Cybersecurity-Architecture-and-Engineering Exam Info and Free Practice Test All-in-One Exam Guide May-2026 [Q66-Q88]

May 16, 2026 latestexam 0 Comments

Rate this post

Cybersecurity-Architecture-and-Engineering Exam Info and Free Practice Test All-in-One Exam Guide May-2026

Pass WGU Cybersecurity-Architecture-and-Engineering Actual Free Exam Q&As Updated Dump May 16, 2026

QUESTION 66
What type of software utilizes a commercial software license?

Public Domain

Proprietary

Open Source

Shareware

* Proprietary softwareis a type of software that is owned by an individual or a company.
* It is usually sold commercially and comes with acommercial software license.
* This type of license typically restricts the ways in which the software can be used, modified, and distributed.
* Users must agree to the terms of the license, which often include restrictions on copying, sharing, and modifying the software.
* Example:Microsoft Windows and Adobe Photoshop are proprietary software products.
References:
* “The Cathedral and the Bazaar” by Eric S. Raymond.
* “Understanding Open Source and Free Software Licensing” by Andrew M. St. Laurent.

QUESTION 67
While undergoing a security audit, it is determined that an organization has several backup repositories hosted in the cloud without any level of protection.
Which action should be taken to protect the backup repositories first?

Audit access logs

Run a vulnerability scan

Restrict access to the backups

Disable the backup repositories

The correct answer is C – Restrict access to the backups.
According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), the first step in protecting sensitive data such as cloud backups is enforcing access controls to limit who can access the data. Restricting access immediately mitigates the risk of unauthorized exposure or tampering.
Auditing access logs (A) provides insight but does not actively protect. Running vulnerability scans (B) identifies issues but does not protect immediately. Disabling repositories (D) is not practical for maintaining backup availability.
Reference Extract from Study Guide:
“Access control is the first line of defense for sensitive data repositories, ensuring that only authorized users can access backup data.”
– WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Data Security and Access Control

QUESTION 68
An IT team has been tasked with improving an organization’s security posture to defend against potential malicious actors.
What is the first step when hunting for potential threats?

Deploy an anti-malware solution

Implement an intrusion detection system

Form an incident response team

Establish a baseline for normal activity

The correct answer is D – Establish a baseline for normal activity.
According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488) materials, the first step in threat hunting is to understand what constitutes normal behavior within the environment. Establishing a baseline allows analysts to detect anomalies and deviations that could indicate malicious activity. Without a clear understanding of normal operations, it is extremely difficult to identify potential threats.
Deploying anti-malware solutions (A) and implementing intrusion detection systems (B) are important security measures but are not the first step in proactive threat hunting. Forming an incident response team (C) is essential for handling incidents but does not directly initiate threat hunting.
Reference Extract from Study Guide:
“Threat hunting begins with establishing a baseline of normal network, system, and user activity, enabling the detection of anomalies that may indicate potential threats.”
– WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Threat Hunting and Detection

QUESTION 69
In which state is data considered information?

Raw

Input

Unprocessed

Processed

Data is considered information when it has been processed and organized in a meaningful way. Raw data in its unprocessed state is not useful until it undergoes processing to become interpretable and actionable information. Processing can involve sorting, aggregating, and analyzing data to extract valuable insights.

QUESTION 70
An on-call security engineer has been notified after business hours that a possible threat could be impacting production applications.
Which type of threat intelligence should be used by first responders?

Tactical

Commodity malware

Operational

Strategic

The correct answer is A – Tactical.
Based on WGU Cybersecurity Architecture and Engineering (KFO1 / D488) study material, tactical threat intelligence provides technical details such as indicators of compromise (IOCs), IP addresses, file hashes, domain names, and other evidence needed to detect and respond to threats immediately. This type of intelligence is used by security teams to perform real-time monitoring and incident response.
Operational intelligence (C) addresses campaigns or actor behavior but is not immediately actionable.
Strategic intelligence (D) provides high-level, long-term threat trends. Commodity malware (B) refers to low- level malware types, not intelligence classifications.
Reference Extract from Study Guide:
“Tactical threat intelligence focuses on technical indicators of compromise (IOCs) and immediate actionable information that responders use to detect and contain active threats.”
– WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Threat Intelligence Concepts

QUESTION 71
A company is planning to implement a new cloud-based system to store sensitive customer information.
What should be identified in the first step of the risk management process for this project?

Possible threats to the new system

Potential business impacts of a security breach

Potential vulnerabilities of the new system

Business assets that will be stored in the new system

The correct answer is D – Business assets that will be stored in the new system.
As described in WGU Cybersecurity Architecture and Engineering (KFO1 / D488), the first step in risk management is identifying and classifying assets that need protection. Without understanding the business assets, you cannot properly assess threats, vulnerabilities, or impacts.
Threats (A), impacts (B), and vulnerabilities (C) are assessed after assets are identified.
Reference Extract from Study Guide:
“Identifying and classifying business assets is the first step in the risk management process, as assets drive the prioritization of threats and mitigations.”
– WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Identification and Asset Classification

QUESTION 72
Which risk management strategy will ensure the secure storage of data on a new document management system?

Configuration of the system to require frequent password changes

Incorporation of a strict firewall policy to restrict access to the system’s server

Implementation of encryption for all data stored in the system

Implementation of a secure virtual private network (VPN) connection for all remote access to the system

The correct answer is C – Implementation of encryption for all data stored in the system.
WGU Cybersecurity Architecture and Engineering (KFO1 / D488) emphasizes that encrypting data at rest ensures that even if storage systems are compromised, the data remains confidential and secure.
Password changes (A) help secure user accounts but not stored data. Firewall policies (B) and VPNs (D) protect data in transit and access control but not the storage layer itself.
Reference Extract from Study Guide:
“Encrypting data at rest ensures that stored data remains confidential and protected from unauthorized access, even if storage devices are compromised.”
– WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Data Protection Strategies

QUESTION 73
A security analyst for a financial institution is in the process of planning to upgrade the institution’s IT infrastructure to meet current industry standards. There are various potential risks associated with the upgrade, including data breaches, system outages, and cost overruns. The analyst is tasked with managing these risks to ensure a successful upgrade.
What is the first step in the risk management life cycle in this scenario?

Assess

Control

Review

Identify

The correct answer is D – Identify.
According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), the first step in risk management is identifying potential risks. Only once risks are identified can they be assessed, controlled, and reviewed. In this case, identifying potential data breaches, outages, and cost issues is the starting point.
Assess (A) happens after identification. Control (B) involves implementing responses. Review (C) happens later to check effectiveness.
Reference Extract from Study Guide:
“The first phase of risk management is risk identification, where potential threats and vulnerabilities are recognized and documented.”
– WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Management Life Cycle

QUESTION 74
A company has identified a potential risk associated with a new software implementation, which could result in a significant data breach.
Which step of the risk management life cycle involves implementing security controls to prevent the risk?

Assess

Identify

Control

Review

The correct answer is C – Control.
According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), the control phase of the risk management life cycle involves implementing appropriate security measures or countermeasures to mitigate or eliminate identified risks. After a risk is assessed, controls are applied to address it and reduce its impact or likelihood.
Assess (A) evaluates risk severity. Identify (B) discovers risks. Review (D) checks the effectiveness of applied controls.
Reference Extract from Study Guide:
“The control phase of risk management focuses on applying security controls and mitigations to reduce the risk to an acceptable level.”
– WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Management Life Cycle

QUESTION 75
Which technique allows someone to obtain a password while it is in transit?

Packet sniffing

Buffer overflow

Phishing

Black hat

* Packet sniffing is a technique used to capture and analyze network traffic, which can include intercepting passwords while they are in transit.
* When data packets are transmitted over a network, a packet sniffer can capture these packets, and if they are not encrypted, it can read sensitive information like passwords.
* The other options:
* Buffer overflow is a type of attack that exploits a program’s memory handling.
* Phishing is a social engineering attack to deceive users into providing sensitive information.
* Black hat refers to a hacker with malicious intent, not a specific technique.
* Therefore, packet sniffing is the correct technique for obtaining passwords in transit.
References:
* “Network Security Essentials: Applications and Standards” by William Stallings, which explains packet sniffing and network security threats.
* “Computer Security: Principles and Practice” by William Stallings and Lawrie Brown, which covers network attack techniques including packet sniffing.

QUESTION 76
Which item information should be stored in a database to determine an order total?

Item order line

Item unit price

Item description

Item restock levels

To determine an order total, the item unit price is essential because it represents the cost per unit of the item.
By multiplying the unit price by the quantity ordered, you can calculate the total cost for each item in the order, and then sum these totals to get the overall order total.

QUESTION 77
What is scope creep?

Realization that the organization staffing is inadequate

The extent of the project that lacks needed requirements

Small changes in a project that lead to bigger changes

When the project is completed in less than the required time

Scope creep refers to the phenomenon where the scope of a project gradually increases over time due to small, incremental changes that were not initially planned or approved. This can happen when:
* New featuresor requirements are added without proper evaluation or approval.
* Stakeholderscontinuously request small changes or additions.
* Lack of a clear scope definitionand change control process.
These small changes can accumulate, leading to significant deviations from the original project plan, affecting the project’s schedule, budget, and overall success.
References
* Project Management Institute, “A Guide to the Project Management Body of Knowledge (PMBOK Guide),” PMI.
* Kathy Schwalbe, “Information Technology Project Management,” Cengage Learning.

QUESTION 78
Management has asked its networking team to recommend a solution for direct communication between multiple virtual networks in the cloud. The solution must utilize the least amount of administrative effort.

Remote Desktop Protocol (RDP)

Virtual network peering

Domain Name System (DNS)

Virtual Local Area Network (VLAN)

Virtual Network Peeringallows two or more virtual networks to communicate through private IP addresses, enabling seamless traffic flow across resources in different networks withminimal configuration overhead.
Microsoft Azure Documentation (Network Peering):
“Virtual network peering seamlessly connects Azure virtual networks. The networks appear as one for connectivity purposes, and traffic is routed through Microsoft’s backbone infrastructure.” Unlike VPNs or complex routing configurations,peeringis simple,requires no downtime, and doesn’t need encryption if networks are internal.
#WGU Course Alignment:
Domain:Information Systems and Architecture
Topic:Cloud architecture, network segmentation, and inter-VNET connectivity

QUESTION 79
A cloud service provider is concerned about the potential risks associated with hardware-based attacks on its virtual machines. The provider has decided to implement hardening techniques and endpoint security controls to mitigate the risk.
Which hardening technique will meet the needs of this provider?

Conducting regular vulnerability assessments and penetration testing

Disabling central processing unit (CPU) virtualization support

Implementing a web application firewall to monitor incoming traffic

Enforcing strict access control policies for all users

The correct answer is A – Conducting regular vulnerability assessments and penetration testing.
According to the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) materials, performing vulnerability assessments and penetration testing helps identify weaknesses in both hardware and virtual environments. Regular testing ensures that any hardware-related vulnerabilities are discovered and addressed before they can be exploited.
Disabling CPU virtualization support (B) would prevent virtual machines from running, defeating the purpose. A web application firewall (C) monitors traffic at the application layer but does not address hardware risks. Access control policies (D) are important but not directly tied to detecting hardware vulnerabilities.
Reference Extract from Study Guide:
“Regular vulnerability assessments and penetration testing identify weaknesses in hardware and software environments, providing critical insights for maintaining a hardened and secure posture.”
– WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Security Testing and Assessment

QUESTION 80
A professional services organization deployed security edge devices in key locations on its corporate network.
How will these devices improve the organization’s security posture?

They act as an initial defense layer for potential threats

They are a set of Trusted Platform Module (TPM) devices

They protect from severe Distributed Denial-of-Service (DDoS) attacks

They act as a Security Information and Event Management (SIEM) module for a SOC analyst

Security edge devices(such as NGFWs, IDS/IPS, and secure gateways) are deployed at thenetwork perimeterto inspect and filter traffic, providing aninitial layer of defenseagainst external threats before they reach internal systems.
NIST SP 800-41 Rev. 1:
“Edge security devices enforce security policy at network boundaries and act as a first line of defense by preventing unauthorized or malicious traffic from entering the internal network.” They are not TPMs or SIEMs, though they maygenerate dataconsumed by SIEMs.
#WGU Course Alignment:
Domain:Network Security
Topic:Deploy perimeter defense technologies at network entry points

QUESTION 81
Which block cipher mode of operation for encrypting data is simple and efficient and provides no confidentiality beyond that of the underlying block cipher?

Electronic codebook (ECB)

Cipher block chaining (CBC)

Counter (CTR)

Output feedback (OFB)

The correct answer is A – Electronic codebook (ECB).
According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), ECB mode is the simplest and most basic mode of operation for block ciphers. It encrypts each block of plaintext independently with the same key, but identical plaintext blocks produce identical ciphertext blocks, providing no additional confidentiality beyond the block cipher itself and making patterns visible.
CBC (B), CTR (C), and OFB (D) are more secure and avoid patterns.
Reference Extract from Study Guide:
“Electronic Codebook (ECB) mode encrypts each block independently and is simple but reveals patterns when identical plaintext blocks occur, thus offering minimal confidentiality beyond the underlying cipher.”
– WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Block Cipher Modes of Operation

QUESTION 82
An organization wants to secure remote access to its servers and is looking for a secure protocol that can provide encryption and strong authentication. The organization wants to ensure that its servers can only be accessed by authorized users and that the data exchanged during the session is encrypted.
Which protocol meets the needs of the organization?

Hypertext Transfer Protocol (HTTP)

File Transfer Protocol (FTP)

Telnet

Secure Shell (SSH)

The correct answer is D – Secure Shell (SSH).
WGU Cybersecurity Architecture and Engineering (KFO1 / D488) materials state that SSH provides strong encryption and authentication for remote access over unsecured networks. SSH ensures that sessions are confidential and that only authorized users can access remote systems.
HTTP (A) and FTP (B) transmit data in plaintext and do not provide encryption. Telnet (C) also transmits data in plaintext and is insecure for remote access.
Reference Extract from Study Guide:
“Secure Shell (SSH) is used for secure remote management, offering encrypted communications and authentication mechanisms to protect against unauthorized access and eavesdropping.”
– WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Secure Protocols and Communications

QUESTION 83
Which risk management strategy will help prevent cheating using a learning management system as a platform?

Enforcement of a strict firewall policy to restrict access to the system’s server

Configuration of the system to disable all Bluetooth services on all workstations

Implementation of secure user authentication protocols

Implementation of regular software updates and patch management

The correct answer is C – Implementation of secure user authentication protocols.
WGU Cybersecurity Architecture and Engineering (KFO1 / D488) emphasizes that secure authentication mechanisms, like strong passwords, multifactor authentication, and session management, prevent unauthorized access and impersonation, thus helping prevent cheating inlearning platforms.
Firewall policies (A) and disabling Bluetooth (B) harden systems but do not directly address authentication.
Software updates (D) protect against system vulnerabilities but not user integrity.
Reference Extract from Study Guide:
“Secure authentication protocols ensure that users accessing learning management systems are properly verified, reducing risks of impersonation and cheating.”
– WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Secure Access Control and Identity Verification

QUESTION 84
A healthcare organization would like to interoperate with another healthcare organization without needing to maintain individual accounts for members of the other organization.
Which technology concept should the company use?

Single Sign-On (SSO)

Federated Authentication

Multi-Factor Authentication (MFA)

Cloud Identity Provider

Federated authenticationallows two or more organizations to share access credentials based ontrusted identity providers. This enables users from one domain to access systems in another without creating separate accounts.
NIST SP 800-63C (Digital Identity Guidelines – Federation):
“Federated identity allows users to access multiple services across security domains using a single identity, reducing the administrative burden of account duplication.” This is essential in B2B or inter-organizational environments likehealthcare information exchange.
#WGU Course Alignment:
Domain:Access Control and Identity Management
Topic:Implement federated identity systems for cross-organizational access

QUESTION 85
A financial institution conducted a cybersecurity assessment, which identified several vulnerabilities, including outdated software and weak password policies. The company also needs to implement a new core banking system that can handle a large number of transactions while ensuring the security of customer data.
Which risk mitigation process is the most effective approach to address these vulnerabilities, and what is the best topology for the new core banking system?

Creating strong password policies and enforcing multifactor authentication and using public cloud topology

Implementing security patches and updates on a regular basis and using hybrid cloud topology

Installing antivirus software on all endpoints and using on-premise topology

Conducting regular security audits and penetration testing and using private cloud topology

The correct answer is B – Implementing security patches and updates on a regular basis and using hybrid cloud topology.
WGU Cybersecurity Architecture and Engineering (KFO1 / D488) emphasizes that timely application of security patches is critical to addressing vulnerabilities like outdated software. A hybrid cloud topology offers the flexibility and scalability needed by financial institutions while keeping sensitive data protected in more controlled environments.
Strong password policies (A) help, but public cloud alone may not be best for sensitive banking systems.
Antivirus (C) addresses only part of the threat. Private cloud (D) improves security but may not offer the scalability benefits of a hybrid approach.
Reference Extract from Study Guide:
“Timely application of security patches mitigates vulnerabilities, and hybrid cloud models balance the need for scalability and sensitive data protection in financial institutions.”
– WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Mitigation Strategies and Cloud Topologies

QUESTION 86
What is true about an operating system?

It is a firmware burned onto the computer mother board.

It is a software program that directly supports the computer itself.

It is a hardware component of the computer system.

It is an application program similar to word processors.

* Anoperating system (OS)is a system software that manages computer hardware and software resources and provides common services for computer programs.
* It serves as an intermediary between users and the computer hardware.
* Key functionsof an OS include:
* Managinghardware resourceslike the CPU, memory, and I/O devices.
* Providing auser interface(UI) for interaction with the system.
* File managementand handling file operations.
* Process managementand multitasking.
* Securityand access control.
* Examples include Windows, Linux, and macOS.
References:
* “Operating System Concepts” by Abraham Silberschatz, Greg Gagne, and Peter B. Galvin.
* “Modern Operating Systems” by Andrew S. Tanenbaum.

QUESTION 87
The DevSecOps team for an organization manages a continuous integration and continuous deployment (CI
/CD) pipeline for a three-tier web application. Management has asked the team to perform a series of comprehensive post-deployment tests to make sure that all of the components of the application can interact and function properly.

Dynamic code analysis

Integration testing

Static code analysis

Package scanning

Integration testingverifies the interactions and data flow between individual software components post- deployment. It is a crucial step in CI/CD pipelines, especially inmulti-tier architecturesystems like web applications.
NIST SP 800-160 Vol. 1 (Systems Security Engineering):
“Integration testing should verify that security functions behave correctly when subsystems or components are combined.” This test type ensures system cohesion after components are deployed, unlikestatic/dynamic code analysiswhich focuses on code quality and vulnerabilities during earlier phases.
#WGU Course Alignment:
Domain:System Security Engineering
Topic:Validate secure systems through testing in CI/CD pipelines

QUESTION 88
Which software allows the user to easily access the hardware of a computer?

Productivity

FTP client

Application

Operating system

The operating system (OS) is the primary software that manages all the hardware and other software on a computer. It acts as an intermediary between users and the computer hardware. The OS handles basic tasks such as controlling and allocating memory, prioritizing system requests, controlling input and output devices, facilitating networking, and managing files. Examples include Windows, macOS, and Linux.

Loading …

Online Questions – Valid Practice Cybersecurity-Architecture-and-Engineering Exam Dumps Test Questions: https://www.latestcram.com/Cybersecurity-Architecture-and-Engineering-exam-cram-questions.html

Free Cram & Latest Exams Dumps

Cybersecurity-Architecture-and-Engineering Exam Info and Free Practice Test All-in-One Exam Guide May-2026 [Q66-Q88]

leave a comment Cancel reply

Recent Posts

Archives

Categories