WGU Cybersecurity-Architecture-and-Engineering WGU Cybersecurity Architecture and Engineering (KFO1/D488) Exam Practice Test

Packet sniffing is a technique used to capture and analyze network traffic, which can include intercepting passwords while they are in transit.

When data packets are transmitted over a network, a packet sniffer can capture these packets, and if they are not encrypted, it can read sensitive information like passwords.

The other options:

Buffer overflow is a type of attack that exploits a program's memory handling.

Phishing is a social engineering attack to deceive users into providing sensitive information.

Black hat refers to a hacker with malicious intent, not a specific technique.

Therefore, packet sniffing is the correct technique for obtaining passwords in transit.

Preventing unauthorized access and impersonation during exams or coursework is critical in e-learning platforms.Strong user authentication(e.g., MFA, CAPTCHA, secure login mechanisms) ensures that only authorized users access exams and coursework.

NIST SP 800-63B (Digital Identity Guidelines – Authentication):

“Secure user authentication ensures the identity of individuals accessing sensitive applications, reducing the risk of impersonation and credential misuse.”

Firewall rules and patching are important, but they don't directly addressuser-level fraud prevention.

????WGU Course Alignment:

Domain:Access Control and Identity Management

Topic:Secure authentication mechanisms for web platforms

The correct answer is A — Implementing secure encrypted enclaves and Advanced Micro Devices (AMD) Secure Memory Encryption.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) explains that encryption at the memory level (such as AMD SME) and secure enclaves protect data in volatile memory, safeguarding it even if physical attacks occur.

Security training (B), antivirus (C), and password policies (D) improve security generally but do not specifically address data in volatile memory.

Reference Extract from Study Guide:

"Encrypted enclaves and secure memory encryption protect sensitive data in volatile storage, maintaining confidentiality and integrity even during advanced attacks."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Server and Memory Security Controls

=============================================

The correct answer is C — Encrypting data.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) states that encryption is the best defense against man-in-the-middle attacks because even if traffic is intercepted, the data remains unreadable without the appropriate decryption keys.

Disabling Wi-Fi (A) is not practical and does not eliminate MITM threats entirely. Password policies (B and D) strengthen account security but do not protect data transmission.

Reference Extract from Study Guide:

"Encryption ensures the confidentiality of data in transit, preventing unauthorized parties from accessing the content even during man-in-the-middle attacks."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Data Transmission Security

=============================================

Desktops typically have more memory (RAM) and internal storage (hard drives or SSDs) compared to handheld computers. This allows desktops to handle more intensive computingtasks and store larger amounts of data. Handheld devices, on the other hand, prioritize portability and battery life over high storage and memory capacity.

Recovery Point Objective (RPO)defines themaximum acceptable amount of data lossmeasured in time. It determines how often backups should occur to avoid losing critical business data.

NIST SP 800-34 Rev. 1:

“RPO represents the point in time prior to an outage to which systems and data must be restored to resume business operations.”

CDP is a method; RPO is thestrategic planning metric.

????WGU Course Alignment:

Domain:Business Continuity and Disaster Recovery

Topic:Define RPO to support data resilience and backup planning

The correct answer is D — Implementation of licensing technologies in order to restrict unauthorized access to the system.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), using licensing technologies helps prevent software piracy by ensuring that only authorized users with valid licenses can access and operate the system. License management solutions validate user access and reduce unauthorized duplication or usage of proprietary software.

Disabling external devices (A) protects against physical data theft but not piracy. Encrypting patient data (B) protects confidentiality but not against software piracy. Virus scanning (C) detects malware, not unauthorized software copying.

Reference Extract from Study Guide:

"Licensing technologies enforce legal software use and prevent unauthorized access, helping organizations protect intellectual property and defeat piracy efforts."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Software and Intellectual Property Protection

=============================================

An input device is any hardware component that allows a user to enter data into a computer.

A scanner is an input device that converts physical documents into digital format.

The other options:

Printer is an output device.

Flash drive is a storage device.

CD can be both storage and media for input/output depending on the context but is not primarily used for direct data input.

Therefore, a scanner is the correct answer for an input device.

The domain name in a Uniform Resource Locator (URL) identifies the server on which the web page can be found.

Example: In the URL "http://www.example.com/index.html":

"http" is the protocol.

"www.example.com" is the domain name.

"/index.html" is the resource path ID.

The other options:

The protocol specifies the communication method.

The resource path ID specifies the specific page or resource on the server.

The IP address is not typically visible in the URL itself but can be resolved via DNS.

Therefore, the domain name is the correct part that identifies the server.

SIEM systemsconsolidate logs and events from across the enterprise and apply behavior analysis and correlation rules to detect suspicious activity, including lateral movement, brute force, and privilege escalation.

NIST SP 800-137 (Information Security Continuous Monitoring for Federal Information Systems and Organizations):

“SIEM solutions provide security teams with insight into potentially malicious activity and enable proactive incident detection and response.”

????WGU Course Alignment:

Domain:Security Operations and Monitoring

Topic:Utilize SIEM for real-time user behavior analysis

The correct answer is B — Secure Hash Algorithm 256 (SHA-256).

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) outlines that SHA-256 is a cryptographic hash function used to verify data integrity. It generates a fixed-size hash value based on input data, and any alteration to the data results in a different hash, signaling tampering.

DES (A) and AES (C) are encryption algorithms for confidentiality. RSA (D) is used for encryption and digital signatures, not solely for ensuring integrity via hashing.

Reference Extract from Study Guide:

"SHA-256 is a widely adopted cryptographic hash function used to verify the integrity of digital data and detect unauthorized modifications."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Cryptographic Hash Functions and Data Integrity

=============================================

The System Development Life Cycle (SDLC) is a process used for planning, creating, testing, and deploying an information system. It involves several stages, including requirements gathering, system design, implementation, testing, deployment, and maintenance. The SDLC ensures that the system meets the needs of users and is developed in a structuredand efficient manner.

The correct answer is B — Public key infrastructure (PKI).

According to the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) Study Guide, PKI is the framework that enables the issuance and management of digital certificates used for device authentication. By using certificates, devices can securely authenticate themselves to access corporate resources without relying solely on passwords.

VPNs (A) secure network connections but do not authenticate devices themselves. Certificate signing (C) is a part of PKI but not the complete infrastructure. Endpoint passwords (D) authenticate users, not necessarily the devices.

Reference Extract from Study Guide:

"Public key infrastructure (PKI) enables the issuance of digital certificates used for authenticating users, systems, and devices, ensuring secure access control."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Cryptography and PKI Concepts

=============================================

Homomorphic encryptionallows computation on ciphertexts, producing encrypted results that, when decrypted, match the results of operations performed on plaintext. This enablessecure outsourcing of computationwithout exposing sensitive data.

NIST IR 8105 (Homomorphic Encryption):

“Homomorphic encryption enables computation on encrypted data without decrypting it, preserving data privacy during processing.”

SSL encrypts communication, PIR and SFE are niche protocols not suitable for general-purpose computation over encrypted data.

????WGU Course Alignment:

Domain:Cryptography

Topic:Understand and apply homomorphic encryption for secure computation

The correct answer is C — Cyber kill chain.

The Cyber Kill Chain, developed by Lockheed Martin, is a model that breaks down a cyber attack into seven distinct phases: reconnaissance, weaponization, delivery, exploitation, installation, command and control (C2), and actions on objectives. According to the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) study materials, this model helps security teams understand and interrupt an attack at various stages.

While MITRE ATT&CK (B) and its ICS variant (A) provide detailed mappings of techniques used by attackers, they are not structured specifically into seven phases like the Cyber Kill Chain. The Diamond Model (D) is an analysis methodology, not a phase-based model.

Reference Extract from Study Guide:

"The Cyber Kill Chain model divides the sequence of a cyber attack into seven phases, providing a structured method for analyzing and disrupting attacks."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Attack Frameworks and Methodologies

The correct answer is A — Recovery time objective (RTO).

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), the RTO is the maximum acceptable amount of time that a system, application, or process can be offline after a failure before unacceptable consequences occur to the business.

BIA (B) is the process of analyzing impact. BCP (C) is the overall plan for maintaining operations. DR (D) refers to the broader recovery effort.

Reference Extract from Study Guide:

"Recovery time objective (RTO) defines the maximum tolerable downtime for critical systems before significant business impact occurs."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Recovery Objectives and Disaster Recovery Metrics

=============================================

The correct answer is C — Tampering.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) materials explain that tampering refers to unauthorized modifications of systems or data. In this case, the website being altered to redirect users to a malicious landing page indicates that an attacker has tampered with the legitimate website code or its DNS settings.

Exfiltration (A) refers to stealing data. Phishing (B) involves tricking users but not modifying a website. Ransomware (D) encrypts systems for ransom, not cause redirection.

Reference Extract from Study Guide:

"Tampering involves the unauthorized modification of a system or its resources, often to redirect users to malicious destinations or to alter functionality in harmful ways."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Threat Categories and Impacts

=============================================

Integration testingverifies the interactions and data flow between individual software components post-deployment. It is a crucial step in CI/CD pipelines, especially inmulti-tier architecturesystems like web applications.

NIST SP 800-160 Vol. 1 (Systems Security Engineering):

“Integration testing should verify that security functions behave correctly when subsystems or components are combined.”

This test type ensures system cohesion after components are deployed, unlikestatic/dynamic code analysiswhich focuses on code quality and vulnerabilities during earlier phases.

????WGU Course Alignment:

Domain:System Security Engineering

Topic:Validate secure systems through testing in CI/CD pipelines

The correct answer is C — Assess.

As per WGU Cybersecurity Architecture and Engineering (KFO1 / D488) materials, after risks have been identified, the next step in the risk management life cycle is to assess them. Assessment involves analyzing and prioritizing the risks based on their potential impact and likelihood. Only after assessment can proper strategies be formulated for controlling and mitigating the risks.

Identification (A) occurs before assessment, while reviewing (B) and controlling (D) happen later in the process.

Reference Extract from Study Guide:

"Following the identification of risks, the risk management process proceeds to risk assessment, where risks are analyzed and prioritized based on likelihood and impact to guide mitigation efforts."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Management Process

=============================================

SHA-256is a widely usedcryptographic hash functionthat generates a fixed-size output(digest) from input data. It is designed to detect even the smallest change in the input, thereby ensuringdata integrity.

NIST FIPS PUB 180-4 (Secure Hash Standard):

“SHA-256 is used to verify the integrity of data by producing a hash value that is unique to the input, enabling detection of unauthorized changes.”

Unlike RSA and AES (used for encryption), hash algorithms are one-way functions used forintegrity verification.

????WGU Course Alignment:

Domain:Cryptography

Topic:Apply hashing techniques to ensure data integrity

Applyingregular updates and patchesis fundamental to risk mitigation. Choosing ahybrid cloud topologyallows the financial institution to retaincritical services in-housewhile leveragingcloud scalabilityfor high-volume transactions.

NIST SP 800-160 Vol. 1 (Systems Security Engineering):

“Security patching is essential for mitigating vulnerabilities, especially in high-assurance environments like financial systems.”

Thehybrid modelbalancesperformance, control, and security, which is vital for core banking systems.

????WGU Course Alignment:

Domain:System Security Engineering

Topic:Apply risk mitigation techniques and choose secure deployment topologies

Virtual Network Peeringallows two or more virtual networks to communicate through private IP addresses, enabling seamless traffic flow across resources in different networks withminimal configuration overhead.

Microsoft Azure Documentation (Network Peering):

“Virtual network peering seamlessly connects Azure virtual networks. The networks appear as one for connectivity purposes, and traffic is routed through Microsoft’s backbone infrastructure.”

Unlike VPNs or complex routing configurations,peeringis simple,requires no downtime, and doesn’t need encryption if networks are internal.

????WGU Course Alignment:

Domain:Information Systems and Architecture

Topic:Cloud architecture, network segmentation, and inter-VNET connectivity

Identity federationallows authentication credentials to be used across multiple systems or domains—includingon-premises and cloud platforms—without duplicating user databases.

NIST SP 800-63C (Federated Identity Guidelines):

“Federation enables users to access multiple, disparate services using a single digital identity that can be shared securely across organizational boundaries.”

This approach is essential in hybrid architectures where cloud VMs and on-prem servers must recognize acentralized identity providerlike Active Directory.

????WGU Course Alignment:

Domain:Access Control and Identity Management

Topic:Implement federated identity in hybrid and multi-cloud environments

The correct answer is A — A process to reassess risks on a defined schedule.

Based on the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) Study Guide, risks must be reassessed periodically because the threat landscape, organizational assets, and business processes evolve over time. Risks identified years ago might have changed in likelihood, impact, or may have been mitigated already. Therefore, it is essential to establish a formal process for periodic risk review and reassessment to maintain accurate and actionable risk profiles.

Availability of risk documents (B), methods of capture (C), and leadership involvement in scoring (D) are important, but they do not directly address the primary issue of outdated risk assessments.

Reference Extract from Study Guide:

"Organizations must implement a periodic review and reassessment process for risks to ensure that risk profiles reflect the current threat environment, organizational changes, and mitigation efforts."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Management Framework

The correct answer is D — Weak passwords.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), unauthorized SSH access from an unknown IP address often suggests that the attacker exploited weak or compromised passwords to gain access. Weak passwords are a common vulnerability for services exposed to the internet, especially SSH servers.

Exfiltration (A) refers to data theft after access, not initial unauthorized access. Unpatched software (B) might lead to other vulnerabilities but is not indicated here. Enumeration (C) is gathering information but not gaining login access directly.

Reference Extract from Study Guide:

"Weak or compromised passwords are a primary cause of unauthorized access, particularly for remote management interfaces such as SSH."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Authentication Security BestPractices

=============================================

Intranet Application Software:

Intranet applications are designed to be used within an organization’s internal network. They are not accessible from outside the organization unless through a secure connection like a VPN.

Characteristics:

Internal Hosting: These applications are hosted on servers within the business network, ensuring that only authorized internal users can access them.

Security: Since they are hosted internally, they can be secured with internal security measures like firewalls and access controls.

Incorrect Options:

A: Describes applications hosted by external providers.

C: Describes applications hosted by third-party web portals.

D: Describes standalone applications on individual computers.

The correct answer is A — Developing and implementing a testing plan for the DRP.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), testing the disaster recovery plan is critical to ensuring that it is functional and effective when an actual disruptive event occurs. Regularly scheduled DRP testing validates that recovery processes work as intended and that personnel are familiar with their responsibilities.

Reviewing (B) and training (D) are important but are supplementary activities. Risk assessment (C) is important for planning but does not test the DRP.

Reference Extract from Study Guide:

"Testing and exercising disaster recovery plans ensure operational readiness and reveal gaps or weaknesses that can be corrected before an actual event occurs."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Disaster Recovery Testing and Validation

=============================================

Security edge devices(such as NGFWs, IDS/IPS, and secure gateways) are deployed at thenetwork perimeterto inspect and filter traffic, providing aninitial layer of defenseagainst external threats before they reach internal systems.

NIST SP 800-41 Rev. 1:

“Edge security devices enforce security policy at network boundaries and act as a first line of defense by preventing unauthorized or malicious traffic from entering the internal network.”

They are not TPMs or SIEMs, though they maygenerate dataconsumed by SIEMs.

????WGU Course Alignment:

Domain:Network Security

Topic:Deploy perimeter defense technologies at network entry points

The correct answer is B — Wireless intrusion prevention system (WIPS).

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), a WIPS actively monitors wireless networks for unauthorized access points and malicious activity, such as man-in-the-middle (MITM) attacks. It can automatically detect, alert, and prevent wireless threats in real time, which is exactly what the organization requires to counteract MITM attacks on the wireless network.

A SIEM (A) collects logs and generates alerts but does not prevent wireless attacks. An inline encryptor (C) encrypts data but does not prevent wireless attacks. A Layer 3 switch (D) operates at the network layer and does not prevent wireless-specific threats.

Reference Extract from Study Guide:

"A wireless intrusion prevention system (WIPS) detects and prevents unauthorized access points and malicious wireless activity, including man-in-the-middle attacks."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Wireless Security and Threat Prevention

=============================================

The correct answer is D — Configuring third-party authentication with Security Assertion Markup Language (SAML).

According to the WGU KFO1 / D488 Study Guide, SAML enables Single Sign-On (SSO) and federated identity across different domains by securely exchanging authentication and authorization data between an identity provider (such as an organization's Active Directory Federation Services) and a service provider (such as Azure). This allows on-premises users to log into cloud services using their existing corporate credentials.

TLS (A) provides secure communication but does not manage identity federation. 2FA (B) strengthens authentication but is not about identity federation setup. LDAP (C) is a protocol for accessing directory services, not specifically designed for federation across cloud platforms.

Reference Extract from Study Guide:

"SAML is used to implement Single Sign-On (SSO) and federated identity management, allowing organizations to extend on-premises authentication capabilities to cloud services seamlessly."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Identity and Access Management Concepts

The correct answer is C — Constantly scan for known signatures on every machine.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), scanning for known malware signatures is an essential method for detecting infections such as botnets. Signature-based detection compares files and behaviors against databases of known indicators of compromise (IOCs).

Two-factor authentication (A) protects login processes but does not detect malware. Firewall rules (B) help control access but do not detect infections. Configuration management (D) ensures system setup integrity but does not detect botnets.

Reference Extract from Study Guide:

"Signature-based scanning detects malware and botnets by comparing system files and behaviors against databases of known threats and indicators of compromise (IOCs)."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Malware Detection and Threat Response

The correct answer is C — Common Vulnerabilities and Exposures (CVE).

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) highlights that the CVE database provides information about publicly disclosed cybersecurity vulnerabilities in software, including open-source libraries. By consulting the CVE list, the security team can assess whether the open-source libraries have known vulnerabilities before approving their use.

Agile (A) and Waterfall (B) are software development methodologies, not vulnerability databases. Continuous delivery (D) refers to automated software deployment and not vulnerability assessment.

Reference Extract from Study Guide:

"The Common Vulnerabilities and Exposures (CVE) database provides standardized information on publicly known cybersecurity vulnerabilities, enabling risk assessment of software components."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Vulnerability Management Concepts

=============================================

TheCentral Processing Unit (CPU)is the primary component of a computer that performs most of the processing inside a computer.

Carrying out the instructions of a computer program: The CPU executes program instructions, which are the basic tasks that tell the computer what to do.

Containing an arithmetic logic unit (ALU): The ALU performs all arithmetic and logic operations, such as addition, subtraction, and comparison.

The CPU also manages data flow between the computer's other components.

It fetches instructions from memory, decodes them, and then executes them, which involves performing calculations and making decisions.

The correct answer is D — Implementing strong authentication mechanisms and encryption protocols to secure communication between the LDAP server and clients.

As outlined in WGU Cybersecurity Architecture and Engineering (KFO1 / D488) materials, securing LDAP communication and strengthening authentication directly addresses vulnerabilities related to unauthorized access. Using encryption protocols such as LDAP over SSL (LDAPS) ensures that credentials and sensitive data are transmitted securely.

Security awareness training (A) helps against social engineering but does not secure the LDAP system itself. Backups (B) are a recovery measure, not a preventive one. IDPS (C) can detect attacks but does not directly secure the LDAP server against exploitation.

Reference Extract from Study Guide:

"Implementing strong authentication and encrypting communications for LDAP servers mitigates vulnerabilities by preventing unauthorized access and protecting sensitive information during transmission."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Secure Protocols and Services

The correct answer is D — Identify.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), the first step in risk management is identifying potential risks. Only once risks are identified can they be assessed, controlled, and reviewed. In this case, identifying potential data breaches, outages, and cost issues is the starting point.

Assess (A) happens after identification. Control (B) involves implementing responses. Review (C) happens later to check effectiveness.

Reference Extract from Study Guide:

"The first phase of risk management is risk identification, where potential threats and vulnerabilities are recognized and documented."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Management Life Cycle

=============================================

The correct answer is A — Intrusion detection system (IDS).

As outlined in WGU Cybersecurity Architecture and Engineering (KFO1 / D488), an IDS helps monitor network traffic for suspicious activities and security threats, making it a fundamental component of securing a network for a start-up. It enables early detection of attacks, contributing both to cybersecurity defense and incident response efforts.

Packet filtering (B) is a limited firewall technique and not as comprehensive. Bootstrapping (C) is a startup or initialization process, not a security measure. VPN (D) secures remote access but does not inherently monitor for threats.

Reference Extract from Study Guide:

"An intrusion detection system (IDS) monitors network traffic for suspicious activity and potential threats, enhancing a network’s security posture and supporting incident detection."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Network Security Monitoring and Defense

Here are your fully verified and properly formatted answers for this final batch, based on WGU Cybersecurity Architecture and Engineering (KFO1 / D488) official materials:

=============================================

The correct answer is C — Stream ciphers.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) content explains that stream ciphers encrypt data bit-by-bit or byte-by-byte, making them highly efficient and suitable for real-time applications like video conferencing where low latency is critical.

Block ciphers (A) encrypt large chunks of data, causing latency. Asymmetric encryption (B) is too slow for real-time data streams. Hash functions (D) are used for data integrity, not for ongoing data encryption.

Reference Extract from Study Guide:

"Stream ciphers encrypt data continuously and are ideal for real-time applications such as video or audio streaming where low latency is essential."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Encryption Technologies

The correct answer is D — Upgrade the remaining end-of-life machines.

As outlined in WGU Cybersecurity Architecture and Engineering (KFO1 / D488), the best way to address end-of-life systems is to upgrade them to supported versions. End-of-life systems no longer receive security patches, leaving them highly vulnerable. Upgrading restores security and compliance.

Shutting down (A), disconnecting (B), or blocking (C) are temporary solutions that may disrupt operations but do not solve the root problem.

Reference Extract from Study Guide:

"Upgrading end-of-life systems is critical to restoring security and compliance, as unsupported systems are vulnerable to exploitation."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Vulnerability Management and Remediation

=============================================

The correct answer is C — Competitor.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), competitors often attempt to steal intellectual property to gain a business advantage. Given the theft of valuable business assets (e-books and videos), the most likely actor is a competitor motivated by financial or market advantage, not ideology or random hacking.

An APT (A) is usually nation-state-sponsored and targets critical infrastructure. A novice hacker (B) might deface or cause damage but is less likely focused on IP theft. Hacktivists (D) are politically motivated, not financially.

Reference Extract from Study Guide:

"Competitors may engage in cyber espionage to steal intellectual property and gain market advantage, representing a significant threat to business assets."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Threat Actor Categories

Multi-Factor Authentication (MFA)mitigates identity theft by requiring two or more factors (something you know, have, or are) for access. This significantly raises the difficulty of account compromise, especially in environments with sensitive supply chain data.

NIST SP 800-63B (Digital Identity Guidelines):

“MFA significantly reduces the likelihood of credential compromise and is strongly recommended for all user accounts accessing critical systems.”

While patching and firewalls are important, MFAdirectly addresses identity theftprevention.

????WGU Course Alignment:

Domain:Access Control and Identity Management

Topic:Implement MFA for secure user authentication

The correct answer is A — Conducting regular vulnerability assessments and penetration testing.

According to the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) materials, performing vulnerability assessments and penetration testing helps identify weaknesses in both hardware and virtual environments. Regular testing ensures that any hardware-related vulnerabilities are discovered and addressed before they can be exploited.

Disabling CPU virtualization support (B) would prevent virtual machines from running, defeating the purpose. A web application firewall (C) monitors traffic at the application layer but does not address hardware risks. Access control policies (D) are important but not directly tied to detecting hardware vulnerabilities.

Reference Extract from Study Guide:

"Regular vulnerability assessments and penetration testing identify weaknesses in hardware and software environments, providing critical insights for maintaining a hardened and secure posture."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Security Testing and Assessment

=============================================

The correct answer is C — Host-based firewall.

According to the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) materials, a host-based firewall enforces traffic control policies at the endpoint level. It can allow or deny traffic based on application, port, IP address, and protocol rules, restricting access to only approved services and applications on a system.

Antivirus tools (A) detect malware but do not control network traffic. Two-factor authentication (B) secures user access but does not manage network traffic. HSMs (D) handle encryption keys, not network access control.

Reference Extract from Study Guide:

"Host-based firewalls restrict traffic at the system level, permitting only authorized services and applications, enhancing endpoint security."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Endpoint Protection and Firewalls

=============================================

Theprinciple of least privilegedictates that backups—especially those containing sensitive or mission-critical data—should havestrict access controlsto prevent unauthorized access.

NIST SP 800-209 (Security Guidelines for Storage Infrastructure):

“Access to storage resources must be tightly controlled through identity management and access control policies to prevent compromise or misuse of sensitive data.”

While vulnerability scanning and auditing are goodfollow-upactions,immediate access restrictionis thefirst-line defense.

????WGU Course Alignment:

Domain:System Security Engineering

Topic:Secure cloud data storage and apply access control measures

Alpha testing is a type of system testing that involves having end users test the system with simulated data and the help of the developer. This phase is crucial because:

Early feedback: Users provide early feedback on the usability and functionality of the system.

Bug identification: Developers can identify and fix bugs before the system is released for beta testing or production.

Simulated environment: The testing is done in a controlled, simulated environment, often within the development organization.

Alpha testing is followed by beta testing, where the system is tested in a real-world environment by end users without the developers' direct involvement.

References

Ron Patton, "Software Testing," Sams Publishing.

Glenford J. Myers, "The Art of Software Testing," Wiley.

AHost-based Intrusion Detection and Prevention System (HIDPS)can detect unauthorized activity or suspicious changesat the OS level, including those specifically targetingLinux kernel modules, services, or rootkits.

NIST SP 800-94 Rev. 1:

“HIDPS software runs on individual hosts or devices in the network, analyzing inbound and outbound packets and alerting administrators to suspicious activity.”

HIDPS is especially effective in server environments wherekernel-level visibilityis critical.

????WGU Course Alignment:

Domain:System Security Engineering

Topic:Implement and monitor HIDPS on enterprise Linux servers

Encrypting stored (at rest) dataensures that even if the storage is compromised (e.g., stolen or accessed by unauthorized parties), the data remains unintelligible without the encryption keys.

NIST SP 800-111 (Guide to Storage Encryption Technologies):

“Data encryption provides confidentiality of information stored on media or storage systems, preventing unauthorized disclosure of sensitive data.”

Encryption is a core requirement forconfidentiality controls, especially for systems handling documents and records.

????WGU Course Alignment:

Domain:System Security Engineering

Topic:Apply data-at-rest encryption for secure information storage

The correct answer is A — Tactical.

Based on WGU Cybersecurity Architecture and Engineering (KFO1 / D488) study material, tactical threat intelligence provides technical details such as indicators of compromise (IOCs), IP addresses, file hashes, domain names, and other evidence needed to detect and respond to threats immediately. This type of intelligence is used by security teams to perform real-time monitoring and incident response.

Operational intelligence (C) addresses campaigns or actor behavior but is not immediately actionable. Strategic intelligence (D) provides high-level, long-term threat trends. Commodity malware (B) refers to low-level malware types, not intelligence classifications.

Reference Extract from Study Guide:

"Tactical threat intelligence focuses on technical indicators of compromise (IOCs) and immediate actionable information that responders use to detect and contain active threats."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Threat Intelligence Concepts

=============================================

The correct answer is C — Data loss prevention (DLP).

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), DLP technologies monitor and control the transfer of sensitive information outside of the corporate network, preventing unauthorized data exfiltration whether by internal misuse or external threats.

MFA (A) strengthens authentication but does not monitor data transfer. IDS (B) detects intrusions but does not prevent data loss. IPS (D) blocks network attacks but is not specifically designed for preventing exfiltration of sensitive data.

Reference Extract from Study Guide:

"Data loss prevention (DLP) solutions protect sensitive data by monitoring, detecting, and blocking potential data exfiltration attempts."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Data Protection Technologies

=============================================

The correct answer is D — Private information retrieval (PIR).

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) explains that PIR allows users to query a database in such a way that the server cannot determine what information the user is retrieving. It protects user privacy while enabling database interaction.

SFE (A) involves computing a function without revealing inputs. PFE (B) is similar to SFE but focuses on functions. Homomorphic encryption (C) allows computation but not necessarily private querying.

Reference Extract from Study Guide:

"Private Information Retrieval (PIR) enables users to access database information without revealing the nature of the query to the server, preserving user privacy."

The correct answer is D — Likelihood.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) emphasizes that when evaluating the chance of future incidents, the focus should be on likelihood — the probability that a threat will exploit a vulnerability again. Given that a breach has already occurred, it is important to assess how likely another breach could happen without additional security measures.

Impact (A) measures consequences, not probability. Risk (B) is a combination of impact and likelihood, but to specifically focus on future potential, likelihood (D) is primary. Threat actors (C) describe adversaries, not probabilities.

Reference Extract from Study Guide:

"Likelihood refers to the probability that a specific threat will successfully exploit a vulnerability, and is a key consideration in predicting future incidents."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Assessment Concepts

=============================================

Data encryptionprotects sensitive ERP system information by rendering the data unreadable to unauthorized users, even if the system is compromised. This is the most effective method to preserve confidentiality in a breach.

NIST SP 800-111 (Guide to Storage Encryption Technologies):

“Encryption ensures that even if data is exfiltrated or accessed by unauthorized individuals, it cannot be understood without the appropriate decryption keys.”

Backups and firewalls are important, butencryption directly protects data at restfrom unauthorized viewing.

????WGU Course Alignment:

Domain:System Security Engineering

Topic:Implement encryption controls for stored business data

The correct answer is C — ChaCha.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488) materials, ChaCha is a stream cipher developed as a variant of Salsa20. It offers enhanced security, improved performance, and resistance to cryptographic attacks. It is often combined with Poly1305 forauthenticated encryption, commonly used in modern secure communications.

CTR (A) and CBC (B) are block cipher modes, not stream ciphers. ECB (D) is a block cipher mode and is insecure due to its lack of diffusion properties.

Reference Extract from Study Guide:

"ChaCha is a modern stream cipher, evolved from Salsa20, designed for speed and security, and often used alongside Poly1305 for authenticated encryption."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Encryption Technologies

=============================================

Private Information Retrieval (PIR)allows a user to retrieve data from a server without revealingwhich datais being requested. It’s aprivacy-preserving protocolprimarily used in secure databases and web applications.

ACM Computing Surveys – Private Information Retrieval:

“PIR enables users to query a database without disclosing the identity of the item being retrieved, maintaining the user’s privacy.”

Homomorphic encryption protects data during processing, while PIR protectsaccess patterns.

????WGU Course Alignment:

Domain:Cryptography and Privacy Engineering

Topic:Apply PIR techniques for private querying in databases

The characteristic of quality data represented here is relevance. When an organization sends customers email messages based on their purchase patterns, it ensures that the information is relevant to the customers' interests and needs. Relevant data is tailored to the specific context in which it is used, enhancing its value and effectiveness.

The operating system (OS) is the primary software that manages all the hardware and other software on a computer. It acts as an intermediary between users and the computer hardware. The OS handles basic tasks such as controlling and allocating memory, prioritizing system requests, controlling input and output devices, facilitating networking, and managing files. Examples include Windows, macOS, and Linux.

The correct answer is A — Electronic codebook (ECB).

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), ECB mode is the simplest and most basic mode of operation for block ciphers. It encrypts each block of plaintext independently with the same key, but identical plaintext blocks produce identical ciphertext blocks, providing no additional confidentiality beyond the block cipher itself and making patterns visible.

CBC (B), CTR (C), and OFB (D) are more secure and avoid patterns.

Reference Extract from Study Guide:

"Electronic Codebook (ECB) mode encrypts each block independently and is simple but reveals patterns when identical plaintext blocks occur, thus offering minimal confidentiality beyond the underlying cipher."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Block Cipher Modes of Operation

=============================================

To determine an order total, the item unit price is essential because it represents the cost per unit of the item. By multiplying the unit price by the quantity ordered, you can calculate the total cost for each item in the order, and then sum these totals to get the overall order total.

Real-time transaction monitoringhelps detect and respond to fraudulent activities (e.g., unauthorized access, anomalous transactions) as they happen. It’s critical in high-risk environments likeonline banking systems.

FFIEC IT Examination Handbook (Retail Payment Systems):

“Real-time fraud detection systems monitor for suspicious or anomalous transactions that may indicate identity theft, account takeover, or credit card fraud.”

This is anactive, risk-aware controlthat’s far more effective than backups or email restrictions for this use case.

????WGU Course Alignment:

Domain:Security Operations and Monitoring

Topic:Implement real-time monitoring systems for financial fraud detection

Anoperating system (OS)is a system software that manages computer hardware and software resources and provides common services for computer programs.

It serves as an intermediary between users and the computer hardware.

Key functionsof an OS include:

Managinghardware resourceslike the CPU, memory, and I/O devices.

Providing auser interface(UI) for interaction with the system.

File managementand handling file operations.

Process managementand multitasking.

Securityand access control.

Examples include Windows, Linux, and macOS.

The correct answer is C — Intrusion prevention system.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) states that an Intrusion Prevention System (IPS) actively monitors network traffic and can block malicious activity in real-time. It can enforce rules like blocking an IP address after multiple failed SSH login attempts, stopping brute force attacks.

DLP (A) focuses on preventing sensitive data loss. A firewall (B) controls network traffic but generally does not automatically block based on login attempts unless highly customized. File integrity monitoring (D) watches file changes, not login attempts.

Reference Extract from Study Guide:

"An intrusion prevention system (IPS) monitors network traffic for malicious activities and can automatically block connections that meet predefined suspicious criteria."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Intrusion Detection and Prevention Systems

=============================================

Data encryptionensures confidentiality and integrity even if communications are intercepted. If properly implemented (e.g., using TLS), encryption makes the payload unreadable to the attacker.

NIST SP 800-52 Rev. 2 (Guidelines for the Selection and Use of Transport Layer Security):

“Encryption technologies provide secure channels that resist interception and unauthorized access, which is essential in mitigating MITM attacks.”

Passwords and Wi-Fi controls support security, but encryption is thecoredefense against data leakage during interception.

????WGU Course Alignment:

Domain:Cryptography

Topic:Apply encryption to secure data in transit and at rest

Scripting languages are designed for integrating and communicating with other programming languages.

Python: A high-level scripting language known for its readability and extensive library support.

PHP: A server-side scripting language used primarily for web development.

References

"Python Crash Course" by Eric Matthes

"PHP and MySQL Web Development" by Luke Welling and Laura Thomson

The correct answer is D — Installing endpoint protection software.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) teaches that endpoint protection (including antivirus, anti-malware, and endpoint detection and response) is critical for detecting,blocking, and removing commodity malware like ransomware and Trojans.

Firewalls (A) help with perimeter security but don't directly block malware on endpoints. Rerouting communications (B) is not a standard protection method. Two-factor authentication (C) secures logins but does not protect systems from malware infection.

Reference Extract from Study Guide:

"Endpoint protection software defends individual systems against malware threats by detecting, blocking, and removing malicious files and processes."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Endpoint Security Solutions

=============================================

Aproprietary software licensetypically grants a business or user theright to usethe software.

Unlike open-source licenses, proprietary licenses do not usually allow modification, redistribution, or reverse engineering.

The software remains the property of the company that created it, and the licensee is only granted specific, limited rights.

Examples:Many enterprise software applications come with proprietary licenses that specify the terms of use.

Data is considered information when it has been processed and organized in a meaningful way. Raw data in its unprocessed state is not useful until it undergoes processing to become interpretable and actionable information. Processing can involve sorting, aggregating, and analyzing data to extract valuable insights.

The correct answer is B — Implementing security patches and updates on a regular basis and using hybrid cloud topology.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) emphasizes that timely application of security patches is critical to addressing vulnerabilities like outdated software. A hybrid cloud topology offers the flexibility and scalability needed by financial institutions while keeping sensitive data protected in more controlled environments.

Strong password policies (A) help, but public cloud alone may not be best for sensitive banking systems. Antivirus (C) addresses only part of the threat. Private cloud (D) improves security but may not offer the scalability benefits of a hybrid approach.

Reference Extract from Study Guide:

"Timely application of security patches mitigates vulnerabilities, and hybrid cloud models balance the need for scalability and sensitive data protection in financial institutions."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Mitigation Strategies and Cloud Topologies

=============================================

To protect datain use(within memory), the provider must implementhardware-level memory encryptionandtrusted execution environments(secure enclaves), which protect against cold boot attacks, memory scraping, and unauthorized access.

NIST SP 800-207A (Hardware-Enabled Security: Enclaves):

“Trusted execution environments and memory encryption mechanisms help ensure that data remains protected even when systems are compromised at lower levels.”

This is amodern cloud security best practiceespecially useful forconfidential computingenvironments.

????WGU Course Alignment:

Domain:System Security Engineering / Cryptography

Topic:Protect data in use with hardware-based encryption and enclaves

Data Loss Prevention (DLP)systems are specifically designed todetect, monitor, andpreventunauthorized attempts to access, transmit, or extract sensitive data — including email, removable media, and cloud uploads.

NIST SP 800-207A (Data Protection):

“DLP systems are used to prevent sensitive information from being transmitted outside of a trusted boundary by monitoring and enforcing content-based policies.”

IDS and IPS detect threats but do notfocus on protecting data from being exfiltrated. MFA protects user identities, not data leakage.

????WGU Course Alignment:

Domain:Security Operations and Monitoring

Topic:Implement DLP controls to protect sensitive data from unauthorized extraction

ADatabase Administrator (DBA)is responsible for managing the database infrastructure.

Primary responsibilitiesinclude:

Installing and configuringnew databases and database servers.

Ensuring databases run efficiently and are properly maintained.

Performingbackup and recoveryoperations to prevent data loss.

Monitoring performanceand tuning databases for optimal performance.

Implementingsecurity measuresto protect the database against unauthorized access.