WGU Cybersecurity-Architecture-and-Engineering Dumps

The correct answer is D — Mission essential functions (MEFs).

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) specifies that mission essential functions (MEFs) are those activities that must be maintained or resumed quickly during or after a disruption to ensure continuity of critical operations, particularly for government agencies.

BCP (A) is the plan itself. DR (B) focuses on IT and system recovery. RPO (C) measures acceptable data loss but does not define critical services.

Reference Extract from Study Guide:

"Mission essential functions (MEFs) are critical activities that must be performed continuously or resumed quickly after disruption to support business or agency operations."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Continuity of Operations Planning

=============================================

The correct answer is A — Virtual network peering.

According to the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) Study Guide, virtual network peering enables direct communication between two or more virtual networks without the need for gateways, VPNs, or additional configurations. It allows seamless interconnectivity with minimal administrative overhead. Peered networks can communicate as if they were part of the same network, which meets the organization's request for the least administrative effort.

Other options like Virtual LANs (B) operate within the same network and don't span multiple virtual networks. Remote Desktop Protocol (C) is used for remote access, not network interconnection. Domain Name System (D) resolves names to IP addresses but does not establish communication pathways between networks.

Reference Extract from Study Guide:

"Virtual network peering provides a low-latency, high-bandwidth connection between virtual networks with minimal administrative setup. It is the recommended solution for direct communication across cloud-based virtual networks."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Network Architectures Module

=============================================

The correct answer is C — Stream ciphers.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) content explains that stream ciphers encrypt data bit-by-bit or byte-by-byte, making them highly efficient and suitable for real-time applications like video conferencing where low latency is critical.

Block ciphers (A) encrypt large chunks of data, causing latency. Asymmetric encryption (B) is too slow for real-time data streams. Hash functions (D) are used for data integrity, not for ongoing data encryption.

Reference Extract from Study Guide:

"Stream ciphers encrypt data continuously and are ideal for real-time applications such as video or audio streaming where low latency is essential."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Encryption Technologies

The domain name in a Uniform Resource Locator (URL) identifies the server on which the web page can be found.

Example: In the URL

"http" is the protocol.

is the domain name.

"/index.html" is the resource path ID.

The other options:

The protocol specifies the communication method.

The resource path ID specifies the specific page or resource on the server.

The IP address is not typically visible in the URL itself but can be resolved via DNS.

Therefore, the domain name is the correct part that identifies the server.

The correct answer is D — Weak passwords.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), unauthorized SSH access from an unknown IP address often suggests that the attacker exploited weak or compromised passwords to gain access. Weak passwords are a common vulnerability for services exposed to the internet, especially SSH servers.

Exfiltration (A) refers to data theft after access, not initial unauthorized access. Unpatched software (B) might lead to other vulnerabilities but is not indicated here. Enumeration (C) is gathering information but not gaining login access directly.

Reference Extract from Study Guide:

"Weak or compromised passwords are a primary cause of unauthorized access, particularly for remote management interfaces such as SSH."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Authentication Security BestPractices

=============================================

Theavailabilityof the POS system depends on itsresilience against known vulnerabilities. Applyingregular security patchesensures that attackers cannot exploit outdated components, which could crash or disrupt the POS system.

NIST SP 800-40 Rev. 3 (Guide to Enterprise Patch Management):

“Prompt application of security patches mitigates vulnerabilities that can be exploited to disrupt system availability or compromise data.”

Backups protect from data loss, butpatching is proactive protectionfor uptime and availability.

????WGU Course Alignment:

Domain:Security Operations and Monitoring

Topic:Maintain system availability through proactive patch management

The correct answer is B — Sixteen characters with at least one letter, one number, and one symbol.

According to the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) Study Guide, strong password policies must enforce a minimum length (preferably 12 to 16 characters) and require complexity, including uppercase and lowercase letters, numbers, and special characters. Sixteen-character passwords that include varied character types greatly increase the difficulty for attackers using brute-force or dictionary attacks.

Options A, C, and D either lack complexity or have too few characters, making them vulnerable to attacks.

Reference Extract from Study Guide:

"A strong password should be at least 12–16 characters long and include a mix of uppercase letters, lowercase letters, numbers, and special characters to maximize resistance to brute-force attacks."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Identity and AccessManagement Concepts

=============================================

The relational model is the most common organizing principle of databases. In a relational database, data is organized into tables (or relations), where each table consists of rows andcolumns. Each row represents a record with a unique identifier, and each column represents a data field. This model allows for easy data retrieval and management through the use of structured query language (SQL).

Access rights are critical components of access control mechanisms in information security. They specify what actions users or systems can perform on specific resources, limiting them to only permitted items.

Definition: Access rights, also known as permissions, are rules that define the allowed actions on a resource (e.g., read, write, execute).

Implementation: Access rights are typically implemented using Access Control Lists (ACLs), Role-Based Access Control (RBAC), or other access control models.

Purpose: The main goal is to enforce the principle of least privilege, ensuring that users can only access the resources necessary for their role.

References

NIST Special Publication 800-53

ISO/IEC 27001:2013

"Computer Security: Principles and Practice" by William Stallings

Aproprietary software licensetypically grants a business or user theright to usethe software.

Unlike open-source licenses, proprietary licenses do not usually allow modification, redistribution, or reverse engineering.

The software remains the property of the company that created it, and the licensee is only granted specific, limited rights.

Examples:Many enterprise software applications come with proprietary licenses that specify the terms of use.

The correct answer is B — Business impact analysis (BIA).

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), a BIA identifies and prioritizes critical business functions and assesses the impact of disruptions on those functions. It determines recovery priorities and establishes the framework for disaster recovery and business continuity planning.

BCP (A) is the broader planning effort. DR (C) focuses on restoring systems. IR (D) responds to specific incidents, not overall business impacts.

Reference Extract from Study Guide:

"Business impact analysis (BIA) determines the criticality of business processes by assessing thepotential impacts of disruptions, providing the foundation for prioritizing recovery efforts."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Business Continuity and Disaster Recovery Planning

=============================================

Organizational culture can support ethical guidelines by establishing clear protocols and policies that promote the security and privacy of data. This includes:

Data protection policies: Guidelines on how data should be handled, stored, and protected.

Ethical behavior: Encouraging employees to adhere to ethical standards and practices.

Training and awareness: Regular training sessions to educate employees on security best practices and ethical behavior.

Incident response: Protocols for responding to data breaches and other security incidents.

A strong organizational culture that prioritizes data security and privacy helps ensure that ethical guidelines are consistently followed.

References

Michael E. Whitman and Herbert J. Mattord, "Principles of Information Security," Cengage Learning.

Rebecca Herold, "Managing an Information Security and Privacy Awareness and Training Program," CRC Press.

Information Technology (IT) has revolutionized the way businesses operate, enabling them to reach global markets and audiences. IT facilitates communication, data exchange, and operational efficiency across borders, allowing companies to manage global operations and engage with international customers seamlessly. This global reach is a critical aspect of modern business strategies, driven by advancements in IT infrastructure and services.

Big data refers to the use of large and complex data sets that traditional data-processing software cannot adequately handle. Businesses leverage big data to analyze and systematically extract information from large datasets, which helps them gain valuable insights, improve decision-making, enhance customer experiences, and optimize business processes. This capability is critical in today's data-driven world, where informed decision-making can significantly impact a company's success.

The correct answer is D — Secure Shell (SSH).

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) materials state that SSH provides strong encryption and authentication for remote access over unsecured networks. SSH ensures that sessions are confidential and that only authorized users can access remote systems.

HTTP (A) and FTP (B) transmit data in plaintext and do not provide encryption. Telnet (C) also transmits data in plaintext and is insecure for remote access.

Reference Extract from Study Guide:

"Secure Shell (SSH) is used for secure remote management, offering encrypted communications and authentication mechanisms to protect against unauthorized access and eavesdropping."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Secure Protocols and Communications

=============================================

The correct answer is B — Risk mitigation.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488) course content, risk mitigation involves taking steps to reduce either the likelihood or the impact of risks. Since the healthcare provider plans to implement tools to lower the risks identified at the clinic, it is using a mitigation strategy, not avoiding, transferring, or simply accepting the risk.

Risk acceptance (A) means taking no action. Risk transference (C) shifts responsibility elsewhere, such as through insurance. Risk avoidance (D) involves eliminating the risky activity entirely.

Reference Extract from Study Guide:

"Risk mitigation is the process of implementing measures to reduce the likelihood or impact of identified risks, often through security controls or operational changes."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Response Strategies

Packet sniffing is a technique used to capture and analyze network traffic, which can include intercepting passwords while they are in transit.

When data packets are transmitted over a network, a packet sniffer can capture these packets, and if they are not encrypted, it can read sensitive information like passwords.

The other options:

Buffer overflow is a type of attack that exploits a program's memory handling.

Phishing is a social engineering attack to deceive users into providing sensitive information.

Black hat refers to a hacker with malicious intent, not a specific technique.

Therefore, packet sniffing is the correct technique for obtaining passwords in transit.

Risk avoidanceinvolves eliminating the source of risk altogether. In this case, the organization chose todecommission the vulnerable systeminstead of patching or compensating — a clear example of avoiding risk.

NIST SP 800-30 Rev. 1 (Risk Assessment Guide):

“Risk avoidance involves not performing the action that gives rise to the risk or eliminating the risk cause or consequence.”

This strategy is ideal when the cost or complexity of mitigation is too high or when risk to the business is unacceptable.

????WGU Course Alignment:

Domain:Security Models and Design

Topic:Understand and apply risk response strategies (avoid, accept, transfer, mitigate)

Computer networks provide several benefits for businesses, including:

Lower IT operations costs: Networking allows businesses to share resources, such as printers and storage, reducing the need for individual equipment for each user and lowering overall IT costs.

Increased business efficiency: Networks enable faster communication and data sharing between employees, departments, and locations, leading to more efficient business operations and improved collaboration.

The goal in this scenario is tosecure the application against malware and advanced persistent threats (APTs). According to the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) course materials:

Firewall policiesare critical forcontrolling accessto applications and network resources.

By implementing astrict firewall policy, you limit access to only trusted and necessary sources, greatly reducing the attack surface available to malware or APT actors.

While antivirus software (Option C) can help detect malware,APT actors often use sophisticated methodsthat bypass traditional antivirus tools.

Encryption (Option A) protectsdata confidentialitybutdoes not preventmalware or APTs from attacking the application.

Strong password policies (Option B) helpwith account securitybutdo not directly addressmalware or APT threats.

Key extract from the WGU D488 Study Guide:

"A strict firewall policy is essential for preventing unauthorized access and mitigating advanced persistent threats. Limiting exposure through segmentation, access control lists, and traffic filtering protects critical assets from external and internal threats."

The correct order of project phases according to the Project Management Institute (PMI) and other standard project management methodologies is:

Initiation: This phase involves defining the project at a high level and getting approval to start.

Planning: In this phase, detailed planning is done to set the project's scope, objectives, and procedures.

Executing: This phase is where the project plan is put into action and the project deliverables are created.

Monitoring and Controlling: This phase involves tracking, reviewing, and regulating the project’s progress and performance, ensuring that everything aligns with the project plan.

Closing: This is the final phase, where the project is formally closed, and final deliverables are handed over.

References

Project Management Institute, "A Guide to the Project Management Body of Knowledge (PMBOK Guide)," PMI.

Harold Kerzner, "Project Management: A Systems Approach to Planning, Scheduling, and Controlling," Wiley.

The correct answer is B — Password policies.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) emphasizes that strong password policies, including requirements for complexity, minimum length, expiration, and reuse restrictions, are essential for protecting user credentials from compromise.

Object storage (A) and removable storage (C) deal with data storage, not password management. Hardware key managers (D) manage cryptographic keys, not passwords directly.

Reference Extract from Study Guide:

"Implementing strong password policies enforces secure password practices among users, reducing the risk of credential compromise."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Identity and Access Management Controls

=============================================

The correct answer is B — Compare the unknown address to known IP addresses to determine if it is a threat.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), proper threat analysis requires identifying and verifying whether an unknown source is malicious before taking action. Comparing the IP address against known threat databases or intelligence feeds allows the organization to make informed decisions.

Permanently blocking (A) or temporarily blocking (C) without analysis could cause disruption if the IP is legitimate. Rate limiting (D) reduces traffic but does not determine threat status.

Reference Extract from Study Guide:

"Effective incident analysis begins by verifying and classifying the suspicious activity, including checking unknown IP addresses against threat intelligence sources."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Threat Analysis and IncidentHandling

=============================================

Security edge devices(such as NGFWs, IDS/IPS, and secure gateways) are deployed at thenetwork perimeterto inspect and filter traffic, providing aninitial layer of defenseagainst external threats before they reach internal systems.

NIST SP 800-41 Rev. 1:

“Edge security devices enforce security policy at network boundaries and act as a first line of defense by preventing unauthorized or malicious traffic from entering the internal network.”

They are not TPMs or SIEMs, though they maygenerate dataconsumed by SIEMs.

????WGU Course Alignment:

Domain:Network Security

Topic:Deploy perimeter defense technologies at network entry points

The correct answer is C — Implementing shell restrictions.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), shell restrictions on Linux systems can prevent users (or attackers) from executing unauthorized commands, significantly reducing the exploitation risk on Linux servers.

Host-based IDPS (A) detects attacks but does not directly harden the OS. Access control (B) andassessments/penetration testing (D) are important but do not focus specifically on securing the Linux shell environment.

Reference Extract from Study Guide:

"Implementing shell restrictions on Linux systems minimizes the attack surface by limiting the ability of users and processes to execute unauthorized commands."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Linux System Hardening Techniques

Integration testingverifies the interactions and data flow between individual software components post-deployment. It is a crucial step in CI/CD pipelines, especially inmulti-tier architecturesystems like web applications.

NIST SP 800-160 Vol. 1 (Systems Security Engineering):

“Integration testing should verify that security functions behave correctly when subsystems or components are combined.”

This test type ensures system cohesion after components are deployed, unlikestatic/dynamic code analysiswhich focuses on code quality and vulnerabilities during earlier phases.

????WGU Course Alignment:

Domain:System Security Engineering

Topic:Validate secure systems through testing in CI/CD pipelines

The correct answer is D — Installing endpoint protection software.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) teaches that endpoint protection (including antivirus, anti-malware, and endpoint detection and response) is critical for detecting,blocking, and removing commodity malware like ransomware and Trojans.

Firewalls (A) help with perimeter security but don't directly block malware on endpoints. Rerouting communications (B) is not a standard protection method. Two-factor authentication (C) secures logins but does not protect systems from malware infection.

Reference Extract from Study Guide:

"Endpoint protection software defends individual systems against malware threats by detecting, blocking, and removing malicious files and processes."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Endpoint Security Solutions

=============================================

The correct answer is D — Containerization.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) material states that containerization provides isolated environments (containers) where applications can be developed, tested, and deployed securely. This isolation minimizes the risk of vulnerabilities affecting the host system or other applications, improving the overall security of the development process.

DLP (A) prevents data leakage but does not isolate applications. VPNs (B) secure network traffic but do not create isolated development environments. Firewalls (C) control network traffic but do not manage application-level isolation.

Reference Extract from Study Guide:

"Containerization secures application development and deployment by isolating applications in lightweight, standalone environments, reducing risk and improving manageability."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Application Security Concepts

=============================================

The correct answer is C — HTTP interceptor.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), an HTTP interceptor is a tool or method used to capture, inspect, and manipulate HTTP/S traffic between aclient and server. It allows testers to identify security vulnerabilities such as improper input validation, session management flaws, and exposure of sensitive data.

A Bastion scanner (A) is not a standard tool for traffic inspection. Port scanners (B) check for open ports but do not inspect HTTP traffic content. Domain interceptors (D) are not a recognized testing tool in this context.

Reference Extract from Study Guide:

"HTTP interceptors allow for the inspection and manipulation of web traffic, helping to identify application vulnerabilities prior to deployment."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Web Application Security Testing

=============================================

It is better to purchase software rather than build a software solution in-house when there is a short timeline. Building software from scratch requires significant time for development, testing, and deployment. Purchasing off-the-shelf software can significantly reduce the time needed to implement a solution. Other considerations include:

Cost-effectiveness: Pre-built software can be more cost-effective than developing a custom solution, especially when factoring in the costs of development, maintenance, and support.

Immediate availability: Purchased software is usually ready to deploy immediately, whereas custom development can take months or even years.

Proven reliability: Commercial software often has a track record of reliability and user support, reducing the risk of bugs and issues that may arise with custom development.

Therefore, when time is of the essence, purchasing software is the preferable option.

References

Ian Sommerville, "Software Engineering," Pearson.

Steve McConnell, "Rapid Development: Taming Wild Software Schedules," Microsoft Press.

The correct answer is D — Encryption to prevent man-in-the-middle and eavesdropping attacks.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) explains that while NFC is inherently short-range, it is still vulnerable to eavesdropping and man-in-the-middle attacks. Applying encryption ensures that even if communication is intercepted, the data remains protected and confidential.

Kerberos (A) is primarily for authentication within internal networks. Bluetooth restrictions (B) are unrelated to NFC. PDM (C) restricts device usage but does not directly protect NFC communication.

Reference Extract from Study Guide:

"Encrypting near-field communication ensures confidentiality and protects against interception and manipulation through man-in-the-middle and eavesdropping attacks."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Wireless and Mobile Security Concepts

The correct answer is C — Encrypting data.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) states that encryption is the best defense against man-in-the-middle attacks because even if traffic is intercepted, the data remains unreadable without the appropriate decryption keys.

Disabling Wi-Fi (A) is not practical and does not eliminate MITM threats entirely. Password policies (B and D) strengthen account security but do not protect data transmission.

Reference Extract from Study Guide:

"Encryption ensures the confidentiality of data in transit, preventing unauthorized parties from accessing the content even during man-in-the-middle attacks."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Data Transmission Security

=============================================

The correct answer is A — Unsecured wireless access points.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) explains that unauthorized logins to a WLAN often indicate poorly secured wireless access points, such as those lacking strong encryption (e.g., WPA2/WPA3), not using strong passwords, or having open accesswithout authentication. This vulnerability can allow attackers to access internal systems and sensitive data.

Up-to-date anti-malware software (B), a strong password policy (C), and regular security training (D) are good security practices but do not directly explain unauthorized WLAN access.

Reference Extract from Study Guide:

"Unauthorized wireless access often results from unsecured wireless configurations, including weak encryption, open networks, or default credentials, posing significant risks to organizational assets."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Wireless Security Concepts

=============================================

In a star network topology, each network device is connected to a central device like a hub or a switch.

This central device acts as a repeater for data flow.

The other options:

Bus topology uses a single central cable.

Mesh topology involves each device being connected to every other device.

Ring topology connects devices in a circular fashion.

Therefore, the star topology correctly describes a network where devices connect to a central hub or switch.

The correct answer is C — Intrusion prevention system.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) states that an Intrusion Prevention System (IPS) actively monitors network traffic and can block malicious activity in real-time. It can enforce rules like blocking an IP address after multiple failed SSH login attempts, stopping brute force attacks.

DLP (A) focuses on preventing sensitive data loss. A firewall (B) controls network traffic but generally does not automatically block based on login attempts unless highly customized. File integrity monitoring (D) watches file changes, not login attempts.

Reference Extract from Study Guide:

"An intrusion prevention system (IPS) monitors network traffic for malicious activities and can automatically block connections that meet predefined suspicious criteria."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Intrusion Detection and Prevention Systems

=============================================

The correct answer is C — Symmetric algorithm.

According to the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) study material, symmetric encryption uses the same key for both encryption and decryption, offering high speed and lower computational overhead compared to asymmetric algorithms. This makes symmetric encryption ideal when both security and performance are important factors.

Block cipher (A) is a type of symmetric algorithm but not the broader category being asked. Hash functions (B) are for data integrity, not encryption/decryption. Asymmetric algorithms (D) are more secure for key exchange but have higher computational cost.

Reference Extract from Study Guide:

"Symmetric encryption algorithms use a single shared key for encryption and decryption, offering efficient and high-performance protection for sensitive data transmissions."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Cryptography Fundamentals

=============================================

The correct answer is A — Expiration.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), password expiration policies require users to change their passwords after a certain period, ensuring that long-term credential exposure risk is minimized.

Length (B) defines minimum password size. Recovery (C) relates to resetting forgotten passwords. Complexity (D) enforces character requirements, not age.

Reference Extract from Study Guide:

"Password expiration policies require users to update passwords regularly, minimizing the risk of long-term credential exposure."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Password Security Best Practices

=============================================

The correct answer is B — Elliptic Curve Diffie-Hellman (ECDH).

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) material highlights that ECDH is an enhanced, more efficient form of the traditional Diffie-Hellman key exchange, using elliptic curve cryptography (ECC). It provides similar security with much smaller key sizes, improving performance and efficiency.

DH (A) is the traditional method but is less efficient. RSA (C) is primarily used for encryption and digital signatures. DSA (D) is used for digital signatures, not for key exchange.

Reference Extract from Study Guide:

"Elliptic Curve Diffie-Hellman (ECDH) enhances traditional key exchange by utilizing elliptic curve cryptography, offering higher security with smaller key sizes and improved efficiency."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Cryptographic Key Management

The correct answer is A — Intrusion detection system (IDS).

As outlined in WGU Cybersecurity Architecture and Engineering (KFO1 / D488), an IDS helps monitor network traffic for suspicious activities and security threats, making it a fundamental component of securing a network for a start-up. It enables early detection of attacks, contributing both to cybersecurity defense and incident response efforts.

Packet filtering (B) is a limited firewall technique and not as comprehensive. Bootstrapping (C) is a startup or initialization process, not a security measure. VPN (D) secures remote access but does not inherently monitor for threats.

Reference Extract from Study Guide:

"An intrusion detection system (IDS) monitors network traffic for suspicious activity and potential threats, enhancing a network’s security posture and supporting incident detection."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Network Security Monitoring and Defense

Here are your fully verified and properly formatted answers for this final batch, based on WGU Cybersecurity Architecture and Engineering (KFO1 / D488) official materials:

=============================================

DNSSEC (Domain Name System Security Extensions)is a security protocol that adds cryptographic validation to DNS responses, making it nearly impossible for attackers to spoof DNS responses or redirect users to malicious sites.

NIST SP 800-81 Rev. 2 (Secure Domain Name System (DNS) Deployment Guide):

“DNSSEC provides data origin authentication and data integrity to DNS responses using digital signatures, effectively mitigating spoofing and cache poisoning attacks.”

While patching and awareness are important, DNSSECdirectly mitigatesthe technical risk described.

????WGU Course Alignment:

Domain:System Security Engineering

Topic:Implement DNS hardening techniques such as DNSSEC

The correct answer is C — Obfuscating error messages on the site or within the uniform resource locator (URL).

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) states that minimizing the information revealed through error messages and URLs prevents attackers from gathering reconnaissance information that could be used to exploit vulnerabilities.

HTTPS (A and B) protects data in transit but does not conceal server details. PCI-DSS certification (D) improves overall security but is not focused specifically on information disclosure during a redesign.

Reference Extract from Study Guide:

"Obfuscating detailed error messages and removing revealing information in URLs help prevent attackers from gaining reconnaissance data that could be used in targeted attacks."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Web Application Security

=============================================

The SQL statement provided is:

SELECT*FROMCustomersWHEREState ='Arizona';

SELECT *indicates that all columns from the table should be selected.

FROM Customersspecifies the table from which to retrieve the data.

WHERE State = 'Arizona'filters the results to include only those records where the State column has the value 'Arizona'.

Therefore, the statement returns all records from the Customers table that are located in Arizona.

Data encryptionensures confidentiality and integrity even if communications are intercepted. If properly implemented (e.g., using TLS), encryption makes the payload unreadable to the attacker.

NIST SP 800-52 Rev. 2 (Guidelines for the Selection and Use of Transport Layer Security):

“Encryption technologies provide secure channels that resist interception and unauthorized access, which is essential in mitigating MITM attacks.”

Passwords and Wi-Fi controls support security, but encryption is thecoredefense against data leakage during interception.

????WGU Course Alignment:

Domain:Cryptography

Topic:Apply encryption to secure data in transit and at rest

The statement refers to the different types of media that can be used for data backup. Backup media encompasses various storage devices and methods used to store copies of data. Examples include:

CDs and DVDs: Optical storage media used for smaller-scale backups.

Hard drives: Mechanical or solid-state drives used for local and external backups.

Cloud storage: Online services providing remote storage and access to backups.

Choosing the appropriate backup media is crucial for ensuring data availability and recovery in case of data loss.

References

David M. Kroenke and Randall J. Boyle, "Using MIS," Pearson.

Curtis Preston, "Backup & Recovery: Inexpensive Backup Solutions for Open Systems," O'Reilly Media.

Anoperating system (OS)is a system software that manages computer hardware and software resources and provides common services for computer programs.

It serves as an intermediary between users and the computer hardware.

Key functionsof an OS include:

Managinghardware resourceslike the CPU, memory, and I/O devices.

Providing auser interface(UI) for interaction with the system.

File managementand handling file operations.

Process managementand multitasking.

Securityand access control.

Examples include Windows, Linux, and macOS.

Next-Generation Firewalls (NGFWs)offer a unified solution that includes traditional packet filtering andadvanced detection featureslike Intrusion Detection and Prevention (IDPS). This makes them the most efficient and scalable option for replacing legacy firewalls in modern environments.

NIST SP 800-94 Rev. 1 (Guide to Intrusion Detection and Prevention Systems):

“NGFWs integrate IDS/IPS features with traffic inspection, enabling detection and prevention of attacks in real time.”

????WGU Course Alignment:

Domain:Security Operations

Topic:Implement detection and prevention solutions (e.g., NGFWs, IDS/IPS)

The correct answer is C — Constantly scan for known signatures on every machine.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), scanning for known malware signatures is an essential method for detecting infections such as botnets. Signature-based detection compares files and behaviors against databases of known indicators of compromise (IOCs).

Two-factor authentication (A) protects login processes but does not detect malware. Firewall rules (B) help control access but do not detect infections. Configuration management (D) ensures system setup integrity but does not detect botnets.

Reference Extract from Study Guide:

"Signature-based scanning detects malware and botnets by comparing system files and behaviors against databases of known threats and indicators of compromise (IOCs)."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Malware Detection and Threat Response

Alpha testing is a type of system testing that involves having end users test the system with simulated data and the help of the developer. This phase is crucial because:

Early feedback: Users provide early feedback on the usability and functionality of the system.

Bug identification: Developers can identify and fix bugs before the system is released for beta testing or production.

Simulated environment: The testing is done in a controlled, simulated environment, often within the development organization.

Alpha testing is followed by beta testing, where the system is tested in a real-world environment by end users without the developers' direct involvement.

References

Ron Patton, "Software Testing," Sams Publishing.

Glenford J. Myers, "The Art of Software Testing," Wiley.

Data Loss Prevention (DLP)systems are specifically designed todetect, monitor, andpreventunauthorized attempts to access, transmit, or extract sensitive data — including email, removable media, and cloud uploads.

NIST SP 800-207A (Data Protection):

“DLP systems are used to prevent sensitive information from being transmitted outside of a trusted boundary by monitoring and enforcing content-based policies.”

IDS and IPS detect threats but do notfocus on protecting data from being exfiltrated. MFA protects user identities, not data leakage.

????WGU Course Alignment:

Domain:Security Operations and Monitoring

Topic:Implement DLP controls to protect sensitive data from unauthorized extraction

Proxy Server Functions:

Caching: Proxy servers can store copies of web pages and other web resources. This helps to improve load times for frequently accessed resources and reduce bandwidth usage.

Security: They can provide additional security by anonymizing the user’s IP address and filtering unwanted content.

Correct Function:

Acting as a cache (B) is one of the primary functions, where it stores web pages that users in the organization have recently accessed.

Incorrect Functions:

A: Describes a file server.

C: Describes a database server.

D: Describes a web server.

The correct answer is D — Measured boot.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) explains that Measured Boot, often implemented with Trusted Platform Modules (TPMs), ensures that each component of theboot process is verified for integrity. It provides cryptographic evidence that the system's startup sequence has not been tampered with.

Two-factor authentication (A) secures user logins but does not verify boot integrity. IDS (B) monitors network or host behavior but does not protect the boot process. HSM (C) secures cryptographic operations, not the system boot.

Reference Extract from Study Guide:

"Measured Boot verifies the integrity of the boot process, providing assurance that the system has not been compromised during startup."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), System Hardening and Trusted Computing

=============================================

The correct answer is C — Integration testing.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), integration testing verifies that different modules or components of an application work together as intended.This type of testing is essential after deployment to ensure the overall system functions correctly across all tiers (e.g., web, application, and database layers).

Static code analysis (A) examines source code without execution. Dynamic code analysis (B) tests running code for vulnerabilities but not necessarily component interaction. Package scanning (D) reviews third-party libraries for vulnerabilities but does not test integration.

Reference Extract from Study Guide:

"Integration testing verifies that multiple components of an application function correctly when combined, ensuring end-to-end system reliability post-deployment."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Secure Software Development and Testing

The correct answer is B — Wireless intrusion prevention system (WIPS).

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), a WIPS actively monitors wireless networks for unauthorized access points and malicious activity, such as man-in-the-middle (MITM) attacks. It can automatically detect, alert, and prevent wireless threats in real time, which is exactly what the organization requires to counteract MITM attacks on the wireless network.

A SIEM (A) collects logs and generates alerts but does not prevent wireless attacks. An inline encryptor (C) encrypts data but does not prevent wireless attacks. A Layer 3 switch (D) operates at the network layer and does not prevent wireless-specific threats.

Reference Extract from Study Guide:

"A wireless intrusion prevention system (WIPS) detects and prevents unauthorized access points and malicious wireless activity, including man-in-the-middle attacks."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Wireless Security and Threat Prevention

=============================================

Before taking disruptive actions,identification and threat classificationmust occur. Cross-referencing againstknown malicious IP lists(e.g., threat intelligence feeds) helps determine if the address is benign, malicious, or compromised.

NIST SP 800-61 Rev. 2 (Computer Security Incident Handling Guide):

“Security teams should validate the threat source by comparing it to blacklists and threat intelligence before containment steps are taken.”

Blocking or rate-limiting prematurely may disrupt legitimate activity, makingintelligence-based comparisonthe prudent first step.

????WGU Course Alignment:

Domain:Security Operations and Monitoring

Topic:Perform traffic analysis and threat intelligence correlation

The correct answer is C — Assess.

As per WGU Cybersecurity Architecture and Engineering (KFO1 / D488) materials, after risks have been identified, the next step in the risk management life cycle is to assess them. Assessment involves analyzing and prioritizing the risks based on their potential impact and likelihood. Only after assessment can proper strategies be formulated for controlling and mitigating the risks.

Identification (A) occurs before assessment, while reviewing (B) and controlling (D) happen later in the process.

Reference Extract from Study Guide:

"Following the identification of risks, the risk management process proceeds to risk assessment, where risks are analyzed and prioritized based on likelihood and impact to guide mitigation efforts."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Management Process

=============================================

The correct answer is A — Implementing two-factor authentication.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488) content, two-factor authentication (2FA) strengthens authentication processes by requiring users to providetwo forms of evidence (e.g., password + SMS code or authentication app) before accessing systems. Even if credentials are stolen, without the second factor, attackers would be unable to log in.

Background checks (B) are important for insider threats but not stolen external credentials. Security awareness training (C) is good practice but does not technically prevent the misuse of stolen credentials. SIEM systems (D) help detect breaches but do not stop unauthorized access at the authentication layer.

Reference Extract from Study Guide:

"Two-factor authentication mitigates the risks associated with credential theft by requiring an additional factor, significantly improving the security posture."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Authentication and Identity Management

=============================================

The correct answer is D — Likelihood.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) emphasizes that when evaluating the chance of future incidents, the focus should be on likelihood — the probability that a threat will exploit a vulnerability again. Given that a breach has already occurred, it is important to assess how likely another breach could happen without additional security measures.

Impact (A) measures consequences, not probability. Risk (B) is a combination of impact and likelihood, but to specifically focus on future potential, likelihood (D) is primary. Threat actors (C) describe adversaries, not probabilities.

Reference Extract from Study Guide:

"Likelihood refers to the probability that a specific threat will successfully exploit a vulnerability, and is a key consideration in predicting future incidents."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Assessment Concepts

=============================================

The correct answer is C — Control.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), the control phase of the risk management life cycle involves implementing appropriate security measures or countermeasures to mitigate or eliminate identified risks. After a risk is assessed, controls are applied to address it and reduce its impact or likelihood.

Assess (A) evaluates risk severity. Identify (B) discovers risks. Review (D) checks the effectiveness of applied controls.

Reference Extract from Study Guide:

"The control phase of risk management focuses on applying security controls and mitigations to reduce the risk to an acceptable level."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Management Life Cycle

=============================================

Federated authenticationallows two or more organizations to share access credentials based ontrusted identity providers. This enables users from one domain to access systems in another without creating separate accounts.

NIST SP 800-63C (Digital Identity Guidelines – Federation):

“Federated identity allows users to access multiple services across security domains using a single identity, reducing the administrative burden of account duplication.”

This is essential in B2B or inter-organizational environments likehealthcare information exchange.

????WGU Course Alignment:

Domain:Access Control and Identity Management

Topic:Implement federated identity systems for cross-organizational access

Scripting languages are designed for integrating and communicating with other programming languages.

Python: A high-level scripting language known for its readability and extensive library support.

PHP: A server-side scripting language used primarily for web development.

References

"Python Crash Course" by Eric Matthes

"PHP and MySQL Web Development" by Luke Welling and Laura Thomson

The Domain Name System (DNS) has several key roles, including:

Storing the IP addresses associated with domain names.

Translating human-readable domain names (aliases) into IP addresses that computers use to identify each other on the network.

The other options:

Creating IP addresses if it cannot find an alias is incorrect; DNS does not create IP addresses.

Sending packets along a pathway that connects it to the Internet is the role of routers and not DNS.

Therefore, storing the IP address and translating an IP alias to an actual IP address are the correct roles of DNS.

The correct answer is D — By providing over-the-air updates.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) describes that over-the-air(OTA) updates allow organizations to remotely deploy patches and updates to mobile devices without requiring users to manually visit a central location. This method is essential for maintaining security for a geographically dispersed workforce.

Remote module updates (A), tokenized container updates (B), and mobile station updates (C) are not standard or widely recognized terms for mobile device update practices in this context.

Reference Extract from Study Guide:

"Over-the-air (OTA) updates ensure that security patches and software updates can be remotely deployed to mobile devices, supporting business continuity and device security."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Mobile Device Management and Security

=============================================

The correct answer is C — Determine business processes and recovery criticality, identify resource requirements, and identify recovery priorities for system resources.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), a BIA identifies critical business functions, determines the impact of disruptions, and establishes recovery priorities, including resource needs.

A (monitoring) relates to incident response. B (developing BCP) is after BIA. D (recovery strategies) is part of disaster recovery planning after BIA findings.

Reference Extract from Study Guide:

"Business impact analysis (BIA) involves determining critical business processes, evaluating their recovery requirements, and prioritizing system recovery efforts."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Business Impact Analysis Procedures

=============================================

Electronic Codebook (ECB)is thesimplest modeof block cipher operation, but it encrypts each blockindependently, which results inidentical ciphertext for identical plaintext blocks— making itunsafe for use with structured or repetitive data.

NIST SP 800-38A (Recommendation for Block Cipher Modes of Operation):

“ECB reveals patterns in plaintext and should not be used when such patterns are meaningful and predictable.”

Though efficient, ECB lackssemantic securityand is rarely recommended in practice.

????WGU Course Alignment:

Domain:Cryptography

Topic:Evaluate block cipher modes for appropriate use cases

AData Protection Impact Assessment (DPIA)is a formal process toassess the risks to personal data privacybefore implementing systems or technologies that handle personal data, especially under regulations likeGDPRor HIPAA.

NIST Privacy Framework v1.0 (Appendix D):

“A DPIA helps organizations systematically analyze, identify, and minimize the data protection risks of a project or plan involving personal information.”

While BCP and DR focus on operational resilience, DPIA isprivacy-focusedand risk-driven.

????WGU Course Alignment:

Domain:Risk Management and Privacy Engineering

Topic:Conduct privacy impact assessments for systems processing personal data

The correct answer is D — Implementation of licensing technologies in order to restrict unauthorized access to the system.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), using licensing technologies helps prevent software piracy by ensuring that only authorized users with valid licenses can access and operate the system. License management solutions validate user access and reduce unauthorized duplication or usage of proprietary software.

Disabling external devices (A) protects against physical data theft but not piracy. Encrypting patient data (B) protects confidentiality but not against software piracy. Virus scanning (C) detects malware, not unauthorized software copying.

Reference Extract from Study Guide:

"Licensing technologies enforce legal software use and prevent unauthorized access, helping organizations protect intellectual property and defeat piracy efforts."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Software and Intellectual Property Protection

=============================================

A programming language is a formal language comprising a set of instructions that produce various kinds of output. Programming languages are used in computer programming to implement algorithms and manipulate data. They provide the vocabulary and grammatical rules for instructing a computer to perform specific tasks, allowing developers to write software programs that can be executed by a computer.

AES (Advanced Encryption Standard)is a symmetric block cipher approved by NIST for protecting sensitive data, includingelectronic protected health information (ePHI). It is the recommended encryption method underHIPAA compliance guidelines.

NIST FIPS 197 (Advanced Encryption Standard - AES):

“AES is a symmetric cipher used to protect sensitive electronic data and is approved for use in securing government and healthcare systems.”

WEP is outdated, SMTP is a protocol for email, and RSA is better suited for key exchange, not bulk data encryption.

????WGU Course Alignment:

Domain:Cryptography and Compliance

Topic:Use NIST-approved encryption (AES) for healthcare data under HIPAA