Free Practice Questions for WGU Cybersecurity-Architecture-and-Engineering Exam

Step by Step Comprehensive Detailed Explanation

A compiler is a program that translates source code written in a high-level programming language into machine code.

Definition: A compiler processes the entire source code of a program and translates it into a machine code executable.

Functionality: This process is typically done in several stages, including lexical analysis, syntax analysis, semantic analysis, optimization, and code generation.

Output: The result is an executable file that can be run on a specific operating system.

References

"Compilers: Principles, Techniques, and Tools" by Alfred V. Aho, Monica S. Lam, Ravi Sethi, and Jeffrey D. Ullman

NISTIR 7860, "C++ Coding Standards"

It is better to purchase software rather than build a software solution in-house when there is a short timeline. Building software from scratch requires significant time for development, testing, and deployment. Purchasing off-the-shelf software can significantly reduce the time needed to implement a solution. Other considerations include:

Cost-effectiveness: Pre-built software can be more cost-effective than developing a custom solution, especially when factoring in the costs of development, maintenance, and support.

Immediate availability: Purchased software is usually ready to deploy immediately, whereas custom development can take months or even years.

Proven reliability: Commercial software often has a track record of reliability and user support, reducing the risk of bugs and issues that may arise with custom development.

Therefore, when time is of the essence, purchasing software is the preferable option.

References

Ian Sommerville, "Software Engineering," Pearson.

Steve McConnell, "Rapid Development: Taming Wild Software Schedules," Microsoft Press.

The correct answer is A — Tactical.

Based on WGU Cybersecurity Architecture and Engineering (KFO1 / D488) study material, tactical threat intelligence provides technical details such as indicators of compromise (IOCs), IP addresses, file hashes, domain names, and other evidence needed to detect and respond to threats immediately. This type of intelligence is used by security teams to perform real-time monitoring and incident response.

Operational intelligence (C) addresses campaigns or actor behavior but is not immediately actionable. Strategic intelligence (D) provides high-level, long-term threat trends. Commodity malware (B) refers to low-level malware types, not intelligence classifications.

Reference Extract from Study Guide:

"Tactical threat intelligence focuses on technical indicators of compromise (IOCs) and immediate actionable information that responders use to detect and contain active threats."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Threat Intelligence Concepts

=============================================

The employee needs to execute a program from the command line, which requires inputting commands into the computer.

The primary device for inputting commands is the keyboard.

Other options like the hard drive, speaker, and printer are not used for inputting commands.

The hard drive is used for data storage.

The speaker outputs sound.

The printer outputs documents.

Therefore, the correct peripheral device for this task is the keyboard.

The correct answer is A — A process to reassess risks on a defined schedule.

Based on the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) Study Guide, risks must be reassessed periodically because the threat landscape, organizational assets, and business processes evolve over time. Risks identified years ago might have changed in likelihood, impact, or may have been mitigated already. Therefore, it is essential to establish a formal process for periodic risk review and reassessment to maintain accurate and actionable risk profiles.

Availability of risk documents (B), methods of capture (C), and leadership involvement in scoring (D) are important, but they do not directly address the primary issue of outdated risk assessments.

Reference Extract from Study Guide:

"Organizations must implement a periodic review and reassessment process for risks to ensure that risk profiles reflect the current threat environment, organizational changes, and mitigation efforts."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Management Framework

The correct answer is D — Implementation of data encryption.

As per WGU Cybersecurity Architecture and Engineering (KFO1 / D488), encrypting data at rest ensures that even if attackers breach the system and obtain files, the data remains protected because it cannot be easily read without decryption keys.

Firewall enforcement (A) restricts access but does not protect data if stolen. Disabling printing services (B) limits data leakage but not core data protection. Backups (C) help with recovery, not immediate breach protection.

Reference Extract from Study Guide:

"Encrypting sensitive data ensures confidentiality even in the event of a security breach, protecting information from unauthorized exploitation."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Data Security and Encryption Practices

=============================================

Fiber optic communications use light waves to transmit data.

This method allows for high-speed and long-distance data transmission.

The other options:

Radio towers use radio waves.

Twisted pair uses electrical signals.

Coaxial also uses electrical signals.

Therefore, the correct communication medium that uses light waves is fiber optic.

The correct answer is D — Security information and event management (SIEM).

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), a SIEM collects and correlates event data from multiple sources (such as cloud and on-premisesenvironments) in real-time. It provides centralized visibility, analysis, and alerting, which is critical in hybrid cloud deployments.

File integrity monitoring (A) watches for unauthorized file changes, not event correlation. DLP (B) protects sensitive data but does not correlate events. IDS (C) detects network intrusions but does not combine event data centrally.

Reference Extract from Study Guide:

"Security information and event management (SIEM) systems collect, normalize, correlate, andanalyze security event data from multiple sources, providing centralized monitoring and alerting."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Security Monitoring and Event Management

=============================================

The SQL statementSELECT * FROM Customers WHERE State = 'Arizona';is used to select records from theCustomerstable.

TheSELECT *clause indicates that all columns from theCustomerstable should be returned.

TheWHEREclause filters the rows to only include those where theStatecolumn value is'Arizona'.

The result is a subset of theCustomerstable with all rows that match the condition.

The correct answer is D — Removing all end-of-life devices from the network.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), end-of-life systems pose significant risks because they no longer receive patches or updates. The besthardening technique in this situation is to decommission and remove these devices, eliminating their vulnerabilities altogether.

Access control (A), vulnerability scanning (B), and IDPS (C) are helpful practices but do not eliminate vulnerabilities of unsupported devices.

Reference Extract from Study Guide:

"Removing end-of-life or unsupported assets is essential for maintaining a secure infrastructure, as these devices are highly vulnerable to exploitation."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), System and Device Hardening

=============================================