WGU (KFO1/D488) Cybersecurity Architecture and Engineering Exam Questions Instant Access

Question 1

Which security technique should be used to prevent data exfiltration?

AMulti-factor authentication (MFA)

BIntrusion detection software (IDS)

CData loss prevention (DLP)

DIntrusion prevention software (IPS)

Answer : C

The correct answer is C --- Data loss prevention (DLP).

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), DLP technologies monitor and control the transfer of sensitive information outside of the corporate network, preventing unauthorized data exfiltration whether by internal misuse or external threats.

MFA (A) strengthens authentication but does not monitor data transfer. IDS (B) detects intrusions but does not prevent data loss. IPS (D) blocks network attacks but is not specifically designed for preventing exfiltration of sensitive data.

Reference Extract from Study Guide:

'Data loss prevention (DLP) solutions protect sensitive data by monitoring, detecting, and blocking potential data exfiltration attempts.'

--- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Data Protection Technologies

=============================================

Question 2

A financial institution conducted a cybersecurity assessment, which identified several vulnerabilities, including outdated software and weak password policies. The company also needs to implement a new core banking system that can handle a large number of transactions while ensuring the security of customer data.

Which risk mitigation process is the most effective approach to address these vulnerabilities, and what is the best topology for the new core banking system?

ACreating strong password policies and enforcing multifactor authentication and using public cloud topology

BImplementing security patches and updates on a regular basis and using hybrid cloud topology

CInstalling antivirus software on all endpoints and using on-premise topology

DConducting regular security audits and penetration testing and using private cloud topology

Answer : B

The correct answer is B --- Implementing security patches and updates on a regular basis and using hybrid cloud topology.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) emphasizes that timely application of security patches is critical to addressing vulnerabilities like outdated software. A hybrid cloud topology offers the flexibility and scalability needed by financial institutions while keeping sensitive data protected in more controlled environments.

Strong password policies (A) help, but public cloud alone may not be best for sensitive banking systems. Antivirus (C) addresses only part of the threat. Private cloud (D) improves security but may not offer the scalability benefits of a hybrid approach.

Reference Extract from Study Guide:

'Timely application of security patches mitigates vulnerabilities, and hybrid cloud models balance the need for scalability and sensitive data protection in financial institutions.'

--- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Mitigation Strategies and Cloud Topologies

=============================================

Question 3

Which risk management strategy will ensure that data stored on an Enterprise Resource Planning (ERP) system is secure from exploitation in the event of a data breach?

AImplementation of data encryption

BEnforcement of a strict firewall policy to restrict access to the ERP system's server

CImplementation of regular backup and disaster recovery planning

DConfiguration of the ERP system to disable all printing services on all workstations

Answer : A

Data encryptionprotects sensitive ERP system information by rendering the data unreadable to unauthorized users, even if the system is compromised. This is the most effective method to preserve confidentiality in a breach.

NIST SP 800-111 (Guide to Storage Encryption Technologies):

''Encryption ensures that even if data is exfiltrated or accessed by unauthorized individuals, it cannot be understood without the appropriate decryption keys.''

Backups and firewalls are important, butencryption directly protects data at restfrom unauthorized viewing.

WGU Course Alignment:

Domain:System Security Engineering

Topic:Implement encryption controls for stored business data

Question 4

An organization is experiencing multiple instances of attempted access from geographical locations where there are no corporate offices or staff.

What should a network administrator do to prevent further access attempts?

AAdjust the rule sets within the security information and event manager (SIEM) tool

BAdjust the Domain Name Service (DNS) server A Records

CAdjust the firewall configuration to drop traffic from these addresses

DAdjust the main proxy server to only allow specific addresses

Answer : C

The correct answer is C --- Adjust the firewall configuration to drop traffic from these addresses.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) teaches that the firewall is the primary network defense that can block or filter unwanted incoming traffic based on IP addresses, geographical locations, and other attributes. Dropping traffic from untrusted regions at the firewall level effectively prevents further access attempts.

Adjusting SIEM (A) can improve alerting but not blocking. DNS changes (B) relate to domain resolution, not access control. Proxy servers (D) can limit outbound traffic but are not primarily used for blocking geographic access inbound.

Reference Extract from Study Guide:

'Adjusting firewall rules to drop or block traffic based on IP addresses or geolocation is a primary defense against unauthorized access attempts from suspicious regions.'

--- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Network Security and Firewall Configuration

=============================================

Question 5

A professional services organization deployed security edge devices in key locations on its corporate network.

How will these devices improve the organization's security posture?

AThey act as an initial defense layer for potential threats

BThey protect from severe distributed denial-of-service (DDoS) attacks

CThey act as a security information and event management (SIEM) module for a security operations center (SOC) analyst

DThey are a set of trusted platform module (TPM) devices

Answer : A

The correct answer is A --- They act as an initial defense layer for potential threats.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), security edge devices such as firewalls, secure web gateways, and intrusion prevention systems (IPS) are placed at the network perimeter to serve as the first layer of defense against external threats.

DDoS protection (B) may be part of a broader security solution but is not the main role of general edge devices. SIEM modules (C) collect and correlate logs, not defend at the perimeter. TPM devices (D) are hardware-based cryptographic modules, not network edge defenses.

Reference Extract from Study Guide:

'Security edge devices provide the first line of defense against external threats by monitoring, filtering, and blocking malicious traffic entering the corporate network.'

--- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Network Security and Perimeter Defense

Question 6

A company has recently experienced a data breach in which customer information was stolen. The company is concerned about the potential for future data breaches. A review of the incident revealed that the breach originated from stolen credentials.

Which security measure will meet the needs of this company?

AImplementing two-factor authentication

BConducting background checks on employees

CProviding regular security awareness training to employees

DInstalling a security information and event management (SIEM) system

Answer : A

The correct answer is A --- Implementing two-factor authentication.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488) content, two-factor authentication (2FA) strengthens authentication processes by requiring users to provide two forms of evidence (e.g., password + SMS code or authentication app) before accessing systems. Even if credentials are stolen, without the second factor, attackers would be unable to log in.

Background checks (B) are important for insider threats but not stolen external credentials. Security awareness training (C) is good practice but does not technically prevent the misuse of stolen credentials. SIEM systems (D) help detect breaches but do not stop unauthorized access at the authentication layer.

Reference Extract from Study Guide:

'Two-factor authentication mitigates the risks associated with credential theft by requiring an additional factor, significantly improving the security posture.'

--- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Authentication and Identity Management

=============================================

Question 7

Which stream cipher is a variant of the Salsa20 cipher, designed to be fast, secure, and resistant to cryptanalysis, and is commonly used in combination with the Poly1305 authentication mode?

AChaCha

BCipher Block Chaining (CBC)

CCounter (CTR)

DElectronic Codebook (ECB)

Answer : A

ChaChais a modern, high-performancestream cipherderived from Salsa20, known for its resistance to timing attacks and its use inTLS 1.3 and mobile securitydue to its efficiency and security. When paired withPoly1305, it provides bothencryption and authentication.

RFC 8439 (ChaCha20 and Poly1305 for IETF Protocols):

''ChaCha20 is a secure cipher designed for high-speed software implementations. It is robust against side-channel and cryptanalytic attacks and is used in conjunction with Poly1305 for authenticated encryption.''

CBC, ECB, and CTR are block cipher modes, not stream ciphers.

WGU Course Alignment:

Domain:Cryptography

Topic:Identify secure and modern stream ciphers for real-time encryption

WGU Cybersecurity Architecture and Engineering (KFO1/D488) WGU (KFO1/D488) Cybersecurity Architecture and Engineering Exam Questions