Free Cybersecurity-Architecture-and-Engineering Exam braindumps download (Cybersecurity-Architecture-and-Engineering exam dumps Free)

QUESTION: 81

The security operations center (SOC) team has been alerted about malicious traffic on the corporate network and is concerned about a distributed denial of service (DDoS) attack. An analyst has been tasked with inspecting network traffic in the on-premises data center to investigate the issue.

Which type of file should the analyst use to inspect the traffic?

Web server access log
Syslog messages
Operating system event log
Packet capture

Answer(s): D

Explanation:

The correct answer is D -- Packet capture.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488) content, packet captures (PCAP files) allow analysts to inspect individual network packets to understand traffic patterns, detect anomalies, and investigate attacks like DDoS. A packet capture provides complete network session data, enabling in-depth analysis of traffic behavior at the packet level.

Web server access logs (A) only capture web activity. Syslog messages (B) primarily record system events but not raw traffic data. Operating system event logs (C) focus on system-level actions, not network flows.

Reference:

Extract from Study Guide:

"Packet captures record the full network traffic and are essential for investigating network-based attacks such as DDoS incidents by analyzing traffic flows, protocols, and payloads."

-- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Network Security Monitoring Concepts

Show Answer Next Question

QUESTION: 82

A security engineer has been asked to audit unapproved changes that have recently taken place in a corporate application.

Which logging mechanism will create an audit trail?

NetFlow logs
Access logs
Packet capture logs
Router logs

Answer(s): B

Explanation:

The correct answer is B -- Access logs.

As outlined in the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) materials, access logs record who accessed which system components, when they did so, and what changes they made. These logs are vital for creating an audit trail that can be reviewed to detect unauthorized changes to applications or systems.

NetFlow logs (A) track network traffic flows but not system or application changes. Packet capture logs (C) deal with network data but are not specialized for auditing application-level events. Router logs (D) capture network device activity, not application access information.

Reference:

Extract from Study Guide:

"Access logs maintain detailed records of user actions within systems and applications, providing the necessary audit trail for tracking authorized and unauthorized activities."

-- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Log Management Concepts

Show Answer Next Question

QUESTION: 83

A company's website is suddenly redirecting users to a suspicious landing page asking for personal information.

What is the most likely cause of the issue?

Exfiltration
Phishing
Tampering
Ransomware

Answer(s): C

Explanation:

The correct answer is C -- Tampering.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) materials explain that tampering refers to unauthorized modifications of systems or data. In this case, the website being altered to redirect users to a malicious landing page indicates that an attacker has tampered with the legitimate website code or its DNS settings.

Exfiltration (A) refers to stealing data. Phishing (B) involves tricking users but not modifying a website. Ransomware (D) encrypts systems for ransom, not cause redirection.

Reference:

Extract from Study Guide:

"Tampering involves the unauthorized modification of a system or its resources, often to redirect users to malicious destinations or to alter functionality in harmful ways."

-- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Threat Categories and Impacts

Show Answer Next Question

QUESTION: 84

A company with a hybrid cloud deployment needs to identify all possible threat types that could impact production systems.

Which threat hunting technique should be used to identify potential attacks that have already occurred?

Honeypots
Log analysis
Social engineering
Penetration testing

Answer(s): B

Explanation:

The correct answer is B -- Log analysis.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488) curriculum, log analysis is critical for retrospective threat hunting -- reviewing system, network, and application logs to identify signs of compromise or unauthorized activities that might have gone unnoticed in real-time. This technique helps uncover attacks that have already occurred in hybrid or cloud environments.

Honeypots (A) are proactive traps to detect future attacks. Social engineering (C) involves manipulating people, not hunting threats. Penetration testing (D) is used to find vulnerabilities, not to review past incidents.

Reference:

Extract from Study Guide:

"Threat hunting through log analysis involves systematically reviewing collected logs to uncover evidence of past or ongoing compromises, enabling organizations to identify and respond to threats that may have bypassed preventive controls."

-- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Threat Detection and Hunting Concepts

Of course!

Here are the verified and properly formatted answers for your next set of questions, strictly following your instructions and the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) official course materials:

Show Answer Next Question

QUESTION: 85

An IT team has been tasked with improving an organization's security posture to defend against potential malicious actors.

What is the first step when hunting for potential threats?

Deploy an anti-malware solution
Implement an intrusion detection system
Form an incident response team
Establish a baseline for normal activity

Answer(s): D

Explanation:

The correct answer is D -- Establish a baseline for normal activity.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488) materials, the first step in threat hunting is to understand what constitutes normal behavior within the environment. Establishing a baseline allows analysts to detect anomalies and deviations that could indicate malicious activity. Without a clear understanding of normal operations, it is extremely difficult to identify potential threats.

Deploying anti-malware solutions (A) and implementing intrusion detection systems (B) are important security measures but are not the first step in proactive threat hunting. Forming an incident response team (C) is essential for handling incidents but does not directly initiate threat hunting.

Reference:

Extract from Study Guide:

"Threat hunting begins with establishing a baseline of normal network, system, and user activity, enabling the detection of anomalies that may indicate potential threats."

-- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Threat Hunting and Detection

Show Answer Next Question

Free Cybersecurity-Architecture-and-Engineering Exam Braindumps WGU Cybersecurity Architecture and Engineering (KFO1/D488) Questions 81–85 (page: 18)

QUESTION: 81

Explanation:

Reference:

QUESTION: 82

Explanation:

Reference:

QUESTION: 83

Explanation:

Reference:

QUESTION: 84

Explanation:

Reference:

QUESTION: 85

Explanation:

Reference:

Free Cybersecurity-Architecture-and-Engineering Exam Braindumps
WGU Cybersecurity Architecture and Engineering (KFO1/D488) Questions 81–85 (page: 18)