support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. WGU
  4. Cybersecurity-Architecture-and-Engineering

Free Cybersecurity-Architecture-and-Engineering Exam Braindumps
WGU Cybersecurity Architecture and Engineering (KFO1/D488) Questions 71–75 (page: 16)

Updated On: 11-Feb-2026
Page 16 of 48
PDF with 232 Questions

An application team manages a large farm of web servers on virtual machines in the cloud. The team wants to reduce the server load by caching static content. Adding a second layer of protection is also a requirement.

What should this team recommend in this scenario?

  1. Firewall rule changes
  2. Intrusion detection system (IDS)
  3. Reverse proxy
  4. Network address translation (NAT)

Answer(s): C

Explanation:

The correct answer is C -- Reverse proxy.

As per the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) course content, a reverse proxy server acts on behalf of web servers by caching static content (such as images, scripts, and HTML files), significantly reducing server load. It also provides an additional layer of protection by hiding the backend servers from direct exposure to clients and enabling centralized application of security policies such as SSL termination and Web Application Firewall (WAF) integration.

Firewall rule changes (A) manage access control but do not handle caching or reduce load. An IDS (B) monitors for intrusions but doesn't offload traffic or cache content. NAT (D) translates IP addresses but doesn't cache content or add a protection layer.


Reference:

Extract from Study Guide:

"A reverse proxy server provides caching capabilities for static content and acts as a protective intermediary between client requests and backend servers, thus reducing server load and enhancing security."

-- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Secure Network Design Concepts



A system analyst is reviewing risk documents and noticed that the date of many risks are more than three years old.

What should be proposed to leadership regarding these risks?

  1. A process to reassess risks on a defined schedule
  2. A process to confirm that risk documents are readily available to all individuals
  3. A process to evaluate how risks are captured on risk documents
  4. A process to determine how involved leadership is in assignment risk scores

Answer(s): A

Explanation:

The correct answer is A -- A process to reassess risks on a defined schedule.

Based on the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) Study Guide, risks must be reassessed periodically because the threat landscape, organizational assets, and business processes evolve over time. Risks identified years ago might have changed in likelihood, impact, or may have been mitigated already. Therefore, it is essential to establish a formal process for periodic risk review and reassessment to maintain accurate and actionable risk profiles.

Availability of risk documents (B), methods of capture (C), and leadership involvement in scoring (D) are important, but they do not directly address the primary issue of outdated risk assessments.


Reference:

Extract from Study Guide:

"Organizations must implement a periodic review and reassessment process for risks to ensure that risk profiles reflect the current threat environment, organizational changes, and mitigation efforts."

-- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Management Framework



A company is developing a new mobile application to support external customers and contractors. The application needs to allow users to sign in using third-party social identities.

What is the best protocol?

  1. Security Assertion Markup Language (SAML)
  2. Kerberos
  3. Lightweight Directory Access Protocol (LDAP)
  4. Open Authorization (OAuth)

Answer(s): D

Explanation:

The correct answer is D -- Open Authorization (OAuth).

According to the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) Study Guide, OAuth is the standard protocol used for authorizing access to third-party applications without revealing user credentials. It allows users to log in using social identity providers like Google, Facebook, or LinkedIn, which is perfect for external customers and contractors accessing a mobile application. OAuth is designed for modern applications requiring delegated access.

SAML (A) is generally used for enterprise single sign-on (SSO) solutions, primarily for internal enterprise authentication, not social login. Kerberos (B) is used within controlled internal network environments for authentication. LDAP (C) is a directory access protocol, not an authorization protocol for third-party sign-in.


Reference:

Extract from Study Guide:

"OAuth enables users to grant a third-party application limited access to their resources withoutexposing their credentials, making it ideal for mobile and web applications involving external users."

-- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Authentication and Authorization Concepts



An IT organization has recently migrated its servers to the cloud. The security team needs to delegate administrative control of multiple cloud services to various administrators inside the company. This team needs a granular solution that will offer the most flexibility while maintaining a secure posture.

What is the best solution?

  1. Open Authorization (OAuth)
  2. Security Assertion Markup Language (SAML)
  3. Role-based access control (RBAC)
  4. Kerberos

Answer(s): C

Explanation:

The correct answer is C -- Role-based access control (RBAC).

WGU KFO1 / D488 course material emphasizes that RBAC allows administrators to assign permissions based on roles rather than individual users. This method provides granular control and flexibility, allowing the organization to efficiently manage access rights across multiple cloud services while maintaining a strong security posture.

OAuth (A) and SAML (B) are protocols for authentication and authorization, not detailed access control models. Kerberos (D) is used for secure authentication within a network but does not provide the granular delegation capabilities needed for cloud service administration.


Reference:

Extract from Study Guide:

"Role-based access control (RBAC) provides a scalable and manageable model to assign permissions to users based on their organizational roles, ensuring flexibility and maintaining secure delegation of administrative tasks."

-- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Access Control Models



A government agency is planning a hybrid cloud deployment. Strict controls must be in place that can label classified data. The solution must ensure that access rights will be granted based on the user's government security classification.

Which type of access control should be used?

  1. Mandatory access control (MAC)
  2. Attribute-based access control (ABAC)
  3. Discretionary access control (DAC)
  4. Role-based access control (RBAC)

Answer(s): A

Explanation:

The correct answer is A -- Mandatory access control (MAC).

Per WGU Cybersecurity Architecture and Engineering (KFO1 / D488) coursework, MAC is a strict access control model where access to resources is based on information labels (such as classified, secret, top secret) and user clearances. Only administrators define and control the policy rules, and users cannot alter access settings, making it ideal for environments where classification labels determine access rights, such as government systems.

ABAC (B) focuses on attributes but is more dynamic rather than based purely on rigid classifications. DAC (C) gives data owners control over access permissions, unsuitable for classified government environments. RBAC (D) assigns permissions based on roles, but not necessarily aligned with security labels.


Reference:

Extract from Study Guide:

"Mandatory access control (MAC) enforces access policies based on fixed labels and security classifications, making it the preferred model for high-security environments like government agencies handling classified data."

-- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Access Control Models



  PDF
Viewing page 16 of 48
Viewing questions 76 - 80 out of 232 questions


Post your Comments and Discuss WGU Cybersecurity-Architecture-and-Engineering exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!