Cybersecurity-Architecture-and-Engineering WGU Cybersecurity Architecture and Engineering (KFO1/D488) Question and Answers

The development of scope creep is often signaled by the addition of many unplanned features to the original project. This indicates that the project scope is expanding beyond its initial boundaries. Key indicators include:

Uncontrolled changesto the project scope.

Continuous new requestsfrom stakeholders that were not part of the original requirements.

Increased project complexityand difficulty in managing the project timeline and resources.

Scope creep can lead to delays, budget overruns, and project failure if not managed properly.

References

Project Management Institute, "A Guide to the Project Management Body of Knowledge (PMBOK Guide)," PMI.

Harold Kerzner, "Project Management: A Systems Approach to Planning, Scheduling, and Controlling," Wiley.

The correct answer is A — Virtual private network (VPN).

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), a VPN creates an encrypted tunnel over public or private networks, ensuring confidentiality, integrity, and authentication of data transmitted between geographically dispersed offices.

SIEM (B) manages security events, not secure communications. PPTP (C) is an outdated and insecure VPN protocol. NAC (D) enforces endpoint security but does not establish secure tunnels.

Reference Extract from Study Guide:

"A virtual private network (VPN) provides a secure, encrypted tunnel between geographically separated networks, enabling confidential communication over untrusted networks."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Secure Remote Access Technologies

The correct answer is D — Removing all end-of-life devices from the network.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), end-of-life systems pose significant risks because they no longer receive patches or updates. The besthardening technique in this situation is to decommission and remove these devices, eliminating their vulnerabilities altogether.

Access control (A), vulnerability scanning (B), and IDPS (C) are helpful practices but do not eliminate vulnerabilities of unsupported devices.

Reference Extract from Study Guide:

"Removing end-of-life or unsupported assets is essential for maintaining a secure infrastructure, as these devices are highly vulnerable to exploitation."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), System and Device Hardening

=============================================

Packet sniffing is a technique used to capture and analyze network traffic, which can include intercepting passwords while they are in transit.

When data packets are transmitted over a network, a packet sniffer can capture these packets, and if they are not encrypted, it can read sensitive information like passwords.

The other options:

Buffer overflow is a type of attack that exploits a program's memory handling.

Phishing is a social engineering attack to deceive users into providing sensitive information.

Black hat refers to a hacker with malicious intent, not a specific technique.

Therefore, packet sniffing is the correct technique for obtaining passwords in transit.

Multi-Factor Authentication (MFA)mitigates identity theft by requiring two or more factors (something you know, have, or are) for access. This significantly raises the difficulty of account compromise, especially in environments with sensitive supply chain data.

NIST SP 800-63B (Digital Identity Guidelines):

“MFA significantly reduces the likelihood of credential compromise and is strongly recommended for all user accounts accessing critical systems.”

While patching and firewalls are important, MFAdirectly addresses identity theftprevention.

🔹WGU Course Alignment:

Domain:Access Control and Identity Management

Topic:Implement MFA for secure user authentication

Professional associations are vital for IT professionals because they:

Provide up-to-date training: Offering courses, certifications, and workshops to keep members current with the latest technologies, practices, and industry standards.

Networking opportunities: Facilitating connections with other professionals in the field, which can lead to job opportunities and collaborations.

Professional development: Offering resources and support for career growth and development.

Industry standards and best practices: Providing guidelines and frameworks to ensure high-quality work and ethical practices.

Staying engaged with professional associations helps IT professionals remain knowledgeable and competent in their field.

References

CompTIA, "Advancing the Global IT Industry."

ISACA, "Building a Better Digital World."

The correct answer is D — Secure Shell (SSH).

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) materials state that SSH provides strong encryption and authentication for remote access over unsecured networks. SSH ensures that sessions are confidential and that only authorized users can access remote systems.

HTTP (A) and FTP (B) transmit data in plaintext and do not provide encryption. Telnet (C) also transmits data in plaintext and is insecure for remote access.

Reference Extract from Study Guide:

"Secure Shell (SSH) is used for secure remote management, offering encrypted communications and authentication mechanisms to protect against unauthorized access and eavesdropping."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Secure Protocols and Communications

=============================================

AnIntrusion Prevention System (IPS)detects and blocks malicious activity in real time based on defined policies or behavior patterns. IPS tools can enforcerate limiting,connection attempts, and evenauto-blockingafter repeated failures.

NIST SP 800-94 Rev. 1:

“Intrusion prevention systems not only detect potential incidents but actively prevent attempts such as brute-force attacks on services like SSH.”

Firewalls may filter traffic, but only an IPSactively terminates or blocks behavior-based threats like repeated failed logins.

🔹WGU Course Alignment:

Domain:Network Security

Topic:Deploy and configure IPS for automated protection against brute-force attacks

IPsecis anend-to-end encryption protocol suitethat operates at thenetwork layer, providingauthentication, integrity, and confidentialitybetween virtual networks—even across different cloud environments like Azure and AWS.

NIST SP 800-77 Rev. 1 (Guide to IPsec VPNs):

“IPsec provides network-layer protection through authentication headers (AH) and encapsulating security payloads (ESP), suitable for securing traffic across untrusted environments.”

FTP is insecure, and SSH is more suitable for command-line access or remote sessions—not secure VPC-to-VPC tunnels.

🔹WGU Course Alignment:

Domain:Cryptography

Topic:Use encryption protocols like IPsec for secure data transmission between networks

The correct answer is A — They act as an initial defense layer for potential threats.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), security edge devices such as firewalls, secure web gateways, and intrusion prevention systems (IPS) are placed at the network perimeter to serve as the first layer of defense against external threats.

DDoS protection (B) may be part of a broader security solution but is not the main role of general edge devices. SIEM modules (C) collect and correlate logs, not defend at the perimeter. TPM devices (D) are hardware-based cryptographic modules, not network edge defenses.

Reference Extract from Study Guide:

"Security edge devices provide the first line of defense against external threats by monitoring, filtering, and blocking malicious traffic entering the corporate network."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Network Security and Perimeter Defense

The correct answer is D — Implementation of data encryption.

As per WGU Cybersecurity Architecture and Engineering (KFO1 / D488), encrypting data at rest ensures that even if attackers breach the system and obtain files, the data remains protected because it cannot be easily read without decryption keys.

Firewall enforcement (A) restricts access but does not protect data if stolen. Disabling printing services (B) limits data leakage but not core data protection. Backups (C) help with recovery, not immediate breach protection.

Reference Extract from Study Guide:

"Encrypting sensitive data ensures confidentiality even in the event of a security breach, protecting information from unauthorized exploitation."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Data Security and Encryption Practices

=============================================

It is better to purchase software rather than build a software solution in-house when there is a short timeline. Building software from scratch requires significant time for development, testing, and deployment. Purchasing off-the-shelf software can significantly reduce the time needed to implement a solution. Other considerations include:

Cost-effectiveness: Pre-built software can be more cost-effective than developing a custom solution, especially when factoring in the costs of development, maintenance, and support.

Immediate availability: Purchased software is usually ready to deploy immediately, whereas custom development can take months or even years.

Proven reliability: Commercial software often has a track record of reliability and user support, reducing the risk of bugs and issues that may arise with custom development.

Therefore, when time is of the essence, purchasing software is the preferable option.

References

Ian Sommerville, "Software Engineering," Pearson.

Steve McConnell, "Rapid Development: Taming Wild Software Schedules," Microsoft Press.

Encrypting stored (at rest) dataensures that even if the storage is compromised (e.g., stolen or accessed by unauthorized parties), the data remains unintelligible without the encryption keys.

NIST SP 800-111 (Guide to Storage Encryption Technologies):

“Data encryption provides confidentiality of information stored on media or storage systems, preventing unauthorized disclosure of sensitive data.”

Encryption is a core requirement forconfidentiality controls, especially for systems handling documents and records.

🔹WGU Course Alignment:

Domain:System Security Engineering

Topic:Apply data-at-rest encryption for secure information storage

The correct answer is B — Sixteen characters with at least one letter, one number, and one symbol.

According to the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) Study Guide, strong password policies must enforce a minimum length (preferably 12 to 16 characters) and require complexity, including uppercase and lowercase letters, numbers, and special characters. Sixteen-character passwords that include varied character types greatly increase the difficulty for attackers using brute-force or dictionary attacks.

Options A, C, and D either lack complexity or have too few characters, making them vulnerable to attacks.

Reference Extract from Study Guide:

"A strong password should be at least 12–16 characters long and include a mix of uppercase letters, lowercase letters, numbers, and special characters to maximize resistance to brute-force attacks."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Identity and AccessManagement Concepts

=============================================

The correct answer is D — Federated authentication.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) explains that federated authentication allows two or more organizations to share identity information securely withoutneeding to maintain separate user accounts for external users. It supports cross-organizational access based on trusted identity providers.

Cloud identity providers (A) offer centralized authentication but don't address federation directly. SSO (B) simplifies authentication within an organization. MFA (C) adds security but does not enable cross-organization authentication.

Reference Extract from Study Guide:

"Federated authentication enables organizations to share identity information and trust external credentials without the need to manage separate accounts for external users."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Identity Federation and Single Sign-On Concepts

=============================================

Theavailabilityof the POS system depends on itsresilience against known vulnerabilities. Applyingregular security patchesensures that attackers cannot exploit outdated components, which could crash or disrupt the POS system.

NIST SP 800-40 Rev. 3 (Guide to Enterprise Patch Management):

“Prompt application of security patches mitigates vulnerabilities that can be exploited to disrupt system availability or compromise data.”

Backups protect from data loss, butpatching is proactive protectionfor uptime and availability.

🔹WGU Course Alignment:

Domain:Security Operations and Monitoring

Topic:Maintain system availability through proactive patch management

The correct answer is D — Identity federation.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) details that identity federation enables users to authenticate using the same credentials across multiple systems and platforms, including hybrid cloud and on-premises environments. Federation facilitates Single Sign-On (SSO) and seamless authentication.

Two-step verification (A) improves authentication strength but does not federate identities. CHAP (B) is an old protocol for PPP connections. Privileged identity management (C) manages high-privilege accounts, not general user access across domains.

Reference Extract from Study Guide:

"Identity federation allows for seamless authentication across on-premises and cloud environments by trusting external identity providers, supporting Single Sign-On (SSO) and hybrid deployments."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Federation and Identity Management Concepts

The correct answer is D — Mission essential functions (MEFs).

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) specifies that mission essential functions (MEFs) are those activities that must be maintained or resumed quickly during or after a disruption to ensure continuity of critical operations, particularly for government agencies.

BCP (A) is the plan itself. DR (B) focuses on IT and system recovery. RPO (C) measures acceptable data loss but does not define critical services.

Reference Extract from Study Guide:

"Mission essential functions (MEFs) are critical activities that must be performed continuously or resumed quickly after disruption to support business or agency operations."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Continuity of Operations Planning

=============================================

Security edge devices(such as NGFWs, IDS/IPS, and secure gateways) are deployed at thenetwork perimeterto inspect and filter traffic, providing aninitial layer of defenseagainst external threats before they reach internal systems.

NIST SP 800-41 Rev. 1:

“Edge security devices enforce security policy at network boundaries and act as a first line of defense by preventing unauthorized or malicious traffic from entering the internal network.”

They are not TPMs or SIEMs, though they maygenerate dataconsumed by SIEMs.

🔹WGU Course Alignment:

Domain:Network Security

Topic:Deploy perimeter defense technologies at network entry points

Integration testingverifies the interactions and data flow between individual software components post-deployment. It is a crucial step in CI/CD pipelines, especially inmulti-tier architecturesystems like web applications.

NIST SP 800-160 Vol. 1 (Systems Security Engineering):

“Integration testing should verify that security functions behave correctly when subsystems or components are combined.”

This test type ensures system cohesion after components are deployed, unlikestatic/dynamic code analysiswhich focuses on code quality and vulnerabilities during earlier phases.

🔹WGU Course Alignment:

Domain:System Security Engineering

Topic:Validate secure systems through testing in CI/CD pipelines

The correct answer is A — Unsecured wireless access points.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) explains that unauthorized logins to a WLAN often indicate poorly secured wireless access points, such as those lacking strong encryption (e.g., WPA2/WPA3), not using strong passwords, or having open accesswithout authentication. This vulnerability can allow attackers to access internal systems and sensitive data.

Up-to-date anti-malware software (B), a strong password policy (C), and regular security training (D) are good security practices but do not directly explain unauthorized WLAN access.

Reference Extract from Study Guide:

"Unauthorized wireless access often results from unsecured wireless configurations, including weak encryption, open networks, or default credentials, posing significant risks to organizational assets."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Wireless Security Concepts

=============================================

The correct answer is A — Conducting regular vulnerability assessments and penetration testing.

According to the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) materials, performing vulnerability assessments and penetration testing helps identify weaknesses in both hardware and virtual environments. Regular testing ensures that any hardware-related vulnerabilities are discovered and addressed before they can be exploited.

Disabling CPU virtualization support (B) would prevent virtual machines from running, defeating the purpose. A web application firewall (C) monitors traffic at the application layer but does not address hardware risks. Access control policies (D) are important but not directly tied to detecting hardware vulnerabilities.

Reference Extract from Study Guide:

"Regular vulnerability assessments and penetration testing identify weaknesses in hardware and software environments, providing critical insights for maintaining a hardened and secure posture."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Security Testing and Assessment

=============================================

DNSSEC (Domain Name System Security Extensions)is a security protocol that adds cryptographic validation to DNS responses, making it nearly impossible for attackers to spoof DNS responses or redirect users to malicious sites.

NIST SP 800-81 Rev. 2 (Secure Domain Name System (DNS) Deployment Guide):

“DNSSEC provides data origin authentication and data integrity to DNS responses using digital signatures, effectively mitigating spoofing and cache poisoning attacks.”

While patching and awareness are important, DNSSECdirectly mitigatesthe technical risk described.

🔹WGU Course Alignment:

Domain:System Security Engineering

Topic:Implement DNS hardening techniques such as DNSSEC

The correct answer is D — Security information and event management (SIEM).

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), a SIEM collects and correlates event data from multiple sources (such as cloud and on-premisesenvironments) in real-time. It provides centralized visibility, analysis, and alerting, which is critical in hybrid cloud deployments.

File integrity monitoring (A) watches for unauthorized file changes, not event correlation. DLP (B) protects sensitive data but does not correlate events. IDS (C) detects network intrusions but does not combine event data centrally.

Reference Extract from Study Guide:

"Security information and event management (SIEM) systems collect, normalize, correlate, andanalyze security event data from multiple sources, providing centralized monitoring and alerting."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Security Monitoring and Event Management

=============================================

SQLis a standard language used to communicate with and manage databases. It allows applications to perform operations such as querying, updating, and managing data.

JDBCis an API in Java that enables Java applications to interact with databases. It provides methods for querying and updating data in a database using SQL.

DBMS (Database Management System)is the system software for creating and managing databases but not directly used by applications for database access.

ODBC (Open Database Connectivity)is another standard API but specific to applications in a broader range of languages and platforms.

GUI (Graphical User Interface)is a user interface and not a method for applications to access databases.

Proxy Server Functions:

Caching: Proxy servers can store copies of web pages and other web resources. This helps to improve load times for frequently accessed resources and reduce bandwidth usage.

Security: They can provide additional security by anonymizing the user’s IP address and filtering unwanted content.

Correct Function:

Acting as a cache (B) is one of the primary functions, where it stores web pages that users in the organization have recently accessed.

Incorrect Functions:

A: Describes a file server.

C: Describes a database server.

D: Describes a web server.

The correct answer is D — Encryption to prevent man-in-the-middle and eavesdropping attacks.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) explains that while NFC is inherently short-range, it is still vulnerable to eavesdropping and man-in-the-middle attacks. Applying encryption ensures that even if communication is intercepted, the data remains protected and confidential.

Kerberos (A) is primarily for authentication within internal networks. Bluetooth restrictions (B) are unrelated to NFC. PDM (C) restricts device usage but does not directly protect NFC communication.

Reference Extract from Study Guide:

"Encrypting near-field communication ensures confidentiality and protects against interception and manipulation through man-in-the-middle and eavesdropping attacks."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Wireless and Mobile Security Concepts

Anoperating system (OS)is a system software that manages computer hardware and software resources and provides common services for computer programs.

It serves as an intermediary between users and the computer hardware.

Key functionsof an OS include:

Managinghardware resourceslike the CPU, memory, and I/O devices.

Providing auser interface(UI) for interaction with the system.

File managementand handling file operations.

Process managementand multitasking.

Securityand access control.

Examples include Windows, Linux, and macOS.

The IT role responsible for the installation and maintenance of hardware and software that make up a computer network is the Network Administrator. Their responsibilities include:

Network installation: Setting up and configuring network hardware, such as routers, switches, firewalls, and servers.

Network maintenance: Ensuring the network operates smoothly, performing regular updates, and troubleshooting issues.

Security management: Implementing security measures to protect the network from unauthorized access, attacks, and breaches.

Performance monitoring: Monitoring network performance and making necessary adjustments to optimize speed and reliability.

Therefore, the Network Administrator is the correct role for these responsibilities.

References

William Stallings, "Data and Computer Communications," Pearson.

Andrew S. Tanenbaum and David J. Wetherall, "Computer Networks," Pearson.

The employee needs to execute a program from the command line, which requires inputting commands into the computer.

The primary device for inputting commands is the keyboard.

Other options like the hard drive, speaker, and printer are not used for inputting commands.

The hard drive is used for data storage.

The speaker outputs sound.

The printer outputs documents.

Therefore, the correct peripheral device for this task is the keyboard.

The correct answer is C — Replacing the legacy firewalls with next-generation firewalls (NGFWs).

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) outlines that NGFWs integrate advanced features like intrusion detection and prevention, application control, and real-time threat intelligence. They are designed to detect and alert on inbound threats as required by the mandate.

SIEM appliances (A) collect logs and correlate events but do not replace firewall functionality. Load balancers (B) manage traffic distribution, not threat detection. Reverse proxies (D) secure and balance traffic for web servers, not general firewall traffic.

Reference Extract from Study Guide:

"Next-generation firewalls (NGFWs) provide integrated intrusion detection and prevention capabilities, fulfilling modern security requirements for real-time threat monitoring and alerting."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Firewall Technologies and Modern Security Controls

The correct answer is C — Implementing a mobile device management (MDM) solution.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) describes that an MDM solution enables organizations to enforce security policies on personal devices, such as encryption, remote wipe capabilities, and application controls. MDM allows safe access to corporate resources while managing the inherent risks of BYOD environments.

Blocking access (A) contradicts the BYOD policy goal. Security audits (B) monitor but do not control personal devices. Awareness training (D) is important but does not enforce technical protections on devices.

Reference Extract from Study Guide:

"Mobile device management (MDM) solutions enforce security policies on employee-owned devices, ensuring compliance and reducing the risks associated with BYOD implementations."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Mobile Device Security

=============================================

Fiber optic communications use light waves to transmit data.

This method allows for high-speed and long-distance data transmission.

The other options:

Radio towers use radio waves.

Twisted pair uses electrical signals.

Coaxial also uses electrical signals.

Therefore, the correct communication medium that uses light waves is fiber optic.

Scope creep refers to the phenomenon where the scope of a project gradually increases over time due to small, incremental changes that were not initially planned or approved. This can happen when:

New featuresor requirements are added without proper evaluation or approval.

Stakeholderscontinuously request small changes or additions.

Lack of a clear scope definitionand change control process.

These small changes can accumulate, leading to significant deviations from the original project plan, affecting the project's schedule, budget, and overall success.

References

Project Management Institute, "A Guide to the Project Management Body of Knowledge (PMBOK Guide)," PMI.

Kathy Schwalbe, "Information Technology Project Management," Cengage Learning.

The correct answer is B — A fully equipped hot site with up-to-date hardware and software.

As stated in WGU Cybersecurity Architecture and Engineering (KFO1 / D488), a hot site is a fully operational data center that mirrors the organization's primary systems and data. In the event of a disaster, operations can quickly transfer to the hot site with minimal downtime, ensuring business continuity.

Mobile data centers (A) are not standard disaster recovery solutions for multinational corporations. Basic secondary backup sites (C) (cold sites) require setup time and are slower to activate. Cloud backups (D) protect data but do not instantly restore full operational capabilities like a hot site.

Reference Extract from Study Guide:

"Hot sites maintain fully operational systems, applications, and data, allowing organizations to maintain business continuity with minimal disruption in the event of a disaster."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Disaster Recovery and Business Continuity Planning

The correct answer is D — Containerization.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) material states that containerization provides isolated environments (containers) where applications can be developed, tested, and deployed securely. This isolation minimizes the risk of vulnerabilities affecting the host system or other applications, improving the overall security of the development process.

DLP (A) prevents data leakage but does not isolate applications. VPNs (B) secure network traffic but do not create isolated development environments. Firewalls (C) control network traffic but do not manage application-level isolation.

Reference Extract from Study Guide:

"Containerization secures application development and deployment by isolating applications in lightweight, standalone environments, reducing risk and improving manageability."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Application Security Concepts

=============================================

To protect datain use(within memory), the provider must implementhardware-level memory encryptionandtrusted execution environments(secure enclaves), which protect against cold boot attacks, memory scraping, and unauthorized access.

NIST SP 800-207A (Hardware-Enabled Security: Enclaves):

“Trusted execution environments and memory encryption mechanisms help ensure that data remains protected even when systems are compromised at lower levels.”

This is amodern cloud security best practiceespecially useful forconfidential computingenvironments.

🔹WGU Course Alignment:

Domain:System Security Engineering / Cryptography

Topic:Protect data in use with hardware-based encryption and enclaves

Access rights are critical components of access control mechanisms in information security. They specify what actions users or systems can perform on specific resources, limiting them to only permitted items.

Definition: Access rights, also known as permissions, are rules that define the allowed actions on a resource (e.g., read, write, execute).

Implementation: Access rights are typically implemented using Access Control Lists (ACLs), Role-Based Access Control (RBAC), or other access control models.

Purpose: The main goal is to enforce the principle of least privilege, ensuring that users can only access the resources necessary for their role.

References

NIST Special Publication 800-53

ISO/IEC 27001:2013

"Computer Security: Principles and Practice" by William Stallings

IT infrastructure encompasses all the physical and virtual resources that support the flow,storage, processing, and analysis of data. Networks, which include the internet, intranets, and extranets, are fundamental components of IT infrastructure as they enable communication and data exchange between different hardware and software components.

Competitorsare known to engage in corporate espionage for business advantage. When intellectual property is targeted (like eBooks, videos), it often indicates acommercial motive, rather than political (hacktivist), state-sponsored (APT), or random (novice hacker) reasons.

NIST SP 800-30 Rev. 1 (Guide for Conducting Risk Assessments):

“Threat sources include adversarial actors such as competitors seeking proprietary or confidential business information.”

The data theft of commercial products strongly aligns with anadversarial actor motivated by business gain, a hallmark of competitor-driven threat modeling.

🔹WGU Course Alignment:

Domain:Security Models and Design

Topic:Understand threat actor types and motivations (e.g., competitors, insiders, nation-states)

The correct answer is A — Homomorphic encryption.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), homomorphic encryption allows computations to be performed directly on encrypted data without needing to decrypt it first. This ensures the confidentiality of the data even during processing.

SFE (B) allows two parties to jointly compute a function without revealing inputs but is not the same. SSL (C) secures communication channels. PIR (D) is for retrieving information privately, not computing on encrypted data.

Reference Extract from Study Guide:

"Homomorphic encryption allows operations on encrypted data, enabling secure processing by third parties without exposing underlying data."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Advanced Encryption Techniques

=============================================

An input device is any hardware component that allows a user to enter data into a computer.

A scanner is an input device that converts physical documents into digital format.

The other options:

Printer is an output device.

Flash drive is a storage device.

CD can be both storage and media for input/output depending on the context but is not primarily used for direct data input.

Therefore, a scanner is the correct answer for an input device.

The correct answer is B — Risk mitigation.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488) course content, risk mitigation involves taking steps to reduce either the likelihood or the impact of risks. Since the healthcare provider plans to implement tools to lower the risks identified at the clinic, it is using a mitigation strategy, not avoiding, transferring, or simply accepting the risk.

Risk acceptance (A) means taking no action. Risk transference (C) shifts responsibility elsewhere, such as through insurance. Risk avoidance (D) involves eliminating the risky activity entirely.

Reference Extract from Study Guide:

"Risk mitigation is the process of implementing measures to reduce the likelihood or impact of identified risks, often through security controls or operational changes."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Response Strategies

The correct answer is B — Advanced Encryption Standard (AES).

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), AES is a widely adopted symmetric encryption standard that ensures the confidentiality and integrity of sensitive data, including patient health information, which HIPAA mandates to protect. AES is considered highly secure and efficient for encrypting stored or transmitted healthcare data.

WEP (A) is outdated and insecure. SMTP (C) is a protocol for sending emails, not encryption. RSA (D) is an asymmetric encryption method typically used for key exchanges, not bulk data encryption.

Reference Extract from Study Guide:

"Advanced Encryption Standard (AES) is recommended for encrypting sensitive healthcare data, providing strong protection for confidentiality and integrity in HIPAA-regulated environments."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Encryption Standards and Regulatory Compliance

=============================================

The second generation of computers (1956-1963) saw the introduction of transistors, which replaced vacuum tubes used in the first generation. Transistors allowed computers to be smaller, faster, more reliable, and more energy-efficient compared to their predecessors.

Arelational databaseis structured to recognize relations among stored items of information.

Multiple tablesin a relational database can have interrelated fields.

These relationships are often managed throughforeign keys, which reference the primary keys of other tables.

This relational model allows for complex queries and data integrity across the database.

Example:Tables such asCustomers,Orders, andProductsin a sales database, whereOrderstable may reference bothCustomersandProductstables to establish relationships.

The correct answer is A — Developing and implementing a testing plan for the DRP.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), testing the disaster recovery plan is critical to ensuring that it is functional and effective when an actual disruptive event occurs. Regularly scheduled DRP testing validates that recovery processes work as intended and that personnel are familiar with their responsibilities.

Reviewing (B) and training (D) are important but are supplementary activities. Risk assessment (C) is important for planning but does not test the DRP.

Reference Extract from Study Guide:

"Testing and exercising disaster recovery plans ensure operational readiness and reveal gaps or weaknesses that can be corrected before an actual event occurs."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Disaster Recovery Testing and Validation

=============================================

Logging and monitoringendpoint activity enables early detection of unauthorized access, suspicious file changes, or user behavior anomalies that may indicate an insider threat or external breach.

NIST SP 800-137 (Information Security Continuous Monitoring):

“Endpoint logging and behavior monitoring are essential for detecting unauthorized access to sensitive information, especially in healthcare environments governed by HIPAA.”

This control supportsreal-time alerting,incident response, andcompliance auditingfor patient data (ePHI).

🔹WGU Course Alignment:

Domain:System Security Engineering

Topic:Implement endpoint monitoring and logging for healthcare compliance (e.g., HIPAA)

The correct answer is C — Restrict access to the backups.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), the first step in protecting sensitive data such as cloud backups is enforcing access controls to limit who can access the data. Restricting access immediately mitigates the risk of unauthorized exposure or tampering.

Auditing access logs (A) provides insight but does not actively protect. Running vulnerability scans (B) identifies issues but does not protect immediately. Disabling repositories (D) is not practical for maintaining backup availability.

Reference Extract from Study Guide:

"Access control is the first line of defense for sensitive data repositories, ensuring that only authorized users can access backup data."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Data Security and Access Control

=============================================

The correct answer is D — Block ciphers.

Per the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) materials, block ciphers encrypt fixed-size blocks of data at a time, providing strong security suitable for data at rest, such as databases. Though they may be less performance-efficient compared to stream ciphers, their strength makes them ideal for securing stored sensitive information.

Stream ciphers (A) are optimized for real-time encryption, not stored data. Asymmetric encryption (B) is slower and more suited for key exchange rather than large data encryption. Hash functions (C) provide integrity verification, not encryption.

Reference Extract from Study Guide:

"Block ciphers encrypt fixed-length blocks of data, providing robust security ideal for protecting data at rest, such as sensitive database information."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Encryption Technologies

=============================================

The correct answer is B — Internet Protocol Security (IPsec).

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), IPsec provides secure communication over IP networks by encrypting and authenticating IP packets. It is widely used for site-to-site VPNs and ensures confidentiality, integrity, and authentication between different cloud environments like Azure and AWS.

TCP (A) is a transport layer protocol ensuring reliable delivery but not encryption. FTP (C) is used for file transfer and is insecure unless secured with extensions. SSH (D) secures remote terminal sessions but is not primarily used for network-wide secure communication.

Reference Extract from Study Guide:

"IPsec provides a secure method of communication across IP networks, ensuring data confidentiality, integrity, and authentication for VPN connections and hybrid cloud communications."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Secure Protocols for Hybrid Environments

=============================================

Applyingregular updates and patchesis fundamental to risk mitigation. Choosing ahybrid cloud topologyallows the financial institution to retaincritical services in-housewhile leveragingcloud scalabilityfor high-volume transactions.

NIST SP 800-160 Vol. 1 (Systems Security Engineering):

“Security patching is essential for mitigating vulnerabilities, especially in high-assurance environments like financial systems.”

Thehybrid modelbalancesperformance, control, and security, which is vital for core banking systems.

🔹WGU Course Alignment:

Domain:System Security Engineering

Topic:Apply risk mitigation techniques and choose secure deployment topologies

A Local Area Network (LAN) requires a router to communicate over the Internet.

The router serves as a gateway that connects the LAN to the external network (Internet) and directs data traffic between the LAN and the Internet.

The other options:

Multiplexer combines multiple signals into one.

Repeater amplifies signals to extend the range.

Switch connects devices within the LAN but does not facilitate Internet communication.

Therefore, a router is the necessary device for a LAN to communicate over the Internet.

Proprietary softwareis a type of software that is owned by an individual or a company.

It is usually sold commercially and comes with acommercial software license.

This type of license typically restricts the ways in which the software can be used, modified, and distributed.

Users must agree to the terms of the license, which often include restrictions on copying, sharing, and modifying the software.

Example:Microsoft Windows and Adobe Photoshop are proprietary software products.

Parallel conversion is a system deployment method where the new system is implemented and runs alongside the old system for a period of time. This method allows for:

Comparison of outputs: Ensuring that the new system produces the same or better results as the old system.

Risk reduction: If there are issues with the new system, the old system can still be used without interrupting business operations.

User adaptation: Users can get accustomed to the new system while still having access to the familiar old system.

Parallel conversion is often used to minimize the risk associated with deploying a new system.

References

Harold Kerzner, "Project Management: A Systems Approach to Planning, Scheduling, and Controlling," Wiley.

Kathy Schwalbe, "Information Technology Project Management," Cengage Learning.

Electronic Codebook (ECB)is thesimplest modeof block cipher operation, but it encrypts each blockindependently, which results inidentical ciphertext for identical plaintext blocks— making itunsafe for use with structured or repetitive data.

NIST SP 800-38A (Recommendation for Block Cipher Modes of Operation):

“ECB reveals patterns in plaintext and should not be used when such patterns are meaningful and predictable.”

Though efficient, ECB lackssemantic securityand is rarely recommended in practice.

🔹WGU Course Alignment:

Domain:Cryptography

Topic:Evaluate block cipher modes for appropriate use cases

The correct answer is B — Secure Hash Algorithm 256 (SHA-256).

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) outlines that SHA-256 is a cryptographic hash function used to verify data integrity. It generates a fixed-size hash value based on input data, and any alteration to the data results in a different hash, signaling tampering.

DES (A) and AES (C) are encryption algorithms for confidentiality. RSA (D) is used for encryption and digital signatures, not solely for ensuring integrity via hashing.

Reference Extract from Study Guide:

"SHA-256 is a widely adopted cryptographic hash function used to verify the integrity of digital data and detect unauthorized modifications."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Cryptographic Hash Functions and Data Integrity

=============================================

Data is considered information when it has been processed and organized in a meaningful way. Raw data in its unprocessed state is not useful until it undergoes processing to become interpretable and actionable information. Processing can involve sorting, aggregating, and analyzing data to extract valuable insights.

A floating-point data type is used for numerical calculations that require a decimal point, such as percentages. In this case, to calculate 90% of the retail price of an item, a floating-point data type is necessary because it can represent both the whole number and the fractional part of the number, allowing for precise calculations.

The correct answer is B — Access logs.

As outlined in the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) materials, access logs record who accessed which system components, when they did so, and what changes they made. These logs are vital for creating an audit trail that can be reviewed to detect unauthorized changes to applications or systems.

NetFlow logs (A) track network traffic flows but not system or application changes. Packet capture logs (C) deal with network data but are not specialized for auditing application-level events. Router logs (D) capture network device activity, not application access information.

Reference Extract from Study Guide:

"Access logs maintain detailed records of user actions within systems and applications, providing the necessary audit trail for tracking authorized and unauthorized activities."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Log Management Concepts

=============================================

The correct answer is A — Intrusion detection system (IDS).

As outlined in WGU Cybersecurity Architecture and Engineering (KFO1 / D488), an IDS helps monitor network traffic for suspicious activities and security threats, making it a fundamental component of securing a network for a start-up. It enables early detection of attacks, contributing both to cybersecurity defense and incident response efforts.

Packet filtering (B) is a limited firewall technique and not as comprehensive. Bootstrapping (C) is a startup or initialization process, not a security measure. VPN (D) secures remote access but does not inherently monitor for threats.

Reference Extract from Study Guide:

"An intrusion detection system (IDS) monitors network traffic for suspicious activity and potential threats, enhancing a network’s security posture and supporting incident detection."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Network Security Monitoring and Defense

Here are your fully verified and properly formatted answers for this final batch, based on WGU Cybersecurity Architecture and Engineering (KFO1 / D488) official materials:

=============================================

Wireless Intrusion Prevention Systems (WIPS)are specifically designed to monitor wireless networks and prevent rogue access points, MITM attacks, and wireless eavesdropping. Unlike Layer 3 switches or SIEM tools, WIPS directly addresses wireless threat vectors.

NIST SP 800-153 (Guidelines for Securing Wireless Local Area Networks):

“WIPS technologies help detect and prevent unauthorized wireless access points and attacks such as evil twin and man-in-the-middle attempts.”

🔹WGU Course Alignment:

Domain:Network Security

Topic:Implement wireless network protections (e.g., WIPS)

The correct answer is A — Risk appetite.

As per the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) coursework, risk appetite defines the amount and type of risk an organization is willing to accept in pursuit of its objectives. It is a strategic-level metric used by executive leadership and boards to determine if the current level of risk exceeds what the organization is comfortable handling.

Risk evaluation plans (B) outline how risks are assessed, treatment plans (C) describe mitigation actions, and risk tolerance (D) is more operational, defining acceptable variation from the appetite but not the overall strategic limit.

Reference Extract from Study Guide:

"Risk appetite represents the amount of risk an organization is willing to pursue or retain and is established by senior leadership as part of governance activities."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Management Concepts

=============================================

The correct answer is C — Host-based firewall.

According to the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) materials, a host-based firewall enforces traffic control policies at the endpoint level. It can allow or deny traffic based on application, port, IP address, and protocol rules, restricting access to only approved services and applications on a system.

Antivirus tools (A) detect malware but do not control network traffic. Two-factor authentication (B) secures user access but does not manage network traffic. HSMs (D) handle encryption keys, not network access control.

Reference Extract from Study Guide:

"Host-based firewalls restrict traffic at the system level, permitting only authorized services and applications, enhancing endpoint security."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Endpoint Protection and Firewalls

=============================================

Organizational culture can support ethical guidelines by establishing clear protocols and policies that promote the security and privacy of data. This includes:

Data protection policies: Guidelines on how data should be handled, stored, and protected.

Ethical behavior: Encouraging employees to adhere to ethical standards and practices.

Training and awareness: Regular training sessions to educate employees on security best practices and ethical behavior.

Incident response: Protocols for responding to data breaches and other security incidents.

A strong organizational culture that prioritizes data security and privacy helps ensure that ethical guidelines are consistently followed.

References

Michael E. Whitman and Herbert J. Mattord, "Principles of Information Security," Cengage Learning.

Rebecca Herold, "Managing an Information Security and Privacy Awareness and Training Program," CRC Press.