The correct answer is C - Replacing the legacy firewalls with next-generation firewalls (NGFWs).
WGU Cybersecurity Architecture and Engineering (KFO1 / D488) outlines that NGFWs integrate advanced features like intrusion detection and prevention, application control, and real-time threat intelligence. They are designed to detect and alert on inbound threats as required by the mandate.
SIEM appliances (A) collect logs and correlate events but do not replace firewall functionality. Load balancers (B) manage traffic distribution, not threat detection. Reverse proxies (D) secure and balance traffic for web servers, not general firewall traffic.
Reference Extract from Study Guide:
"Next-generation firewalls (NGFWs) provide integrated intrusion detection and prevention capabilities, fulfilling modern security requirements for real-time threat monitoring and alerting."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Firewall Technologies and Modern Security Controls

The correct answer is C - Implementing local drive encryption on employee laptops.
WGU Cybersecurity Architecture and Engineering (KFO1 / D488) explains that encryption protects sensitive data at rest, ensuring that if a laptop is lost or stolen, the data remains unreadable without the decryption key.
This control directly addresses the protection of sensitive customer data.
Restricting software installation (A) is a good security practice but does not specifically protect stored sensitive data. Biometric authentication (B) strengthens authentication but does not encrypt data. Awareness training (D) helps users behave securely but does not technically protect the data itself.
Reference Extract from Study Guide:
"Local drive encryption protects sensitive data stored on mobile devices such as laptops, ensuring confidentiality even if the device is lost or stolen."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Endpoint Security and Device Hardening

Risk avoidanceinvolves eliminating the source of risk altogether. In this case, the organization chose todecommission the vulnerable systeminstead of patching or compensating - a clear example of avoiding risk.
NIST SP 800-30 Rev. 1 (Risk Assessment Guide):
"Risk avoidance involves not performing the action that gives rise to the risk or eliminating the risk cause or consequence." This strategy is ideal when the cost or complexity of mitigation is too high or when risk to the business is unacceptable.
#WGU Course Alignment:
Domain:Security Models and Design
Topic:Understand and apply risk response strategies (avoid, accept, transfer, mitigate)

The correct answer is D - Review.
WGU Cybersecurity Architecture and Engineering (KFO1 / D488) describes that the review phase of the risk management cycle involves evaluating whether the implemented controls are effective over time. Conducting regular risk assessments after deployment falls under the review process.
Control (A) is about applying mitigations. Assess (B) happens earlier during initial evaluation. Identify (C) was done before applying the controls.
Reference Extract from Study Guide:
"Reviewing the effectiveness of risk control strategies through ongoing assessments ensures continuous improvement in risk management practices."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Risk Management Review and Continuous Improvement

The correct answer is A - Mandatory access control (MAC).
Per WGU Cybersecurity Architecture and Engineering (KFO1 / D488) coursework, MAC is a strict access control model where access to resources is based on information labels (such as classified, secret, top secret) and user clearances. Only administrators define and control the policy rules, and users cannot alter access settings, making it ideal for environments where classification labels determine access rights, such as government systems.
ABAC (B) focuses on attributes but is more dynamic rather than based purely on rigid classifications. DAC (C) gives data owners control over access permissions, unsuitable for classified government environments.
RBAC (D) assigns permissions based on roles, but not necessarily aligned with security labels.
Reference Extract from Study Guide:
"Mandatory access control (MAC) enforces access policies based on fixed labels and security classifications, making it the preferred model for high-security environments like government agencies handling classified data."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Access Control Models