WGU Cybersecurity-Architecture-and-Engineering Exam Dumps

The correct answer is C --- Strong authentication.

According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488) materials, PCI DSS compliance requires strong access controls, including strong authentication mechanisms, especially when accessing environments containing cardholder data. SSH access must be protected with methods such as multi-factor authentication or strong, complex credentials to ensure that only authorized users gain access.

Patch management (A) maintains system security but is not specifically about authentication. Network segmentation (B) limits data exposure but does not directly relate to authentication. Vulnerability analysis (D) identifies weaknesses but does not address the need for strong authentication when connecting to sensitive environments.

Reference Extract from Study Guide:

'Strong authentication mechanisms are crucial to protect access to environments that store, process, or transmit cardholder data, in compliance with PCI DSS standards.'

--- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Regulatory Compliance and Access Control

=============================================

Mandatory Access Control (MAC)is the access control model used in environments that manage classified information such as government or military systems. Under MAC, access is based onsecurity labels(e.g., Top Secret, Confidential), and userscannot changeaccess controls.

NIST SP 800-53 Rev. 5 -- AC-3 (Access Enforcement):

''MAC policies enforce access based on system-enforced labels, without user discretion, and are ideal for high-security environments where strict data control is essential.''

MAC is theonly modelwhere access control decisions arecentrally controlled and enforced by a policy administrator, making it ideal for environments requiringdata labeling and user classification.

WGU Course Alignment:

Domain:Access Control and Identity Management

Topic:Understand and apply MAC for high-security environments

The correct answer is D --- Identity federation.

WGU Cybersecurity Architecture and Engineering (KFO1 / D488) details that identity federation enables users to authenticate using the same credentials across multiple systems and platforms, including hybrid cloud and on-premises environments. Federation facilitates Single Sign-On (SSO) and seamless authentication.

Two-step verification (A) improves authentication strength but does not federate identities. CHAP (B) is an old protocol for PPP connections. Privileged identity management (C) manages high-privilege accounts, not general user access across domains.

Reference Extract from Study Guide:

'Identity federation allows for seamless authentication across on-premises and cloud environments by trusting external identity providers, supporting Single Sign-On (SSO) and hybrid deployments.'

--- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Federation and Identity Management Concepts

Theavailabilityof the POS system depends on itsresilience against known vulnerabilities. Applyingregular security patchesensures that attackers cannot exploit outdated components, which could crash or disrupt the POS system.

NIST SP 800-40 Rev. 3 (Guide to Enterprise Patch Management):

''Prompt application of security patches mitigates vulnerabilities that can be exploited to disrupt system availability or compromise data.''

Backups protect from data loss, butpatching is proactive protectionfor uptime and availability.

WGU Course Alignment:

Domain:Security Operations and Monitoring

Topic:Maintain system availability through proactive patch management

Theprinciple of least privilegedictates that backups---especially those containing sensitive or mission-critical data---should havestrict access controlsto prevent unauthorized access.

NIST SP 800-209 (Security Guidelines for Storage Infrastructure):

''Access to storage resources must be tightly controlled through identity management and access control policies to prevent compromise or misuse of sensitive data.''

While vulnerability scanning and auditing are goodfollow-upactions,immediate access restrictionis thefirst-line defense.

WGU Course Alignment:

Domain:System Security Engineering

Topic:Secure cloud data storage and apply access control measures