The WGU Cybersecurity Architecture and Engineering (KFO1/D488) (Cybersecurity-Architecture-and-Engineering)

The SQL statementSELECT * FROM Customers WHERE State = 'Arizona';is used to select records from theCustomerstable.

TheSELECT *clause indicates that all columns from theCustomerstable should be returned.

TheWHEREclause filters the rows to only include those where theStatecolumn value is'Arizona'.

The result is a subset of theCustomerstable with all rows that match the condition.

The employee needs to execute a program from the command line, which requires inputting commands into the computer.

The primary device for inputting commands is the keyboard.

Other options like the hard drive, speaker, and printer are not used for inputting commands.

The hard drive is used for data storage.

The speaker outputs sound.

The printer outputs documents.

Therefore, the correct peripheral device for this task is the keyboard.

Recovery Point Objective (RPO)defines themaximum acceptable amount of data lossmeasured in time. It determines how often backups should occur to avoid losing critical business data.

NIST SP 800-34 Rev. 1:

“RPO represents the point in time prior to an outage to which systems and data must be restored to resume business operations.”

CDP is a method; RPO is thestrategic planning metric.

???? WGU Course Alignment:

Domain:Business Continuity and Disaster Recovery

Topic:Define RPO to support data resilience and backup planning

The goal in this scenario is tosecure the application against malware and advanced persistent threats (APTs). According to the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) course materials:

Firewall policiesare critical forcontrolling accessto applications and network resources.

By implementing astrict firewall policy, you limit access to only trusted and necessary sources, greatly reducing the attack surface available to malware or APT actors.

While antivirus software (Option C) can help detect malware,APT actors often use sophisticated methodsthat bypass traditional antivirus tools.

Encryption (Option A) protectsdata confidentialitybutdoes not preventmalware or APTs from attacking the application.

Strong password policies (Option B) helpwith account securitybutdo not directly addressmalware or APT threats.

Key extract from the WGU D488 Study Guide:

"A strict firewall policy is essential for preventing unauthorized access and mitigating advanced persistent threats. Limiting exposure through segmentation, access control lists, and traffic filtering protects critical assets from external and internal threats."

The correct answer is C — Implementing local drive encryption on employee laptops.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) explains that encryption protects sensitive data at rest, ensuring that if a laptop is lost or stolen, the data remains unreadable without the decryption key. This control directly addresses the protection of sensitive customer data.

Restricting software installation (A) is a good security practice but does not specifically protect stored sensitive data. Biometric authentication (B) strengthens authentication but does not encrypt data. Awareness training (D) helps users behave securely but does not technically protect the data itself.

Reference Extract from Study Guide:

"Local drive encryption protects sensitive data stored on mobile devices such as laptops, ensuring confidentiality even if the device is lost or stolen."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Endpoint Security and Device Hardening

=============================================

The correct answer is A — Electronic codebook (ECB).

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), ECB mode is the simplest and most basic mode of operation for block ciphers. It encrypts each block of plaintext independently with the same key, but identical plaintext blocks produce identical ciphertext blocks, providing no additional confidentiality beyond the block cipher itself and making patterns visible.

CBC (B), CTR (C), and OFB (D) are more secure and avoid patterns.

Reference Extract from Study Guide:

"Electronic Codebook (ECB) mode encrypts each block independently and is simple but reveals patterns when identical plaintext blocks occur, thus offering minimal confidentiality beyond the underlying cipher."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Block Cipher Modes of Operation

=============================================

The correct answer is D — Encryption to prevent man-in-the-middle and eavesdropping attacks.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) explains that while NFC is inherently short-range, it is still vulnerable to eavesdropping and man-in-the-middle attacks. Applying encryption ensures that even if communication is intercepted, the data remains protected and confidential.

Kerberos (A) is primarily for authentication within internal networks. Bluetooth restrictions (B) are unrelated to NFC. PDM (C) restricts device usage but does not directly protect NFC communication.

Reference Extract from Study Guide:

"Encrypting near-field communication ensures confidentiality and protects against interception and manipulation through man-in-the-middle and eavesdropping attacks."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Wireless and Mobile Security Concepts

The correct answer is C — Competitor.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), competitors often attempt to steal intellectual property to gain a business advantage. Given the theft of valuable business assets (e-books and videos), the most likely actor is a competitor motivated by financial or market advantage, not ideology or random hacking.

An APT (A) is usually nation-state-sponsored and targets critical infrastructure. A novice hacker (B) might deface or cause damage but is less likely focused on IP theft. Hacktivists (D) are politically motivated, not financially.

Reference Extract from Study Guide:

"Competitors may engage in cyber espionage to steal intellectual property and gain market advantage, representing a significant threat to business assets."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Threat Actor Categories

The correct answer is C — Intrusion prevention system.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) states that an Intrusion Prevention System (IPS) actively monitors network traffic and can block malicious activity in real-time. It can enforce rules like blocking an IP address after multiple failed SSH login attempts, stopping brute force attacks.

DLP (A) focuses on preventing sensitive data loss. A firewall (B) controls network traffic but generally does not automatically block based on login attempts unless highly customized. File integrity monitoring (D) watches file changes, not login attempts.

Reference Extract from Study Guide:

"An intrusion prevention system (IPS) monitors network traffic for malicious activities and can automatically block connections that meet predefined suspicious criteria."

— WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Intrusion Detection and Prevention Systems

=============================================