Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
A cybersecurity analyst at a manufacturing company is tasked with analyzing the indicators of compromise (IOCs) to identify potential threats and vulnerabilities within the organization. While viewing the security information and event management (SIEM), the analyst notices an unknown IP address logging on to the company's Secure Shell (SSH) server.
Which potential vulnerability is the manufacturing company facing?
The correct answer is D --- Weak passwords.
According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), unauthorized SSH access from an unknown IP address often suggests that the attacker exploited weak or compromised passwords to gain access. Weak passwords are a common vulnerability for services exposed to the internet, especially SSH servers.
Exfiltration (A) refers to data theft after access, not initial unauthorized access. Unpatched software (B) might lead to other vulnerabilities but is not indicated here. Enumeration (C) is gathering information but not gaining login access directly.
Reference Extract from Study Guide:
'Weak or compromised passwords are a primary cause of unauthorized access, particularly for remote management interfaces such as SSH.'
--- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Authentication Security BestPractices
A security analyst for a financial institution is in the process of planning to upgrade the institution's IT infrastructure to meet current industry standards. There are various potential risks associated with the upgrade, including data breaches, system outages, and cost overruns. The analyst is tasked with managing these risks to ensure a successful upgrade.
What is the first step in the risk management life cycle in this scenario?
The correct answer is D --- Identify.
According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), the first step in risk management is identifying potential risks. Only once risks are identified can they be assessed, controlled, and reviewed. In this case, identifying potential data breaches, outages, and cost issues is the starting point.
Assess (A) happens after identification. Control (B) involves implementing responses. Review (C) happens later to check effectiveness.
Reference Extract from Study Guide:
'The first phase of risk management is risk identification, where potential threats and vulnerabilities are recognized and documented.'
--- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Management Life Cycle
A large technology company has discovered a known vulnerability in its network infrastructure.The infrastructure contains a number of retired assets that are no longer receiving security updates, which could potentially be exploited by attackers to compromise the network. The company has decided to implement hardening techniques and endpoint security controls to mitigate the risk.
Which hardening technique will meet the needs of this company?
End-of-life (EOL) systemspose a significant security risk because they no longer receive patches or security updates. Themost effective and proactive hardening techniquein this case is tocompletely remove those systems from the network.
NIST SP 800-128 (Guide for Security-Focused Configuration Management):
''Systems no longer supported by vendors must be removed, replaced, or isolated as they pose unacceptable risks.''
Other controls are useful for broader protection, but if a system is inherently vulnerable and cannot be patched,removal is the only surefire solution.
WGU Course Alignment:
Domain:System Security Engineering
Topic:Implement system hardening strategies and manage legacy systems
An IT team has been tasked with improving the security of a company's web applications.
Which threats should the IT team consider detecting when defending the network with a web application firewall (WAF)?
The correct answer is C --- Structured Query Language (SQL) injection attacks.
As per WGU Cybersecurity Architecture and Engineering (KFO1 / D488), a Web Application Firewall (WAF) protects web applications by filtering and monitoring HTTP traffic. It isspecifically effective against attacks such as SQL injection, cross-site scripting (XSS), and other application-layer vulnerabilities.
Phishing (A) and social engineering (D) involve human deception, not web application vulnerabilities. Brute force attacks (B) typically target authentication but are not the primary focus of a WAF.
Reference Extract from Study Guide:
'A web application firewall (WAF) detects and prevents attacks against web applications, including SQL injection and cross-site scripting (XSS).'
--- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Web Application Firewall and Threat Protection
A professional services organization deployed security edge devices in key locations on its corporate network.
How will these devices improve the organization's security posture?
Security edge devices(such as NGFWs, IDS/IPS, and secure gateways) are deployed at thenetwork perimeterto inspect and filter traffic, providing aninitial layer of defenseagainst external threats before they reach internal systems.
NIST SP 800-41 Rev. 1:
''Edge security devices enforce security policy at network boundaries and act as a first line of defense by preventing unauthorized or malicious traffic from entering the internal network.''
They are not TPMs or SIEMs, though they maygenerate dataconsumed by SIEMs.
WGU Course Alignment:
Domain:Network Security
Topic:Deploy perimeter defense technologies at network entry points
Which database has multiple tables with interrelated fields?
Arelational databaseis structured to recognize relations among stored items of information.
Multiple tablesin a relational database can have interrelated fields.
These relationships are often managed throughforeign keys, which reference the primary keys of other tables.
This relational model allows for complex queries and data integrity across the database.
Example:Tables such asCustomers,Orders, andProductsin a sales database, whereOrderstable may reference bothCustomersandProductstables to establish relationships.
'Database System Concepts' by Silberschatz, Korth, and Sudarshan.
'SQL and Relational Theory' by C.J. Date.
A government agency is evaluating its business continuity plan to ensure that its operations can continue during a crisis.
What is the term used to describe the critical services that must be maintained during a disruption?
The correct answer is D --- Mission essential functions (MEFs).
WGU Cybersecurity Architecture and Engineering (KFO1 / D488) specifies that mission essential functions (MEFs) are those activities that must be maintained or resumed quickly during or after a disruption to ensure continuity of critical operations, particularly for government agencies.
BCP (A) is the plan itself. DR (B) focuses on IT and system recovery. RPO (C) measures acceptable data loss but does not define critical services.
Reference Extract from Study Guide:
'Mission essential functions (MEFs) are critical activities that must be performed continuously or resumed quickly after disruption to support business or agency operations.'
--- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Continuity of Operations Planning
6 domains from the WGU Cybersecurity-Architecture-and-Engineering exam outline, with approximate weightings. Every sample question above is tagged with the domain it comes from
This exam section evaluates the capabilities of Cybersecurity Architects to connect and integrate enterprise software systems securely. It emphasizes secure design patterns, approaches for exchanging data, and maintaining seamless functionality among applications, all while upholding the core principles of security throughout the development and rollout phases.
This part assesses Security Engineers, requiring candidates to implement robust protection measures for organizational data. The focus is on utilizing encryption, structured access controls, and systematic data classification to protect sensitive information, ensuring these practices comply with both internal guidelines and broader regulatory expectations.
This section tasks Cloud Security Architects with reviewing various cloud infrastructure models and virtualization technologies, examining their security, compliance, and operational efficiency. Participants analyze cloud deployment choices like IaaS, PaaS, and SaaS, understanding the respective responsibility models to securely incorporate these technologies into organizational architecture.
This domain centers on the responsibilities of Security Analysts in recognizing and analyzing threats and weaknesses within enterprise environments. It covers the interpretation of vulnerability scans and threat intelligence, and encourages recommending solutions to minimize potential risks as identified throughout organizational systems.
Incident Response Specialists are measured in this section, as the exam focuses on the coordinated procedures involved in incident management. Topics include planning, identifying, analyzing, containing, eliminating, and recovering from security incidents, along with the structured application of response frameworks and effective communication during critical events.
Cloud Security Engineers are assessed here for their ability to securely deploy and administer cloud solutions. This segment emphasizes activities such as oversight of cloud resources, configuration management, applying security standards, and maintaining compliance with policies governing cloud operations across the enterprise.
Common questions about the exam itself
