Updated Oct 25, 2025 Verified Pass Cybersecurity-Architecture-and-Engineering Exam in First Attempt Guaranteed
Free Cybersecurity-Architecture-and-Engineering Sample Questions and 100% Cover Real Exam Questions (Updated 215 Questions)
NEW QUESTION # 86
A government agency is planning a hybrid cloud deployment. Strict controls must be in placethat can label classified data. The solution must ensure that access rights will be granted based on the user's government security classification.
- A. Role-Based Access Control (RBAC)
- B. Mandatory Access Control (MAC)
- C. Attribute-Based Access Control (ABAC)
Answer: B
Explanation:
Mandatory Access Control (MAC)is the access control model used in environments that manage classified information such as government or military systems. Under MAC, access is based onsecurity labels(e.g., Top Secret, Confidential), and userscannot changeaccess controls.
NIST SP 800-53 Rev. 5 - AC-3 (Access Enforcement):
"MAC policies enforce access based on system-enforced labels, without user discretion, and are ideal for high- security environments where strict data control is essential." MAC is theonly modelwhere access control decisions arecentrally controlled and enforced by a policy administrator, making it ideal for environments requiringdata labeling and user classification.
#WGU Course Alignment:
Domain:Access Control and Identity Management
Topic:Understand and apply MAC for high-security environments
NEW QUESTION # 87
A large healthcare provider is acquiring a small clinic and has identified a full understanding of the clinic's organizational risks. The large provider has several tools it can implement to reduce the clinic's identified risks.
Which type of risk response should the healthcare provider use?
- A. Risk transference
- B. Risk mitigation
- C. Risk avoidance
- D. Risk acceptance
Answer: B
Explanation:
The correct answer is B - Risk mitigation.
According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488) course content, risk mitigation involves taking steps to reduce either the likelihood or the impact of risks. Since the healthcare provider plans to implement tools to lower the risks identified at the clinic, it is using a mitigation strategy, not avoiding, transferring, or simply accepting the risk.
Risk acceptance (A) means taking no action. Risk transference (C) shifts responsibility elsewhere, such as through insurance. Risk avoidance (D) involves eliminating the risky activity entirely.
Reference Extract from Study Guide:
"Risk mitigation is the process of implementing measures to reduce the likelihood or impact of identified risks, often through security controls or operational changes."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Response Strategies
NEW QUESTION # 88
A company has discovered a vulnerability in its domain name system (DNS) that could allow attackers to redirect users to malicious websites. The company has decided to implement a risk management strategy to mitigate this vulnerability.
What is the most effective risk management strategy for this vulnerability?
- A. Conducting regular security awareness training for employees on the risks of phishing attacks
- B. Restricting DNS access to trusted internet protocol (IP) addresses only
- C. Increasing the frequency of DNS server patching
- D. Implementing domain name system security extensions (DNSSEC) to digitally sign DNS responses and prevent DNS spoofing attacks
Answer: D
Explanation:
The correct answer is B - Implementing domain name system security extensions (DNSSEC) to digitally sign DNS responses and prevent DNS spoofing attacks.
WGU Cybersecurity Architecture and Engineering (KFO1 / D488) teaches that DNSSEC protects the integrity and authenticity of DNS responses, thereby preventing DNS spoofing (also called DNS cache poisoning), which could redirect users to malicious sites.
Restricting DNS access (A) is not sufficient against spoofing. Increasing patching frequency (C) is good practice but does not specifically stop spoofing. Security awareness training (D) helps against phishing, not DNS vulnerabilities.
Reference Extract from Study Guide:
"DNSSEC digitally signs DNS data to ensure the integrity and authenticity of DNS responses, mitigating risks such as DNS spoofing and cache poisoning."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Secure Networking Protocols
NEW QUESTION # 89
Which data type should be used to calculate 90% of the retail price of an item?
- A. Auto-number
- B. Floating-point
- C. Boolean
- D. String
Answer: B
Explanation:
A floating-point data type is used for numerical calculations that require a decimal point, such as percentages.
In this case, to calculate 90% of the retail price of an item, a floating-point data type is necessary because it can represent both the whole number and the fractional part of the number, allowing for precise calculations.
NEW QUESTION # 90
A company has recently implemented a hybrid cloud deployment. The security team has been notified about thousands of failed attempts to connect to routers and switches in the on-premises network. A solution must be implemented to block connections after three unsuccessful SSH attempts on any network device.
- A. Data Loss Prevention
- B. Firewall
- C. Intrusion Prevention System (IPS)
Answer: C
Explanation:
AnIntrusion Prevention System (IPS)detects and blocks malicious activity in real time based on defined policies or behavior patterns. IPS tools can enforcerate limiting,connection attempts, and evenauto- blockingafter repeated failures.
NIST SP 800-94 Rev. 1:
"Intrusion prevention systems not only detect potential incidents but actively prevent attempts such as brute- force attacks on services like SSH." Firewalls may filter traffic, but only an IPSactively terminates or blocks behavior-based threats like repeated failed logins.
#WGU Course Alignment:
Domain:Network Security
Topic:Deploy and configure IPS for automated protection against brute-force attacks
NEW QUESTION # 91
Which two options allow an application to access a database?
Choose 2 answers
- A. Open Database Connectivity (ODBC) application
- B. Graphical user interface (GUI)
- C. Structured Query Language (SQL)
- D. Java Database Connectivity (JDBC)
- E. Database management system (DBMS)
Answer: C,D
Explanation:
* SQLis a standard language used to communicate with and manage databases. It allows applications to perform operations such as querying, updating, and managing data.
* JDBCis an API in Java that enables Java applications to interact with databases. It provides methods for querying and updating data in a database using SQL.
* DBMS (Database Management System)is the system software for creating and managing databases but not directly used by applications for database access.
* ODBC (Open Database Connectivity)is another standard API but specific to applications in a broader range of languages and platforms.
* GUI (Graphical User Interface)is a user interface and not a method for applications to access databases.
References:
* "SQL: The Complete Reference" by James R. Groff and Paul N. Weinberg.
* "Java Database Connectivity: JDBC and Java" by Daniel K. Akers.
NEW QUESTION # 92
Which is true about access rights?
- A. They limit users to permitted items.
- B. They are defined by the machine language.
- C. They are part of the System Development Life Cycle.
- D. They require the use of a compiler.
Answer: A
Explanation:
Access rights are critical components of access control mechanisms in information security. They specify what actions users or systems can perform on specific resources, limiting them to only permitted items.
* Definition: Access rights, also known as permissions, are rules that define the allowed actions on a resource (e.g., read, write, execute).
* Implementation: Access rights are typically implemented using Access Control Lists (ACLs), Role-Based Access Control (RBAC), or other access control models.
* Purpose: The main goal is to enforce the principle of least privilege, ensuring that users can only access the resources necessary for their role.
References
* NIST Special Publication 800-53
* ISO/IEC 27001:2013
* "Computer Security: Principles and Practice" by William Stallings
NEW QUESTION # 93
What is the role of the CPU in a computing environment?
Choose 2 answers
- A. Connecting components to the system unit
- B. Containing an arithmetic logic unit (ALU) that performs arithmetic and logic operations
- C. Storing data as it is being processed
- D. Directing electrical current over the circuit board
- E. Carrying out the instructions of a computer program
Answer: B,E
Explanation:
* TheCentral Processing Unit (CPU)is the primary component of a computer that performs most of the processing inside a computer.
* Carrying out the instructions of a computer program: The CPU executes program instructions, which are the basic tasks that tell the computer what to do.
* Containing an arithmetic logic unit (ALU): The ALU performs all arithmetic and logic operations, such as addition, subtraction, and comparison.
* The CPU also manages data flow between the computer's other components.
* It fetches instructions from memory, decodes them, and then executes them, which involves performing calculations and making decisions.
References:
"Computer Organization and Design: The Hardware/Software Interface" by David A. Patterson and John L.
Hennessy.
"Modern Processor Design: Fundamentals of Superscalar Processors" by John Paul Shen and Mikko H.
Lipasti.
NEW QUESTION # 94
A company is looking to monitor and detect any suspicious activity on its servers. The company wants to implement a security solution that can detect any unauthorized access or unusual activity on the servers.
Which security technology will meet the needs of this company?
- A. Antivirus tools
- B. Two-factor authentication
- C. Hardware security module (HSM)
- D. Host-based intrusion detection system (HIDS)
Answer: D
Explanation:
The correct answer is D - Host-based intrusion detection system (HIDS).
According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), a HIDS monitors individual servers or endpoints for suspicious activity and potential breaches. It provides real-time detection of unauthorized access and unusual behaviors on hosts.
HSM (A) protects cryptographic keys. Two-factor authentication (B) strengthens user authentication but does not monitor server activity. Antivirus tools (C) detect malware but are not designed to detect broader suspicious behaviors.
Reference Extract from Study Guide:
"Host-based intrusion detection systems (HIDS) monitor individual servers for unauthorized activities, unauthorized access attempts, and changes to critical system files."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Intrusion Detection Systems
NEW QUESTION # 95
A company wants to ensure that the integrity of its systems is maintained during the startup process.
Which security technology can ensure the integrity of the system during startup by verifying that the system has not been compromised?
- A. Two-factor authentication
- B. Hardware security module (HSM)
- C. Intrusion detection system (IDS)
- D. Measured boot
Answer: D
Explanation:
The correct answer is D - Measured boot.
WGU Cybersecurity Architecture and Engineering (KFO1 / D488) explains that Measured Boot, often implemented with Trusted Platform Modules (TPMs), ensures that each component of theboot process is verified for integrity. It provides cryptographic evidence that the system's startup sequence has not been tampered with.
Two-factor authentication (A) secures user logins but does not verify boot integrity. IDS (B) monitors network or host behavior but does not protect the boot process. HSM (C) secures cryptographic operations, not the system boot.
Reference Extract from Study Guide:
"Measured Boot verifies the integrity of the boot process, providing assurance that the system has not been compromised during startup."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), System Hardening and Trusted Computing
NEW QUESTION # 96
A corporate website is currently being redesigned, which leaves it vulnerable to security threats. Management does not want to provide an attacker with any information about the web server.
Which strategy should be used to prevent an attacker from gaining unauthorized information?
- A. Becoming Payment Card Industry Data Security Standard (PCI-DSS) compliant and certified
- B. Using Hypertext Transfer Protocol Secure (HTTPS) for all page and content requests
- C. Enabling Hypertext Transfer Protocol Secure (HTTPS) over Domain Name Service (DNS)
- D. Obfuscating error messages on the site or within the uniform resource locator (URL)
Answer: D
Explanation:
The correct answer is C - Obfuscating error messages on the site or within the uniform resource locator (URL).
WGU Cybersecurity Architecture and Engineering (KFO1 / D488) states that minimizing the information revealed through error messages and URLs prevents attackers from gathering reconnaissance information that could be used to exploit vulnerabilities.
HTTPS (A and B) protects data in transit but does not conceal server details. PCI-DSS certification (D) improves overall security but is not focused specifically on information disclosure during a redesign.
Reference Extract from Study Guide:
"Obfuscating detailed error messages and removing revealing information in URLs help prevent attackers from gaining reconnaissance data that could be used in targeted attacks."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Web Application Security
NEW QUESTION # 97
An IT team must allow on-premises users to log in to the Azure portal using their corporate credentials.
Which strategy should be used to enable identity federation in this scenario?
- A. Integrating with lightweight directory access protocol (LDAP)
- B. Encrypting with Transport Layer Security (TLS)
- C. Configuring third-party authentication with Security Assertion Markup Language (SAML)
- D. Deploying a hardware-based two-factor authentication (2FA) solution
Answer: C
Explanation:
The correct answer is D - Configuring third-party authentication with Security Assertion Markup Language (SAML).
According to the WGU KFO1 / D488 Study Guide, SAML enables Single Sign-On (SSO) and federated identity across different domains by securely exchanging authentication and authorization data between an identity provider (such as an organization's Active Directory Federation Services) and a service provider (such as Azure). This allows on-premises users to log into cloud services using their existing corporate credentials.
TLS (A) provides secure communication but does not manage identity federation. 2FA (B) strengthens authentication but is not about identity federation setup. LDAP (C) is a protocol for accessing directory services, not specifically designed for federation across cloud platforms.
Reference Extract from Study Guide:
"SAML is used to implement Single Sign-On (SSO) and federated identity management, allowing organizations to extend on-premises authentication capabilities to cloud services seamlessly."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Identity and Access Management Concepts
NEW QUESTION # 98
Which is true about access rights?
- A. They limit users to permitted items.
- B. They are defined by the machine language.
- C. They are part of the System Development Life Cycle.
- D. They require the use of a compiler.
Answer: A
Explanation:
Access rights are critical components of access control mechanisms in information security. They specify what actions users or systems can perform on specific resources, limiting them to only permitted items.
Definition: Access rights, also known as permissions, are rules that define the allowed actions on a resource (e.
g., read, write, execute).
Implementation: Access rights are typically implemented using Access Control Lists (ACLs), Role-Based Access Control (RBAC), or other access control models.
Purpose: The main goal is to enforce the principle of least privilege, ensuring that users can only access the resources necessary for their role.
References
NIST Special Publication 800-53
ISO/IEC 27001:2013
"Computer Security: Principles and Practice" by William Stallings
NEW QUESTION # 99
What is a component of IT infrastructure?
- A. Printer
- B. People
- C. Data
- D. Networks
Answer: D
Explanation:
IT infrastructure encompasses all the physical and virtual resources that support the flow,storage, processing, and analysis of data. Networks, which include the internet, intranets, and extranets, are fundamental components of IT infrastructure as they enable communication and data exchange between different hardware and software components.
NEW QUESTION # 100
What is the vocabulary and set of rules for instructing a computer to perform certain tasks?
- A. Translator language
- B. Programming language
- C. Low-level language
- D. Machine language
Answer: B
Explanation:
A programming language is a formal language comprising a set of instructions that produce various kinds of output. Programming languages are used in computer programming to implement algorithms and manipulate data. They provide the vocabulary and grammatical rules for instructing a computer to perform specific tasks, allowing developers to write software programs that can be executed by a computer.
NEW QUESTION # 101
......
Download Real WGU Cybersecurity-Architecture-and-Engineering Exam Dumps Test Engine Exam Questions: https://www.pass4guide.com/Cybersecurity-Architecture-and-Engineering-exam-guide-torrent.html
Verified Cybersecurity-Architecture-and-Engineering Dumps Q&As - Cybersecurity-Architecture-and-Engineering Test Engine with Correct Answers: https://drive.google.com/open?id=1E3f3GQF3MWL27oO_hw2JN8OB1uRoCue2