Free Practice Questions for the WGU Courses and Certificates Cybersecurity-Architecture-and-Engineering Exam (2026 Updated)

The correct answer is C — Stream ciphers.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) content explains that stream ciphers encrypt data bit-by-bit or byte-by-byte, making them highly efficient and suitable for real-time applications like video conferencing where low latency is critical.

Block ciphers (A) encrypt large chunks of data, causing latency. Asymmetric encryption (B) is too slow for real-time data streams. Hash functions (D) are used for data integrity, not for ongoing data encryption.

Reference Extract from Study Guide:

"Stream ciphers encrypt data continuously and are ideal for real-time applications such as video or audio streaming where low latency is essential."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Encryption Technologies

The correct answer is D — Security information and event management (SIEM).

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) explains that a SIEM solution collects, correlates, and analyzes logs and events from multiple sources to detect unusual patterns of behavior across an organization’s infrastructure. SIEM systems are specifically designed for centralized monitoring and alerting on suspicious activities, which helps prevent future breaches.

VPN (A) secures communications but does not monitor behavior. SSH (B) is a secure protocol for remote access but not a monitoring tool. WAF (C) protects web applications but does not monitor user behavior across systems.

Reference Extract from Study Guide:

"Security information and event management (SIEM) platforms aggregate and analyze security data from across an enterprise, providing actionable insights into anomalous user activities and potential threats."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Security Monitoring and Event Management

=============================================

AHost-based Intrusion Detection and Prevention System (HIDPS)can detect unauthorized activity or suspicious changesat the OS level, including those specifically targetingLinux kernel modules, services, or rootkits.

NIST SP 800-94 Rev. 1:

“HIDPS software runs on individual hosts or devices in the network, analyzing inbound and outbound packets and alerting administrators to suspicious activity.”

HIDPS is especially effective in server environments wherekernel-level visibilityis critical.

???? WGU Course Alignment:

Domain:System Security Engineering

Topic:Implement and monitor HIDPS on enterprise Linux servers

The correct answer is B — Secure Hash Algorithm 256 (SHA-256).

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) outlines that SHA-256 is a cryptographic hash function used to verify data integrity. It generates a fixed-size hash value based on input data, and any alteration to the data results in a different hash, signaling tampering.

DES (A) and AES (C) are encryption algorithms for confidentiality. RSA (D) is used for encryption and digital signatures, not solely for ensuring integrity via hashing.

Reference Extract from Study Guide:

"SHA-256 is a widely adopted cryptographic hash function used to verify the integrity of digital data and detect unauthorized modifications."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Cryptographic Hash Functions and Data Integrity

=============================================

The correct answer is B — Elliptic Curve Diffie-Hellman (ECDH).

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) material highlights that ECDH is an enhanced, more efficient form of the traditional Diffie-Hellman key exchange, using elliptic curve cryptography (ECC). It provides similar security with much smaller key sizes, improving performance and efficiency.

DH (A) is the traditional method but is less efficient. RSA (C) is primarily used for encryption and digital signatures. DSA (D) is used for digital signatures, not for key exchange.

Reference Extract from Study Guide:

"Elliptic Curve Diffie-Hellman (ECDH) enhances traditional key exchange by utilizing elliptic curve cryptography, offering higher security with smaller key sizes and improved efficiency."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Cryptographic Key Management

The correct answer is C — Implementation of role-based access controls and encryption of all sensitive data.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), the combination of role-based access control (RBAC) and encryption protects sensitive health data by ensuring only authorized users can access necessary information, while encryption ensures the data remains secure both at rest and in transit.

Disabling USB ports (A) prevents data exfiltration but does not fulfill broad privacy requirements. Encrypting network traffic (B) protects in-transit data only. Firewalls (D) protect against unauthorized access but do not manage user roles or internal data privacy.

Reference Extract from Study Guide:

"Protecting sensitive health data requires a combination of access control models such as RBAC and encryption, ensuring both authorization and confidentiality."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Privacy and Data Protection Strategies

Access rights are critical components of access control mechanisms in information security. They specify what actions users or systems can perform on specific resources, limiting them to only permitted items.

Definition: Access rights, also known as permissions, are rules that define the allowed actions on a resource (e.g., read, write, execute).

Implementation: Access rights are typically implemented using Access Control Lists (ACLs), Role-Based Access Control (RBAC), or other access control models.

Purpose: The main goal is to enforce the principle of least privilege, ensuring that users can only access the resources necessary for their role.

References

NIST Special Publication 800-53

ISO/IEC 27001:2013

"Computer Security: Principles and Practice" by William Stallings

Deploying the SMTP server in aDMZ between two firewallsallows email traffic to be filtered before it ever touches the internal network. The DMZ serves as a security buffer zone—where public-facing services are isolated but still accessible from both internal and external networks, thus reducing the attack surface.

NIST SP 800-41 Rev. 1 (Guidelines on Firewalls and Firewall Policy):

"Organizations often place publicly accessible resources (e.g., SMTP servers) in a demilitarized zone (DMZ) between two firewalls to provide layered protection and isolate internal systems from external threats."

???? WGU Course Alignment:

Domain:Network Architecture and Design

Topic:Implement secure DMZ design and segmentation

The correct answer is D — Configuring third-party authentication with Security Assertion Markup Language (SAML).

According to the WGU KFO1 / D488 Study Guide, SAML enables Single Sign-On (SSO) and federated identity across different domains by securely exchanging authentication and authorization data between an identity provider (such as an organization's Active Directory Federation Services) and a service provider (such as Azure). This allows on-premises users to log into cloud services using their existing corporate credentials.

TLS (A) provides secure communication but does not manage identity federation. 2FA (B) strengthens authentication but is not about identity federation setup. LDAP (C) is a protocol for accessing directory services, not specifically designed for federation across cloud platforms.

Reference Extract from Study Guide:

"SAML is used to implement Single Sign-On (SSO) and federated identity management, allowing organizations to extend on-premises authentication capabilities to cloud services seamlessly."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Identity and Access Management Concepts

Theprinciple of least privilegedictates that backups—especially those containing sensitive or mission-critical data—should havestrict access controlsto prevent unauthorized access.

NIST SP 800-209 (Security Guidelines for Storage Infrastructure):

“Access to storage resources must be tightly controlled through identity management and access control policies to prevent compromise or misuse of sensitive data.”

While vulnerability scanning and auditing are goodfollow-upactions,immediate access restrictionis thefirst-line defense.

???? WGU Course Alignment:

Domain:System Security Engineering

Topic:Secure cloud data storage and apply access control measures

To determine an order total, the item unit price is essential because it represents the cost per unit of the item. By multiplying the unit price by the quantity ordered, you can calculate the total cost for each item in the order, and then sum these totals to get the overall order total.

DMCA (Digital Millennium Copyright Act)

Purpose: The DMCA makes it illegal to violate copyrights by disseminating digitized material.

The DMCA was enacted in 1998 to address the issues of digital rights management and copyright infringement in the digital age. It provides legal protection to copyright holders against unauthorized copying, sharing, and distribution of their digital works. The legislation criminalizes the production and dissemination of technology, devices, or services intended tocircumvent measures that control access to copyrighted works (commonly known as DRM—Digital Rights Management).

DMCA Overview - U.S. Copyright Office

HIPAA (Health Insurance Portability and Accountability Act)

Purpose: Prohibits agencies from distributing an individual's health information without the individual's consent.

HIPAA, enacted in 1996, is designed to protect individuals' medical records and other personal health information. The Privacy Rule under HIPAA sets standards for the protection of health information by health plans, healthcare clearinghouses, and healthcare providers that conduct certain healthcare transactions electronically. It mandates the protection and confidential handling of protected health information (PHI).

The correct answer is D — Host-based intrusion detection system (HIDS).

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), a HIDS monitors individual servers or endpoints for suspicious activity and potential breaches. It provides real-time detection of unauthorized access and unusual behaviors on hosts.

HSM (A) protects cryptographic keys. Two-factor authentication (B) strengthens user authentication but does not monitor server activity. Antivirus tools (C) detect malware but are not designed to detect broader suspicious behaviors.

Reference Extract from Study Guide:

"Host-based intrusion detection systems (HIDS) monitor individual servers for unauthorized activities, unauthorized access attempts, and changes to critical system files."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Intrusion Detection Systems

=============================================

The correct answer is C — Competitor.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), competitors often attempt to steal intellectual property to gain a business advantage. Given the theft of valuable business assets (e-books and videos), the most likely actor is a competitor motivated by financial or market advantage, not ideology or random hacking.

An APT (A) is usually nation-state-sponsored and targets critical infrastructure. A novice hacker (B) might deface or cause damage but is less likely focused on IP theft. Hacktivists (D) are politically motivated, not financially.

Reference Extract from Study Guide:

"Competitors may engage in cyber espionage to steal intellectual property and gain market advantage, representing a significant threat to business assets."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Threat Actor Categories

The correct answer is C — Device hardening.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) teaches that device hardening involves reducing vulnerabilities by disabling unnecessary services, ports, and features. Closing unneeded network ports minimizes the attack surface and strengthens device security.

An intrusion prevention system (A) monitors and blocks threats but does not close ports directly. A web application firewall (B) protects web apps, not device configurations. An intrusion detection system (D) only alerts but does not proactively secure devices.

Reference Extract from Study Guide:

"Device hardening minimizes vulnerabilities by disabling unnecessary services and ports, securing the system against network-based attacks."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Device Hardening and Secure Configuration

=============================================

The correct answer is A — Unsecured wireless access points.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) explains that unauthorized logins to a WLAN often indicate poorly secured wireless access points, such as those lacking strong encryption (e.g., WPA2/WPA3), not using strong passwords, or having open accesswithout authentication. This vulnerability can allow attackers to access internal systems and sensitive data.

Up-to-date anti-malware software (B), a strong password policy (C), and regular security training (D) are good security practices but do not directly explain unauthorized WLAN access.

Reference Extract from Study Guide:

"Unauthorized wireless access often results from unsecured wireless configurations, including weak encryption, open networks, or default credentials, posing significant risks to organizational assets."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Wireless Security Concepts

=============================================

The correct answer is C — Control.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), the control phase of the risk management life cycle involves implementing appropriate security measures or countermeasures to mitigate or eliminate identified risks. After a risk is assessed, controls are applied to address it and reduce its impact or likelihood.

Assess (A) evaluates risk severity. Identify (B) discovers risks. Review (D) checks the effectiveness of applied controls.

Reference Extract from Study Guide:

"The control phase of risk management focuses on applying security controls and mitigations to reduce the risk to an acceptable level."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Management Life Cycle

=============================================

The correct answer is A — Intrusion detection system (IDS).

As outlined in WGU Cybersecurity Architecture and Engineering (KFO1 / D488), an IDS helps monitor network traffic for suspicious activities and security threats, making it a fundamental component of securing a network for a start-up. It enables early detection of attacks, contributing both to cybersecurity defense and incident response efforts.

Packet filtering (B) is a limited firewall technique and not as comprehensive. Bootstrapping (C) is a startup or initialization process, not a security measure. VPN (D) secures remote access but does not inherently monitor for threats.

Reference Extract from Study Guide:

"An intrusion detection system (IDS) monitors network traffic for suspicious activity and potential threats, enhancing a network’s security posture and supporting incident detection."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Network Security Monitoring and Defense

Here are your fully verified and properly formatted answers for this final batch, based on WGU Cybersecurity Architecture and Engineering (KFO1 / D488) official materials:

=============================================

The correct answer is B — Avoid.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) materials explain that risk avoidance involves eliminating the source of risk entirely. In this scenario, by decommissioning the vulnerable website and starting anew, the organization is removing the risky environment instead of trying to fix or transfer the risk, which is a clear example of risk avoidance.

Accepting (A) would mean tolerating the risk without action. Transferring (C) would involve shifting the risk to a third party (like insurance). Mitigating (D) would involve reducing the risk without removing the vulnerable system.

Reference Extract from Study Guide:

"Risk avoidance entails eliminating the conditions that expose the organization to a threat, thereby completely removing the associated risk."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Response Strategies

The IT role responsible for the installation and maintenance of hardware and software that make up a computer network is the Network Administrator. Their responsibilities include:

Network installation: Setting up and configuring network hardware, such as routers, switches, firewalls, and servers.

Network maintenance: Ensuring the network operates smoothly, performing regular updates, and troubleshooting issues.

Security management: Implementing security measures to protect the network from unauthorized access, attacks, and breaches.

Performance monitoring: Monitoring network performance and making necessary adjustments to optimize speed and reliability.

Therefore, the Network Administrator is the correct role for these responsibilities.

References

William Stallings, "Data and Computer Communications," Pearson.

Andrew S. Tanenbaum and David J. Wetherall, "Computer Networks," Pearson.

The characteristic of quality data represented here is relevance. When an organization sends customers email messages based on their purchase patterns, it ensures that the information is relevant to the customers' interests and needs. Relevant data is tailored to the specific context in which it is used, enhancing its value and effectiveness.

IT infrastructure encompasses all the physical and virtual resources that support the flow,storage, processing, and analysis of data. Networks, which include the internet, intranets, and extranets, are fundamental components of IT infrastructure as they enable communication and data exchange between different hardware and software components.

The correct answer is A — Conducting regular vulnerability assessments and penetration testing.

According to the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) materials, performing vulnerability assessments and penetration testing helps identify weaknesses in both hardware and virtual environments. Regular testing ensures that any hardware-related vulnerabilities are discovered and addressed before they can be exploited.

Disabling CPU virtualization support (B) would prevent virtual machines from running, defeating the purpose. A web application firewall (C) monitors traffic at the application layer but does not address hardware risks. Access control policies (D) are important but not directly tied to detecting hardware vulnerabilities.

Reference Extract from Study Guide:

"Regular vulnerability assessments and penetration testing identify weaknesses in hardware and software environments, providing critical insights for maintaining a hardened and secure posture."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Security Testing and Assessment

=============================================

Desktops typically have more memory (RAM) and internal storage (hard drives or SSDs) compared to handheld computers. This allows desktops to handle more intensive computingtasks and store larger amounts of data. Handheld devices, on the other hand, prioritize portability and battery life over high storage and memory capacity.

Parallel conversion is a system deployment method where the new system is implemented and runs alongside the old system for a period of time. This method allows for:

Comparison of outputs: Ensuring that the new system produces the same or better results as the old system.

Risk reduction: If there are issues with the new system, the old system can still be used without interrupting business operations.

User adaptation: Users can get accustomed to the new system while still having access to the familiar old system.

Parallel conversion is often used to minimize the risk associated with deploying a new system.

References

Harold Kerzner, "Project Management: A Systems Approach to Planning, Scheduling, and Controlling," Wiley.

Kathy Schwalbe, "Information Technology Project Management," Cengage Learning.

A database driver is a software component that enables communication between an application and a database.

Function: It acts as a bridge, allowing applications to send queries to the database and retrieve results.

Types: Common database drivers include ODBC (Open Database Connectivity) and JDBC (Java Database Connectivity).

References

"Database System Concepts" by Abraham Silberschatz, Henry F. Korth, and S. Sudarshan

"Data Management for Researchers" by Kristin Briney

Top of Form

The correct answer is C — Structured Query Language (SQL) injection attacks.

As per WGU Cybersecurity Architecture and Engineering (KFO1 / D488), a Web Application Firewall (WAF) protects web applications by filtering and monitoring HTTP traffic. It isspecifically effective against attacks such as SQL injection, cross-site scripting (XSS), and other application-layer vulnerabilities.

Phishing (A) and social engineering (D) involve human deception, not web application vulnerabilities. Brute force attacks (B) typically target authentication but are not the primary focus of a WAF.

Reference Extract from Study Guide:

"A web application firewall (WAF) detects and prevents attacks against web applications, including SQL injection and cross-site scripting (XSS)."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Web Application Firewall and Threat Protection

=============================================

The correct answer is B — Advanced Encryption Standard (AES).

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), AES is a widely adopted symmetric encryption standard that ensures the confidentiality and integrity of sensitive data, including patient health information, which HIPAA mandates to protect. AES is considered highly secure and efficient for encrypting stored or transmitted healthcare data.

WEP (A) is outdated and insecure. SMTP (C) is a protocol for sending emails, not encryption. RSA (D) is an asymmetric encryption method typically used for key exchanges, not bulk data encryption.

Reference Extract from Study Guide:

"Advanced Encryption Standard (AES) is recommended for encrypting sensitive healthcare data, providing strong protection for confidentiality and integrity in HIPAA-regulated environments."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Encryption Standards and Regulatory Compliance

=============================================

The SQL statement provided is:

SELECT*FROMCustomersWHEREState ='Arizona';

SELECT *indicates that all columns from the table should be selected.

FROM Customersspecifies the table from which to retrieve the data.

WHERE State = 'Arizona'filters the results to include only those records where the State column has the value 'Arizona'.

Therefore, the statement returns all records from the Customers table that are located in Arizona.

AnIntrusion Prevention System (IPS)detects and blocks malicious activity in real time based on defined policies or behavior patterns. IPS tools can enforcerate limiting,connection attempts, and evenauto-blockingafter repeated failures.

NIST SP 800-94 Rev. 1:

“Intrusion prevention systems not only detect potential incidents but actively prevent attempts such as brute-force attacks on services like SSH.”

Firewalls may filter traffic, but only an IPSactively terminates or blocks behavior-based threats like repeated failed logins.

???? WGU Course Alignment:

Domain:Network Security

Topic:Deploy and configure IPS for automated protection against brute-force attacks

The correct answer is A — Electronic codebook (ECB).

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), ECB mode is the simplest and most basic mode of operation for block ciphers. It encrypts each block of plaintext independently with the same key, but identical plaintext blocks produce identical ciphertext blocks, providing no additional confidentiality beyond the block cipher itself and making patterns visible.

CBC (B), CTR (C), and OFB (D) are more secure and avoid patterns.

Reference Extract from Study Guide:

"Electronic Codebook (ECB) mode encrypts each block independently and is simple but reveals patterns when identical plaintext blocks occur, thus offering minimal confidentiality beyond the underlying cipher."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Block Cipher Modes of Operation

=============================================

The correct answer is A — Calculating and comparing the hash values of the software code before and after transfer using FTP can help detect any changes and ensure the integrity of the code.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), verifying the integrity of transferred files can be done by using cryptographic hash functions. Comparing pre- and post-transfer hashes ensures that the data was not tampered with during transmission.

Intrusion detection (B) focuses on unauthorized access. Access control (C) protects the server but does not ensure file integrity. Backups (D) provide data recovery but do not validate file integrity during transfers.

Reference Extract from Study Guide:

"Hashing verifies data integrity by allowing a comparison of original and received file values, ensuring no tampering occurred during transit."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Data Integrity Assurance

=============================================

A system administrator is responsible for managing, installing, and maintaining an organization's computer systems and networks. This role involves configuring new hardware, setting up user accounts, troubleshooting system and network issues, and ensuring the systems run efficiently.

Proprietary softwareis a type of software that is owned by an individual or a company.

It is usually sold commercially and comes with acommercial software license.

This type of license typically restricts the ways in which the software can be used, modified, and distributed.

Users must agree to the terms of the license, which often include restrictions on copying, sharing, and modifying the software.

Example:Microsoft Windows and Adobe Photoshop are proprietary software products.

The correct answer is D — Block ciphers.

Per the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) materials, block ciphers encrypt fixed-size blocks of data at a time, providing strong security suitable for data at rest, such as databases. Though they may be less performance-efficient compared to stream ciphers, their strength makes them ideal for securing stored sensitive information.

Stream ciphers (A) are optimized for real-time encryption, not stored data. Asymmetric encryption (B) is slower and more suited for key exchange rather than large data encryption. Hash functions (C) provide integrity verification, not encryption.

Reference Extract from Study Guide:

"Block ciphers encrypt fixed-length blocks of data, providing robust security ideal for protecting data at rest, such as sensitive database information."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Encryption Technologies

=============================================

The correct answer is D — Security information and event management (SIEM).

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), a SIEM collects and correlates event data from multiple sources (such as cloud and on-premisesenvironments) in real-time. It provides centralized visibility, analysis, and alerting, which is critical in hybrid cloud deployments.

File integrity monitoring (A) watches for unauthorized file changes, not event correlation. DLP (B) protects sensitive data but does not correlate events. IDS (C) detects network intrusions but does not combine event data centrally.

Reference Extract from Study Guide:

"Security information and event management (SIEM) systems collect, normalize, correlate, andanalyze security event data from multiple sources, providing centralized monitoring and alerting."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Security Monitoring and Event Management

=============================================

To protect datain use(within memory), the provider must implementhardware-level memory encryptionandtrusted execution environments(secure enclaves), which protect against cold boot attacks, memory scraping, and unauthorized access.

NIST SP 800-207A (Hardware-Enabled Security: Enclaves):

“Trusted execution environments and memory encryption mechanisms help ensure that data remains protected even when systems are compromised at lower levels.”

This is amodern cloud security best practiceespecially useful forconfidential computingenvironments.

???? WGU Course Alignment:

Domain:System Security Engineering / Cryptography

Topic:Protect data in use with hardware-based encryption and enclaves

The correct answer is C — Reverse proxy.

As per the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) course content, a reverse proxy server acts on behalf of web servers by caching static content (such as images, scripts, and HTML files), significantly reducing server load. It also provides an additional layer of protection by hiding the backend servers from direct exposure to clients and enabling centralized application of security policies such as SSL termination and Web Application Firewall (WAF) integration.

Firewall rule changes (A) manage access control but do not handle caching or reduce load. An IDS (B) monitors for intrusions but doesn’t offload traffic or cache content. NAT (D) translates IP addresses but doesn't cache content or add a protection layer.

Reference Extract from Study Guide:

"A reverse proxy server provides caching capabilities for static content and acts as a protective intermediary between client requests and backend servers, thus reducing server load and enhancing security."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Secure Network Design Concepts

=============================================

AES (Advanced Encryption Standard)is a symmetric block cipher approved by NIST for protecting sensitive data, includingelectronic protected health information (ePHI). It is the recommended encryption method underHIPAA compliance guidelines.

NIST FIPS 197 (Advanced Encryption Standard - AES):

“AES is a symmetric cipher used to protect sensitive electronic data and is approved for use in securing government and healthcare systems.”

WEP is outdated, SMTP is a protocol for email, and RSA is better suited for key exchange, not bulk data encryption.

???? WGU Course Alignment:

Domain:Cryptography and Compliance

Topic:Use NIST-approved encryption (AES) for healthcare data under HIPAA

The correct answer is C — Assess.

As per WGU Cybersecurity Architecture and Engineering (KFO1 / D488) materials, after risks have been identified, the next step in the risk management life cycle is to assess them. Assessment involves analyzing and prioritizing the risks based on their potential impact and likelihood. Only after assessment can proper strategies be formulated for controlling and mitigating the risks.

Identification (A) occurs before assessment, while reviewing (B) and controlling (D) happen later in the process.

Reference Extract from Study Guide:

"Following the identification of risks, the risk management process proceeds to risk assessment, where risks are analyzed and prioritized based on likelihood and impact to guide mitigation efforts."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Management Process

=============================================

Alpha testing is a type of system testing that involves having end users test the system with simulated data and the help of the developer. This phase is crucial because:

Early feedback: Users provide early feedback on the usability and functionality of the system.

Bug identification: Developers can identify and fix bugs before the system is released for beta testing or production.

Simulated environment: The testing is done in a controlled, simulated environment, often within the development organization.

Alpha testing is followed by beta testing, where the system is tested in a real-world environment by end users without the developers' direct involvement.

References

Ron Patton, "Software Testing," Sams Publishing.

Glenford J. Myers, "The Art of Software Testing," Wiley.

The correct answer is A — Virtual private network (VPN).

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), a VPN creates an encrypted tunnel over public or private networks, ensuring confidentiality, integrity, and authentication of data transmitted between geographically dispersed offices.

SIEM (B) manages security events, not secure communications. PPTP (C) is an outdated and insecure VPN protocol. NAC (D) enforces endpoint security but does not establish secure tunnels.

Reference Extract from Study Guide:

"A virtual private network (VPN) provides a secure, encrypted tunnel between geographically separated networks, enabling confidential communication over untrusted networks."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Secure Remote Access Technologies

Integration testingverifies the interactions and data flow between individual software components post-deployment. It is a crucial step in CI/CD pipelines, especially inmulti-tier architecturesystems like web applications.

NIST SP 800-160 Vol. 1 (Systems Security Engineering):

“Integration testing should verify that security functions behave correctly when subsystems or components are combined.”

This test type ensures system cohesion after components are deployed, unlikestatic/dynamic code analysiswhich focuses on code quality and vulnerabilities during earlier phases.

???? WGU Course Alignment:

Domain:System Security Engineering

Topic:Validate secure systems through testing in CI/CD pipelines

Real-time transaction monitoringhelps detect and respond to fraudulent activities (e.g., unauthorized access, anomalous transactions) as they happen. It’s critical in high-risk environments likeonline banking systems.

FFIEC IT Examination Handbook (Retail Payment Systems):

“Real-time fraud detection systems monitor for suspicious or anomalous transactions that may indicate identity theft, account takeover, or credit card fraud.”

This is anactive, risk-aware controlthat’s far more effective than backups or email restrictions for this use case.

???? WGU Course Alignment:

Domain:Security Operations and Monitoring

Topic:Implement real-time monitoring systems for financial fraud detection

The correct answer is B — Asymmetric encryption.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), asymmetric encryption uses a pair of public and private keys, allowing the sender to encrypt the documents with the recipient’s public key, ensuring that only the recipient’s private key can decrypt them. This guarantees confidentiality even over an unsecured network.

Stream ciphers (A) and block ciphers (C) are types of symmetric encryption, requiring a shared secret key. Hash functions (D) provide integrity, not confidentiality.

Reference Extract from Study Guide:

"Asymmetric encryption enables secure data exchange by allowing encryption with a public key and decryption only with a corresponding private key, ensuring confidentiality over unsecured networks."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Cryptographic Methods and Key Management

=============================================

The correct answer is D — Encryption to prevent man-in-the-middle and eavesdropping attacks.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) explains that while NFC is inherently short-range, it is still vulnerable to eavesdropping and man-in-the-middle attacks. Applying encryption ensures that even if communication is intercepted, the data remains protected and confidential.

Kerberos (A) is primarily for authentication within internal networks. Bluetooth restrictions (B) are unrelated to NFC. PDM (C) restricts device usage but does not directly protect NFC communication.

Reference Extract from Study Guide:

"Encrypting near-field communication ensures confidentiality and protects against interception and manipulation through man-in-the-middle and eavesdropping attacks."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Wireless and Mobile Security Concepts

Data encryptionprotects sensitive ERP system information by rendering the data unreadable to unauthorized users, even if the system is compromised. This is the most effective method to preserve confidentiality in a breach.

NIST SP 800-111 (Guide to Storage Encryption Technologies):

“Encryption ensures that even if data is exfiltrated or accessed by unauthorized individuals, it cannot be understood without the appropriate decryption keys.”

Backups and firewalls are important, butencryption directly protects data at restfrom unauthorized viewing.

???? WGU Course Alignment:

Domain:System Security Engineering

Topic:Implement encryption controls for stored business data

The correct answer is B — Wireless intrusion prevention system (WIPS).

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), a WIPS actively monitors wireless networks for unauthorized access points and malicious activity, such as man-in-the-middle (MITM) attacks. It can automatically detect, alert, and prevent wireless threats in real time, which is exactly what the organization requires to counteract MITM attacks on the wireless network.

A SIEM (A) collects logs and generates alerts but does not prevent wireless attacks. An inline encryptor (C) encrypts data but does not prevent wireless attacks. A Layer 3 switch (D) operates at the network layer and does not prevent wireless-specific threats.

Reference Extract from Study Guide:

"A wireless intrusion prevention system (WIPS) detects and prevents unauthorized access points and malicious wireless activity, including man-in-the-middle attacks."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Wireless Security and Threat Prevention

=============================================

The correct answer is A — They act as an initial defense layer for potential threats.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), security edge devices such as firewalls, secure web gateways, and intrusion prevention systems (IPS) are placed at the network perimeter to serve as the first layer of defense against external threats.

DDoS protection (B) may be part of a broader security solution but is not the main role of general edge devices. SIEM modules (C) collect and correlate logs, not defend at the perimeter. TPM devices (D) are hardware-based cryptographic modules, not network edge defenses.

Reference Extract from Study Guide:

"Security edge devices provide the first line of defense against external threats by monitoring, filtering, and blocking malicious traffic entering the corporate network."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Network Security and Perimeter Defense

The correct answer is C — ChaCha.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488) materials, ChaCha is a stream cipher developed as a variant of Salsa20. It offers enhanced security, improved performance, and resistance to cryptographic attacks. It is often combined with Poly1305 forauthenticated encryption, commonly used in modern secure communications.

CTR (A) and CBC (B) are block cipher modes, not stream ciphers. ECB (D) is a block cipher mode and is insecure due to its lack of diffusion properties.

Reference Extract from Study Guide:

"ChaCha is a modern stream cipher, evolved from Salsa20, designed for speed and security, and often used alongside Poly1305 for authenticated encryption."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Encryption Technologies

=============================================

The correct answer is B — Compare the unknown address to known IP addresses to determine if it is a threat.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), proper threat analysis requires identifying and verifying whether an unknown source is malicious before taking action. Comparing the IP address against known threat databases or intelligence feeds allows the organization to make informed decisions.

Permanently blocking (A) or temporarily blocking (C) without analysis could cause disruption if the IP is legitimate. Rate limiting (D) reduces traffic but does not determine threat status.

Reference Extract from Study Guide:

"Effective incident analysis begins by verifying and classifying the suspicious activity, including checking unknown IP addresses against threat intelligence sources."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Threat Analysis and IncidentHandling

=============================================

The correct answer is D — Installing endpoint protection software.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) teaches that endpoint protection (including antivirus, anti-malware, and endpoint detection and response) is critical for detecting,blocking, and removing commodity malware like ransomware and Trojans.

Firewalls (A) help with perimeter security but don't directly block malware on endpoints. Rerouting communications (B) is not a standard protection method. Two-factor authentication (C) secures logins but does not protect systems from malware infection.

Reference Extract from Study Guide:

"Endpoint protection software defends individual systems against malware threats by detecting, blocking, and removing malicious files and processes."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Endpoint Security Solutions

=============================================

The correct answer is C — Restrict access to the backups.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), the first step in protecting sensitive data such as cloud backups is enforcing access controls to limit who can access the data. Restricting access immediately mitigates the risk of unauthorized exposure or tampering.

Auditing access logs (A) provides insight but does not actively protect. Running vulnerability scans (B) identifies issues but does not protect immediately. Disabling repositories (D) is not practical for maintaining backup availability.

Reference Extract from Study Guide:

"Access control is the first line of defense for sensitive data repositories, ensuring that only authorized users can access backup data."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Data Security and Access Control

=============================================

The correct answer is C — Host-based firewall.

According to the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) materials, a host-based firewall enforces traffic control policies at the endpoint level. It can allow or deny traffic based on application, port, IP address, and protocol rules, restricting access to only approved services and applications on a system.

Antivirus tools (A) detect malware but do not control network traffic. Two-factor authentication (B) secures user access but does not manage network traffic. HSMs (D) handle encryption keys, not network access control.

Reference Extract from Study Guide:

"Host-based firewalls restrict traffic at the system level, permitting only authorized services and applications, enhancing endpoint security."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Endpoint Protection and Firewalls

=============================================

The correct answer is C — Data Protection Impact Assessment (DPIA).

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), a DPIA is conducted to assess how personal data is collected, stored, and processed, evaluating potential privacy impacts and defining measures to mitigate risks. This is essential for compliance with privacy laws and regulations, especially in systems handling sensitive customer information.

DR (A) and BCP (B) are about operational recovery, not data privacy. Risk management (D) is broader and not focused solely on privacy impact.

Reference Extract from Study Guide:

"A Data Protection Impact Assessment (DPIA) evaluates the effects of processing activities on the privacy of individuals and develops strategies to mitigate privacy risks."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Data Privacy and Protection Strategies

=============================================

The correct answer is B — Internet Protocol Security (IPsec).

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), IPsec provides secure communication over IP networks by encrypting and authenticating IP packets. It is widely used for site-to-site VPNs and ensures confidentiality, integrity, and authentication between different cloud environments like Azure and AWS.

TCP (A) is a transport layer protocol ensuring reliable delivery but not encryption. FTP (C) is used for file transfer and is insecure unless secured with extensions. SSH (D) secures remote terminal sessions but is not primarily used for network-wide secure communication.

Reference Extract from Study Guide:

"IPsec provides a secure method of communication across IP networks, ensuring data confidentiality, integrity, and authentication for VPN connections and hybrid cloud communications."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Secure Protocols for Hybrid Environments

=============================================

The correct answer is B — Implementing security patches and updates on a regular basis and using hybrid cloud topology.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) emphasizes that timely application of security patches is critical to addressing vulnerabilities like outdated software. A hybrid cloud topology offers the flexibility and scalability needed by financial institutions while keeping sensitive data protected in more controlled environments.

Strong password policies (A) help, but public cloud alone may not be best for sensitive banking systems. Antivirus (C) addresses only part of the threat. Private cloud (D) improves security but may not offer the scalability benefits of a hybrid approach.

Reference Extract from Study Guide:

"Timely application of security patches mitigates vulnerabilities, and hybrid cloud models balance the need for scalability and sensitive data protection in financial institutions."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Mitigation Strategies and Cloud Topologies

=============================================

Data support an organization's business goals by providing crucial information that aids in making informed decisions. Analyzing data helps identify trends, measure performance, and uncover insights that drive strategic planning and operational improvements. This informed decision-making process is vital for achieving business goals and staying competitive in the market.

Wireless Intrusion Prevention Systems (WIPS)are specifically designed to monitor wireless networks and prevent rogue access points, MITM attacks, and wireless eavesdropping. Unlike Layer 3 switches or SIEM tools, WIPS directly addresses wireless threat vectors.

NIST SP 800-153 (Guidelines for Securing Wireless Local Area Networks):

“WIPS technologies help detect and prevent unauthorized wireless access points and attacks such as evil twin and man-in-the-middle attempts.”

???? WGU Course Alignment:

Domain:Network Security

Topic:Implement wireless network protections (e.g., WIPS)

Anoperating system (OS)is a system software that manages computer hardware and software resources and provides common services for computer programs.

It serves as an intermediary between users and the computer hardware.

Key functionsof an OS include:

Managinghardware resourceslike the CPU, memory, and I/O devices.

Providing auser interface(UI) for interaction with the system.

File managementand handling file operations.

Process managementand multitasking.

Securityand access control.

Examples include Windows, Linux, and macOS.

Business continuity planning (BCP) is essential because it ensures that an organization can quickly resume its critical functions after a disruption. The key aspects include:

Minimizing downtime: Strategies to restore business operations as quickly as possible.

Risk management: Identifying potential threats and creating plans to mitigate their impact.

Data recovery: Ensuring that data can be restored quickly in the event of a loss.

Communication plans: Establishing protocols for communicating with employees, customers, and stakeholders during and after a disruption.

The primary goal of BCP is to ensure the quickest return to business operations, maintaining service levels and minimizing financial losses.

References

Andrew Hiles, "The Definitive Handbook of Business Continuity Management," Wiley.

Michael Wallace and Lawrence Webber, "The Disaster Recovery Handbook," AMACOM.

The correct answer is A — Tactical.

Based on WGU Cybersecurity Architecture and Engineering (KFO1 / D488) study material, tactical threat intelligence provides technical details such as indicators of compromise (IOCs), IP addresses, file hashes, domain names, and other evidence needed to detect and respond to threats immediately. This type of intelligence is used by security teams to perform real-time monitoring and incident response.

Operational intelligence (C) addresses campaigns or actor behavior but is not immediately actionable. Strategic intelligence (D) provides high-level, long-term threat trends. Commodity malware (B) refers to low-level malware types, not intelligence classifications.

Reference Extract from Study Guide:

"Tactical threat intelligence focuses on technical indicators of compromise (IOCs) and immediate actionable information that responders use to detect and contain active threats."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Threat Intelligence Concepts

=============================================

The correct answer is C — Implementation of encryption for all data stored in the system.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) emphasizes that encrypting data at rest ensures that even if storage systems are compromised, the data remains confidential and secure.

Password changes (A) help secure user accounts but not stored data. Firewall policies (B) and VPNs (D) protect data in transit and access control but not the storage layer itself.

Reference Extract from Study Guide:

"Encrypting data at rest ensures that stored data remains confidential and protected from unauthorized access, even if storage devices are compromised."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Data Protection Strategies

=============================================

An unknown IP address successfully logging in viaSSHindicates that authentication was achieved — likely due toweak or reused passwords. This is not enumeration or vulnerability exploitation, but acredential-based compromise.

NIST SP 800-118 (Guide to Enterprise Password Management):

“Weak, default, or reused passwords are among the most exploited vulnerabilities in enterprise networks, particularly on remote access services such as SSH.”

This is one of the most common findings inSIEM alertswhen password policies and access control mechanisms are improperly enforced.

???? WGU Course Alignment:

Domain:System Security Engineering

Topic:Implement strong authentication practices and monitor remote access

The correct answer is B — Risk mitigation.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488) course content, risk mitigation involves taking steps to reduce either the likelihood or the impact of risks. Since the healthcare provider plans to implement tools to lower the risks identified at the clinic, it is using a mitigation strategy, not avoiding, transferring, or simply accepting the risk.

Risk acceptance (A) means taking no action. Risk transference (C) shifts responsibility elsewhere, such as through insurance. Risk avoidance (D) involves eliminating the risky activity entirely.

Reference Extract from Study Guide:

"Risk mitigation is the process of implementing measures to reduce the likelihood or impact of identified risks, often through security controls or operational changes."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Response Strategies

The employee needs to execute a program from the command line, which requires inputting commands into the computer.

The primary device for inputting commands is the keyboard.

Other options like the hard drive, speaker, and printer are not used for inputting commands.

The hard drive is used for data storage.

The speaker outputs sound.

The printer outputs documents.

Therefore, the correct peripheral device for this task is the keyboard.