Check the Available Cybersecurity-Architecture-and-Engineering Exam Dumps with 215 QA's UPDATED 2026
Download Cybersecurity-Architecture-and-Engineering Exam Dumps Questions to get 100% Success in WGU
NEW QUESTION # 122
An IT organization recently implemented a hybrid cloud deployment. The security team must be able to correlate event data combined from different sources in a central location.
- A. Security Information and Event Management (SIEM)
- B. Intrusion Detection System (IDS)
- C. Data Loss Prevention (DLP)
- D. File Integrity Monitoring (FIM)
Answer: A
Explanation:
ASecurity Information and Event Management (SIEM)system collects, normalizes, and correlates logs and security events from various devices across both on-premises and cloud environments. It enables centralizedthreat detection,incident response, andcompliance monitoring.
NIST SP 800-137 (Information Security Continuous Monitoring):
"SIEMs are essential for real-time incident detection and response by aggregating and analyzing logs from disparate systems." Hybrid cloud environmentsmake log correlation complex, and SIEMs are uniquely suited to bridge cloud and on-prem infrastructure.
#WGU Course Alignment:
Domain:Security Operations and Monitoring
Topic:Use SIEM for centralized monitoring and event correlation in hybrid architectures
NEW QUESTION # 123
Which IT role is responsible for installing new hardware and troubleshooting existing hardware?
- A. Network administrator
- B. System administrator
- C. Security administrator
- D. Web administrator
Answer: B
Explanation:
A system administrator is responsible for managing, installing, and maintaining an organization's computer systems and networks. This role involves configuring new hardware, setting up user accounts, troubleshooting system and network issues, and ensuring the systems run efficiently.
NEW QUESTION # 124
A software development company is concerned about the potential risks associated with exploits that target vulnerabilities in the Linux operating system used by the company's servers. The company has decided to implement hardening techniques and endpoint security controls to mitigate the risk.
Which hardening technique will meet the needs of this company?
- A. Implementing a host-based intrusion detection and prevention system
- B. Enforcing strict access control policies for all users
- C. Implementing shell restrictions
- D. Conducting regular security assessments and penetration testing
Answer: C
Explanation:
The correct answer is C - Implementing shell restrictions.
According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), shell restrictions on Linux systems can prevent users (or attackers) from executing unauthorized commands, significantly reducing the exploitation risk on Linux servers.
Host-based IDPS (A) detects attacks but does not directly harden the OS. Access control (B) andassessments
/penetration testing (D) are important but do not focus specifically on securing the Linux shell environment.
Reference Extract from Study Guide:
"Implementing shell restrictions on Linux systems minimizes the attack surface by limiting the ability of users and processes to execute unauthorized commands."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Linux System Hardening Techniques
NEW QUESTION # 125
A financial institution is concerned about a potential data breach due to employees accessing the company network using personal devices. They have decided to implement a bring your own device (BYOD) policy to mitigate the risk.
Which risk mitigation strategy will reduce the risk of a data breach in this scenario?
- A. Implementing a mobile device management (MDM) solution
- B. Providing security awareness training for employees
- C. Conducting regular security audits of the company network
- D. Blocking access to the company network from personal devices
Answer: A
Explanation:
The correct answer is C - Implementing a mobile device management (MDM) solution.
WGU Cybersecurity Architecture and Engineering (KFO1 / D488) describes that an MDM solution enables organizations to enforce security policies on personal devices, such as encryption, remote wipe capabilities, and application controls. MDM allows safe access to corporate resources while managing the inherent risks of BYOD environments.
Blocking access (A) contradicts the BYOD policy goal. Security audits (B) monitor but do not control personal devices. Awareness training (D) is important but does not enforce technical protections on devices.
Reference Extract from Study Guide:
"Mobile device management (MDM) solutions enforce security policies on employee-owned devices, ensuring compliance and reducing the risks associated with BYOD implementations."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Mobile Device Security
NEW QUESTION # 126
A security team is investigating multiple man-in-the-middle (MITM) attacks that have taken place on the corporate network over the past few months. The team needs a solution that will ensure that data is not exposed if a man-in-the-middle attack occurs in the future.
- A. Ensuring all users have complex passwords
- B. Encrypting data
- C. Disabling Wi-Fi connections
- D. Enforcing password history
Answer: B
Explanation:
Data encryptionensures confidentiality and integrity even if communications are intercepted. If properly implemented (e.g., using TLS), encryption makes the payload unreadable to the attacker.
NIST SP 800-52 Rev. 2 (Guidelines for the Selection and Use of Transport Layer Security):
"Encryption technologies provide secure channels that resist interception and unauthorized access, which is essential in mitigating MITM attacks." Passwords and Wi-Fi controls support security, but encryption is thecoredefense against data leakage during interception.
#WGU Course Alignment:
Domain:Cryptography
Topic:Apply encryption to secure data in transit and at rest
NEW QUESTION # 127
Which characteristic applies to machine-level languages?
- A. They use collection of short scripts
- B. They use language translators known as assemblers
- C. They use language translators known as compilers
- D. They use cables to connect circuits
Answer: B
Explanation:
Machine-level languages, also known as assembly languages, are low-level programming languages that are closely related to machine code.
* Definition: Machine-level languages consist of instructions that are directly executed by a computer's CPU.
* Assemblers: An assembler is a tool that translates assembly language code into machine code.
* Characteristics: Assembly languages are specific to a computer architecture and provide a way to write programs that can be executed by the hardware directly.
References
* "Structured Computer Organization" by Andrew S. Tanenbaum
* "Computer Systems: A Programmer's Perspective" by Randal E. Bryant and David R. O'Hallaron
NEW QUESTION # 128
Which is true about access rights?
- A. They limit users to permitted items.
- B. They are part of the System Development Life Cycle.
- C. They are defined by the machine language.
- D. They require the use of a compiler.
Answer: A
Explanation:
Access rights are critical components of access control mechanisms in information security. They specify what actions users or systems can perform on specific resources, limiting them to only permitted items.
* Definition: Access rights, also known as permissions, are rules that define the allowed actions on a resource (e.g., read, write, execute).
* Implementation: Access rights are typically implemented using Access Control Lists (ACLs), Role-Based Access Control (RBAC), or other access control models.
* Purpose: The main goal is to enforce the principle of least privilege, ensuring that users can only access the resources necessary for their role.
References
* NIST Special Publication 800-53
* ISO/IEC 27001:2013
* "Computer Security: Principles and Practice" by William Stallings
NEW QUESTION # 129
A company has recently completed its disaster recovery plan and is preparing to test it. Thecompany's IT team has identified the need to simulate a disaster scenario to evaluate the effectiveness of the plan. The team has considered options including full interruption tests, walkthroughs, tabletop exercises, and checklists. They want to choose a testing method that will allow them to evaluate the plan in a controlled environment while minimizing the impact on the company's operations.
Which testing method will meet the needs of the company?
- A. Walk-through
- B. Tabletop exercises
- C. Full interruption test
- D. Checklists
Answer: B
Explanation:
Tabletop exercisessimulate emergency scenarios in alow-risk, discussion-based format, allowing teams to walk through recovery procedures and decision-making without disrupting actual business operations.
NIST SP 800-84 (Guide to Test, Training, and Exercise Programs):
"Tabletop exercises are effective tools for validating plans and procedures in a discussion format without impacting normal operations." Full interruption tests are disruptive; checklists and walkthroughs offer lower fidelity evaluations.
#WGU Course Alignment:
Domain:Business Continuity and Disaster Recovery
Topic:Test disaster plans using low-impact simulation techniques
NEW QUESTION # 130
A retail company wants to establish the frequency at which it needs to back up its critical data to ensure it can be restored in case of a disruption with the least amount of acceptable data loss.
What is the term used to describe this metric?
- A. Continuous Data Protection (CDP)
- B. Recovery Point Objective (RPO)
- C. Disaster Recovery (DR)
- D. Business Impact Analysis (BIA)
Answer: B
Explanation:
Recovery Point Objective (RPO)defines themaximum acceptable amount of data lossmeasured in time. It determines how often backups should occur to avoid losing critical business data.
NIST SP 800-34 Rev. 1:
"RPO represents the point in time prior to an outage to which systems and data must be restored to resume business operations." CDP is a method; RPO is thestrategic planning metric.
#WGU Course Alignment:
Domain:Business Continuity and Disaster Recovery
Topic:Define RPO to support data resilience and backup planning
NEW QUESTION # 131
Which type of services are Google Apps, Dropbox. and GoToMeeling?
- A. Software-as-a-Service (SaaS)
- B. Infrastructure-as-a-Service (laaS)
- C. Platform-as-a-Service (PaaS)
- D. Security-as-a-Service (SECaaS)
Answer: A
Explanation:
Google Apps, Dropbox, and GoToMeeting are examples of Software-as-a-Service (SaaS). SaaS provides software applications over the internet as a service. Users can access the software through a web browser without needing to install and maintain the software on their local devices, making it convenient and cost-effective for both individuals and businesses.
NEW QUESTION # 132
How should a security analyst detect a potential structured query language (SQL) injection attack?
- A. By looking for repeated failed login attempts to the database server
- B. By looking for database primary key changes on the production environment
- C. By looking for administrative command attempts within database log files
- D. By looking for extra and unexpected symbols and characters in certain queries
Answer: D
Explanation:
The correct answer is A - By looking for extra and unexpected symbols and characters in certain queries.
According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), SQL injection attacks often include malicious SQL code in input fields, with unusual symbols such as semicolons, apostrophes, or comments (', --, ;). Analysts detect these attacks by monitoring for unexpected or abnormal input patterns in database queries.
Changes to primary keys (B) and repeated login failures (C) are unrelated to SQLi detection. Administrative commands (D) relate more to privilege escalation.
Reference Extract from Study Guide:
"SQL injection attacks typically involve abnormal input that includes special SQL characters or commands; monitoring for such anomalies can reveal attempted injections."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Application and Database Security Threats
NEW QUESTION # 133
Which task is the responsibility of a database administrator?
- A. Deciding on database applications for the company
- B. Installing and configuring databases
- C. Troubleshooting network security issues
- D. Compiling code into an executable file
Answer: B
Explanation:
* ADatabase Administrator (DBA)is responsible for managing the database infrastructure.
* Primary responsibilitiesinclude:
* Installing and configuringnew databases and database servers.
* Ensuring databases run efficiently and are properly maintained.
* Performingbackup and recoveryoperations to prevent data loss.
* Monitoring performanceand tuning databases for optimal performance.
* Implementingsecurity measuresto protect the database against unauthorized access.
References:
* "Database Administration: The Complete Guide to DBA Practices and Procedures" by Craig S. Mullins.
* Oracle and Microsoft SQL Server official documentation.
NEW QUESTION # 134
A healthcare provider is developing a disaster recovery plan and wants to determine the longest duration that its systems or applications can be down before causing significant damage to the business.
What is the term used to describe this metric?
- A. Business Continuity Planning (BCP)
- B. Disaster Recovery (DR)
- C. Business Impact Analysis (BIA)
- D. Recovery Time Objective (RTO)
Answer: D
Explanation:
Recovery Time Objective (RTO)refers to themaximum acceptable amount of timea system or service can be offline after a disasterbefore significant impact occurs.
NIST SP 800-34 Rev. 1:
"RTO is the maximum tolerable length of time that a system or application can be unavailable after an incident before significantly impacting business operations." BIA identifies impacts, while RTO quantifiestime-to-recovery tolerance.
#WGU Course Alignment:
Domain:Business Continuity and Disaster Recovery
Topic:Define and use RTO metrics in disaster planning
NEW QUESTION # 135
A company is developing a new mobile application to support external customers and contractors. The application needs to allow users to sign in using third-party social identities.
What is the best protocol?
- A. Open Authorization (OAuth)
- B. Lightweight Directory Access Protocol (LDAP)
- C. Security Assertion Markup Language (SAML)
- D. Kerberos
Answer: A
Explanation:
The correct answer is D - Open Authorization (OAuth).
According to the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) Study Guide, OAuth is the standard protocol used for authorizing access to third-party applications without revealing user credentials.
It allows users to log in using social identity providers like Google, Facebook, or LinkedIn, which is perfect for external customers and contractors accessing a mobile application. OAuth is designed for modern applications requiring delegated access.
SAML (A) is generally used for enterprise single sign-on (SSO) solutions, primarily for internal enterprise authentication, not social login. Kerberos (B) is used within controlled internal network environments for authentication. LDAP (C) is a directory access protocol, not an authorization protocol for third-party sign-in.
Reference Extract from Study Guide:
"OAuth enables users to grant a third-party application limited access to their resources withoutexposing their credentials, making it ideal for mobile and web applications involving external users."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Authentication and Authorization Concepts
NEW QUESTION # 136
A retail company has recently implemented a new point of sale (POS) system that is critical to its business.
Which security control is essential for protecting the availability of the POS system?
- A. Enforcing strict access controls on the POS system
- B. Regularly updating the POS system with the latest security patches
- C. Backing up the data stored in the POS system and having a disaster recovery plan
- D. Implementing intrusion detection and prevention systems
Answer: B
Explanation:
Theavailabilityof the POS system depends on itsresilience against known vulnerabilities. Applyingregular security patchesensures that attackers cannot exploit outdated components, which could crash or disrupt the POS system.
NIST SP 800-40 Rev. 3 (Guide to Enterprise Patch Management):
"Prompt application of security patches mitigates vulnerabilities that can be exploited to disrupt system availability or compromise data." Backups protect from data loss, butpatching is proactive protectionfor uptime and availability.
#WGU Course Alignment:
Domain:Security Operations and Monitoring
Topic:Maintain system availability through proactive patch management
NEW QUESTION # 137
What is a function of a proxy server?
- A. It responds to user queries to create, manipulate, and retrieve records from a database.
- B. It stores files that any user of the network may wish to access.
- C. It acts as a giant cache of web pages that anyone in the organization has recently retrieved.
- D. It responds to HTTP requests and can execute scripts to generate dynamic pages.
Answer: C
Explanation:
* Proxy Server Functions:
* Caching: Proxy servers can store copies of web pages and other web resources. This helps to improve load times for frequently accessed resources and reduce bandwidth usage.
* Security: They can provide additional security by anonymizing the user's IP address and filtering unwanted content.
* Correct Function:
* Acting as a cache (B) is one of the primary functions, where it stores web pages that users in the organization have recently accessed.
* Incorrect Functions:
* A: Describes a file server.
* C: Describes a database server.
* D: Describes a web server.
References:
* Proxy servers: Proxy Server
* Caching in proxy servers:Caching Proxy
NEW QUESTION # 138
A system analyst is reviewing risk documents and noticed that the date of many risks are more than three years old.
What should be proposed to leadership regarding these risks?
- A. A process to reassess risks on a defined schedule
- B. A process to evaluate how risks are captured on risk documents
- C. A process to confirm that risk documents are readily available to all individuals
- D. A process to determine how involved leadership is in assignment risk scores
Answer: A
Explanation:
The correct answer is A - A process to reassess risks on a defined schedule.
Based on the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) Study Guide, risks must be reassessed periodically because the threat landscape, organizational assets, and business processes evolve over time. Risks identified years ago might have changed in likelihood, impact, or may have been mitigated already. Therefore, it is essential to establish a formal process for periodic risk review and reassessment to maintain accurate and actionable risk profiles.
Availability of risk documents (B), methods of capture (C), and leadership involvement in scoring (D) are important, but they do not directly address the primary issue of outdated risk assessments.
Reference Extract from Study Guide:
"Organizations must implement a periodic review and reassessment process for risks to ensure that risk profiles reflect the current threat environment, organizational changes, and mitigation efforts."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Management Framework
NEW QUESTION # 139
What is a characteristic of algorithms?
- A. Random instructions
- B. No starting or stopping point
- C. Unambiguous rules
- D. Constantly changing
Answer: C
Explanation:
An algorithm is a defined set of step-by-step procedures or a set of rules to be followed to perform a specific task or solve a problem. Here are the characteristics that describe an algorithm:
* Unambiguous rules: Each step of an algorithm must be clearly defined and unambiguous. There should be no confusion in interpreting the instructions.
* Definiteness: The algorithm should have a clear starting and stopping point, leading to a precise output after a finite number of steps.
* Finiteness: Algorithms must terminate after a finite number of steps. They cannot run indefinitely.
* Input and Output: An algorithm should take zero or more inputs and produce at least one output.
Therefore, the correct answer is "Unambiguous rules," as it directly reflects the essential characteristic of an algorithm being precise and clear in its steps.
References
* Thomas H. Cormen, Charles E. Leiserson, Ronald L. Rivest, and Clifford Stein, "Introduction to Algorithms," MIT Press.
* Donald E. Knuth, "The Art of Computer Programming," Addison-Wesley.
NEW QUESTION # 140
How are IT and globalization related?
- A. IT allows businesses to have a global reach.
- B. IT allows businesses to create a global common gateway interface (CGI).
- C. IT allows businesses to create tax havens for global companies.
- D. IT allows businesses to reach global HIPAA compliance.
Answer: A
Explanation:
Information Technology (IT) has revolutionized the way businesses operate, enabling them to reach global markets and audiences. IT facilitates communication, data exchange, and operational efficiency across borders, allowing companies to manage global operations and engage with international customers seamlessly. This global reach is a critical aspect of modern business strategies, driven by advancements in IT infrastructure and services.
NEW QUESTION # 141
A retail company wants to establish the frequency at which it needs to backup its critical data to ensure it can be restored in case of a disruption with the least amount of acceptable loss in recovery.
What is the term used to describe this metric?
- A. Business impact analysis (BIA)
- B. Disaster recovery (DR)
- C. Continuous data protection (CDP)
- D. Recovery point objective (RPO)
Answer: D
Explanation:
The correct answer is D - Recovery point objective (RPO).
According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), the RPO defines the maximum amount of data loss that is tolerable in terms of time. It sets the backup frequency to ensure that in the event of a disruption, no more than the specified amount of data is lost.
Continuous data protection (A) is a method but not the term for the metric. BIA (B) identifies impacts but does not define backup timing. DR (C) refers to the overall recovery process, not backup frequency.
Reference Extract from Study Guide:
"Recovery point objective (RPO) defines the maximum age of files that must be recovered from backup storage for normal operations to resume after a failure."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Disaster Recovery and Recovery Objectives
NEW QUESTION # 142
Which two options allow an application to access a database?
Choose 2 answers
- A. Java Database Connectivity (JDBC)
- B. Graphical user interface (GUI)
- C. Open Database Connectivity (ODBC) application
- D. Structured Query Language (SQL)
- E. Database management system (DBMS)
Answer: A,D
Explanation:
* SQLis a standard language used to communicate with and manage databases. It allows applications to perform operations such as querying, updating, and managing data.
* JDBCis an API in Java that enables Java applications to interact with databases. It provides methods for querying and updating data in a database using SQL.
* DBMS (Database Management System)is the system software for creating and managing databases but not directly used by applications for database access.
* ODBC (Open Database Connectivity)is another standard API but specific to applications in a broader range of languages and platforms.
* GUI (Graphical User Interface)is a user interface and not a method for applications to access databases.
References:
* "SQL: The Complete Reference" by James R. Groff and Paul N. Weinberg.
* "Java Database Connectivity: JDBC and Java" by Daniel K. Akers.
NEW QUESTION # 143
Which device does a Local Area Network (LAN) need to communicate over the Internet?
- A. Repeater
- B. Switch
- C. Router
- D. Multiplexer
Answer: C
Explanation:
* A Local Area Network (LAN) requires a router to communicate over the Internet.
* The router serves as a gateway that connects the LAN to the external network (Internet) and directs data traffic between the LAN and the Internet.
* The other options:
* Multiplexer combines multiple signals into one.
* Repeater amplifies signals to extend the range.
* Switch connects devices within the LAN but does not facilitate Internet communication.
* Therefore, a router is the necessary device for a LAN to communicate over the Internet.
References:
* "Computer Networking: A Top-Down Approach" by James Kurose and Keith Ross, which explains network devices and their functions.
* "CCNA Routing and Switching Study Guide" by Todd Lammle, which covers routers and their roles in networks.
NEW QUESTION # 144
A company recently updated its disaster recovery plan (DRP) to ensure business continuity in the event of a disruptive incident.
Which step will ensure the effectiveness of the DRP?
- A. Reviewing and updating the DRP regularly to ensure it remains relevant
- B. Performing a risk assessment of the company's information assets
- C. Developing and implementing a testing plan for the DRP
- D. Training employees on their roles and responsibilities during a disaster
Answer: C
Explanation:
The correct answer is A - Developing and implementing a testing plan for the DRP.
According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), testing the disaster recovery plan is critical to ensuring that it is functional and effective when an actual disruptive event occurs. Regularly scheduled DRP testing validates that recovery processes work as intended and that personnel are familiar with their responsibilities.
Reviewing (B) and training (D) are important but are supplementary activities. Risk assessment (C) is important for planning but does not test the DRP.
Reference Extract from Study Guide:
"Testing and exercising disaster recovery plans ensure operational readiness and reveal gaps or weaknesses that can be corrected before an actual event occurs."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Disaster Recovery Testing and Validation
NEW QUESTION # 145
A professional services organization deployed security edge devices in key locations on its corporate network.
How will these devices improve the organization's security posture?
- A. They act as an initial defense layer for potential threats
- B. They act as a security information and event management (SIEM) module for a security operations center (SOC) analyst
- C. They protect from severe distributed denial-of-service (DDoS) attacks
- D. They are a set of trusted platform module (TPM) devices
Answer: A
Explanation:
The correct answer is A - They act as an initial defense layer for potential threats.
According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), security edge devices such as firewalls, secure web gateways, and intrusion prevention systems (IPS) are placed at the network perimeter to serve as the first layer of defense against external threats.
DDoS protection (B) may be part of a broader security solution but is not the main role of general edge devices. SIEM modules (C) collect and correlate logs, not defend at the perimeter. TPM devices (D) are hardware-based cryptographic modules, not network edge defenses.
Reference Extract from Study Guide:
"Security edge devices provide the first line of defense against external threats by monitoring, filtering, and blocking malicious traffic entering the corporate network."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Network Security and Perimeter Defense
NEW QUESTION # 146
......
Best Value Available! 2026 Realistic Verified Free Cybersecurity-Architecture-and-Engineering Exam Questions: https://www.actualtestsquiz.com/Cybersecurity-Architecture-and-Engineering-test-torrent.html
100% Accurate Answers! Cybersecurity-Architecture-and-Engineering Actual Real Exam Questions: https://drive.google.com/open?id=1kULrcjDdAwmjWC56cxmp8GwQFq9u9u8A
