needs of the start-up?
- A. Bootstrapping
- B. Virtual private network (VPN)
- C. Intrusion detection system (IDS)
- D. Packet filtering
Answer: C
Explanation:
The correct answer is A - Intrusion detection system (IDS).
As outlined in WGU Cybersecurity Architecture and Engineering (KFO1 / D488), an IDS helps monitor network traffic for suspicious activities and security threats, making it a fundamental component of securing a network for a start-up. It enables early detection of attacks, contributing both to cybersecurity defense and incident response efforts.
Packet filtering (B) is a limited firewall technique and not as comprehensive. Bootstrapping (C) is a startup or initialization process, not a security measure. VPN (D) secures remote access but does not inherently monitor for threats.
Reference Extract from Study Guide:
"An intrusion detection system (IDS) monitors network traffic for suspicious activity and potential threats, enhancing a network's security posture and supporting incident detection."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Network Security Monitoring and Defense Here are your fully verified and properly formatted answers for this final batch, based on WGU Cybersecurity Architecture and Engineering (KFO1 / D488) official materials:
NEW QUESTION # 101
Which software allows the user to easily access the hardware of a computer?
- A. Operating system
- B. Application
- C. FTP client
- D. Productivity
Answer: A
Explanation:
The operating system (OS) is the primary software that manages all the hardware and other software on a computer. It acts as an intermediary between users and the computer hardware. The OS handles basic tasks such as controlling and allocating memory, prioritizing system requests, controlling input and output devices, facilitating networking, and managing files. Examples include Windows, macOS, and Linux.
NEW QUESTION # 102
Which risk management strategy will help prevent cheating using a learning management system as a platform?
- A. Enforcement of a strict firewall policy to restrict access to the system's server
- B. Configuration of the system to disable all Bluetooth services on all workstations
- C. Implementation of secure user authentication protocols
- D. Implementation of regular software updates and patch management
Answer: C
Explanation:
Preventing unauthorized access and impersonation during exams or coursework is critical in e-learning platforms.Strong user authentication(e.g., MFA, CAPTCHA, secure login mechanisms) ensures that only authorized users access exams and coursework.
NIST SP 800-63B (Digital Identity Guidelines - Authentication):
"Secure user authentication ensures the identity of individuals accessing sensitive applications, reducing the risk of impersonation and credential misuse." Firewall rules and patching are important, but they don't directly addressuser-level fraud prevention.
#WGU Course Alignment:
Domain:Access Control and Identity Management
Topic:Secure authentication mechanisms for web platforms
NEW QUESTION # 103
A professional services organization deployed security edge devices in key locations on its corporate network.
How will these devices improve the organization's security posture?
- A. They are a set of Trusted Platform Module (TPM) devices
- B. They act as an initial defense layer for potential threats
- C. They protect from severe Distributed Denial-of-Service (DDoS) attacks
- D. They act as a Security Information and Event Management (SIEM) module for a SOC analyst
Answer: B
Explanation:
Security edge devices(such as NGFWs, IDS/IPS, and secure gateways) are deployed at thenetwork perimeterto inspect and filter traffic, providing aninitial layer of defenseagainst external threats before they reach internal systems.
NIST SP 800-41 Rev. 1:
"Edge security devices enforce security policy at network boundaries and act as a first line of defense by preventing unauthorized or malicious traffic from entering the internal network." They are not TPMs or SIEMs, though they maygenerate dataconsumed by SIEMs.
#WGU Course Alignment:
Domain:Network Security
Topic:Deploy perimeter defense technologies at network entry points
NEW QUESTION # 104
A medium-sized grocery chain with locations all across the United States has a new business requirement that all devices must authenticate to access its resources.
What should the grocery chain use for the devices to authenticate?
- A. Public key infrastructure (PKI)
- B. Virtual private network (VPN)
- C. Certificate signing
- D. Endpoint passwords
Answer: A
Explanation:
The correct answer is B - Public key infrastructure (PKI).
According to the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) Study Guide, PKI is the framework that enables the issuance and management of digital certificates used for device authentication. By using certificates, devices can securely authenticate themselves to access corporate resources without relying solely on passwords.
VPNs (A) secure network connections but do not authenticate devices themselves. Certificate signing (C) is a part of PKI but not the complete infrastructure. Endpoint passwords (D) authenticate users, not necessarily the devices.
Reference Extract from Study Guide:
"Public key infrastructure (PKI) enables the issuance of digital certificates used for authenticating users, systems, and devices, ensuring secure access control."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Cryptography and PKI Concepts
NEW QUESTION # 105
Which life cycle is part of the process for planning, creating, testing, and deploying information systems?
- A. Network Development Life Cycle (NDLC)
- B. Software Test Life Cycle (STLC)
- C. System Development Life Cycle (SDLC)
- D. Database Creation System Life Cycle (DCSLC)
Answer: C
Explanation:
The System Development Life Cycle (SDLC) is a process used for planning, creating, testing, and deploying an information system. It involves several stages, including requirements gathering, system design, implementation, testing, deployment, and maintenance. The SDLC ensures that the system meets the needs of users and is developed in a structuredand efficient manner.
NEW QUESTION # 106
The DevSecOps team for an organization manages a continuous integration and continuous deployment (CI
/CD) pipeline for a three-tier web application. Management has asked the team to perform a series of comprehensive post-deployment tests to make sure that all of the components of the application can interact and function properly.
What should the team recommend?
- A. Static code analysis
- B. Dynamic code analysis
- C. Integration testing
- D. Package scanning
Answer: C
Explanation:
The correct answer is C - Integration testing.
According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), integration testing verifies that different modules or components of an application work together as intended. This type of testing is essential after deployment to ensure the overall system functions correctly across all tiers (e.g., web, application, and database layers).
Static code analysis (A) examines source code without execution. Dynamic code analysis (B) tests running code for vulnerabilities but not necessarily component interaction. Package scanning (D) reviews third-party libraries for vulnerabilities but does not test integration.
Reference Extract from Study Guide:
"Integration testing verifies that multiple components of an application function correctly when combined, ensuring end-to-end system reliability post-deployment."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Secure Software Development and Testing
NEW QUESTION # 107
A small online retailer stores customer information, product inventory, and financial data on its local servers.
What are the necessary components of a business continuity and disaster recovery plan for this company?
- A. Redundant backups, a communication plan, and a designated off-site location for data storage and recovery
- B. A detailed evacuation plan, frequent data backups, and regular cybersecurity training for employees
- C. A comprehensive insurance policy, a list of emergency contacts, and a system for continuous monitoring of network activity
- D. Routine maintenance of servers, an emergency generator, and a policy for employees to work remotely in case of a disaster
Answer: A
Explanation:
The correct answer is B - Redundant backups, a communication plan, and a designated off-site location for data storage and recovery.
WGU Cybersecurity Architecture and Engineering (KFO1 / D488) emphasizes that for effective business continuity and disaster recovery, companies must maintain redundant backups, establish a communication strategy for emergencies, and store critical backups in off-site or cloud locations to recover operations quickly.
While evacuation plans (A) and insurance policies (C) are important, they are not the core technical components for IT disaster recovery. Routine maintenance and remote work (D) are helpful but secondary.
Reference Extract from Study Guide:
"Redundant backups, off-site data storage, and an effective communication plan are key components of business continuity and disaster recovery strategies."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Business Continuity and Disaster Recovery Planning
NEW QUESTION # 108
A company has recently implemented a hybrid cloud deployment. The security team has been notified about thousands of failed attempts to connect to routers and switches in the on-premises network. A solution must be implemented to block connections after three unsuccessful SSH attempts on any network device.
- A. Firewall
- B. Data Loss Prevention
- C. Intrusion Prevention System (IPS)
Answer: C
Explanation:
AnIntrusion Prevention System (IPS)detects and blocks malicious activity in real time based on defined policies or behavior patterns. IPS tools can enforcerate limiting,connection attempts, and evenauto- blockingafter repeated failures.
NIST SP 800-94 Rev. 1:
"Intrusion prevention systems not only detect potential incidents but actively prevent attempts such as brute- force attacks on services like SSH." Firewalls may filter traffic, but only an IPSactively terminates or blocks behavior-based threats like repeated failed logins.
#WGU Course Alignment:
Domain:Network Security
Topic:Deploy and configure IPS for automated protection against brute-force attacks
NEW QUESTION # 109
A financial institution conducted a cybersecurity assessment, which identified several vulnerabilities including outdated software and weak password policies. The company also needs to implement a new core banking system that can handle a large number of transactions while ensuring the security of customer data.
Which risk mitigation process is the most effective approach to address these vulnerabilities, and what is the best topology for the new core banking system?
- A. Installing antivirus software on all endpoints and using on-premises topology
- B. Creating strong password policies and enforcing multifactor authentication and using public cloud topology
- C. Conducting regular security audits and penetration testing and using private cloud topology
- D. Implementing security patches and updates on a regular basis and using hybrid cloud topology
Answer: D
Explanation:
Applyingregular updates and patchesis fundamental to risk mitigation. Choosing ahybrid cloud topologyallows the financial institution to retaincritical services in-housewhile leveragingcloud scalabilityfor high-volume transactions.
NIST SP 800-160 Vol. 1 (Systems Security Engineering):
"Security patching is essential for mitigating vulnerabilities, especially in high-assurance environments like financial systems." Thehybrid modelbalancesperformance, control, and security, which is vital for core banking systems.
#WGU Course Alignment:
Domain:System Security Engineering
Topic:Apply risk mitigation techniques and choose secure deployment topologies
NEW QUESTION # 110
A company has identified a potential risk associated with a new software implementation, which could result in a significant data breach.
Which step of the risk management life cycle involves implementing security controls to prevent the risk?
- A. Identify
- B. Review
- C. Control
- D. Assess
Answer: C
Explanation:
The correct answer is C - Control.
According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), the control phase of the risk management life cycle involves implementing appropriate security measures or countermeasures to mitigate or eliminate identified risks. After a risk is assessed, controls are applied to address it and reduce its impact or likelihood.
Assess (A) evaluates risk severity. Identify (B) discovers risks. Review (D) checks the effectiveness of applied controls.
Reference Extract from Study Guide:
"The control phase of risk management focuses on applying security controls and mitigations to reduce the risk to an acceptable level."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Management Life Cycle
NEW QUESTION # 111
......
Cybersecurity-Architecture-and-Engineering [May-2026] Newly Released] Exam Questions For You To Pass: https://actual4test.exam4labs.com/Cybersecurity-Architecture-and-Engineering-practice-torrent.html