Recovery Time Objective (RTO)refers to themaximum acceptable amount of timea system or service can be offline after a disasterbefore significant impact occurs.
NIST SP 800-34 Rev. 1:
"RTO is the maximum tolerable length of time that a system or application can be unavailable after an incident before significantly impacting business operations." BIA identifies impacts, while RTO quantifiestime-to-recovery tolerance.
#WGU Course Alignment:
Domain:Business Continuity and Disaster Recovery
Topic:Define and use RTO metrics in disaster planning

AnIntrusion Prevention System (IPS)detects and blocks malicious activity in real time based on defined policies or behavior patterns. IPS tools can enforcerate limiting,connection attempts, and evenauto- blockingafter repeated failures.
NIST SP 800-94 Rev. 1:
"Intrusion prevention systems not only detect potential incidents but actively prevent attempts such as brute- force attacks on services like SSH." Firewalls may filter traffic, but only an IPSactively terminates or blocks behavior-based threats like repeated failed logins.
#WGU Course Alignment:
Domain:Network Security
Topic:Deploy and configure IPS for automated protection against brute-force attacks

Application Software:
Application software refers to programs that help end users perform specific tasks. Examples include email clients, word processors, and spreadsheet programs.
These are designed to be used by people to perform tasks such as writing documents, managing data, or communicating.
Operating Systems:
Operating systems (OS) manage the hardware and software resources of a computer system. They provide a platform for application software to run.
Examples include Microsoft Windows, macOS, and Linux. The OS handles system-level tasks like memory management, process scheduling, and hardware interaction.
Key Differences:
Application software (B, C) is user-oriented, aimed at helping users complete tasks.
Operating systems (A, D) manage the computer's hardware and system resources.
References:
Application software: Application Software
Operating system functions: Operating System Functions

The correct answer is C - Implementation of role-based access controls and encryption of all sensitive data.
According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), the combination of role- based access control (RBAC) and encryption protects sensitive health data by ensuring only authorized users can access necessary information, while encryption ensures the data remains secure both at rest and in transit.
Disabling USB ports (A) prevents data exfiltration but does not fulfill broad privacy requirements. Encrypting network traffic (B) protects in-transit data only. Firewalls (D) protect against unauthorized access but do not manage user roles or internal data privacy.
Reference Extract from Study Guide:
"Protecting sensitive health data requires a combination of access control models such as RBAC and encryption, ensuring both authorization and confidentiality."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Privacy and Data Protection Strategies

The correct answer is C - Cyber kill chain.
The Cyber Kill Chain, developed by Lockheed Martin, is a model that breaks down a cyber attack into seven distinct phases: reconnaissance, weaponization, delivery, exploitation, installation, command and control (C2), and actions on objectives. According to the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) study materials, this model helps security teams understand and interrupt an attack at various stages.
While MITRE ATT&CK (B) and its ICS variant (A) provide detailed mappings of techniques used by attackers, they are not structured specifically into seven phases like the Cyber Kill Chain. The Diamond Model (D) is an analysis methodology, not a phase-based model.
Reference Extract from Study Guide:
"The Cyber Kill Chain model divides the sequence of a cyber attack into seven phases, providing a structured method for analyzing and disrupting attacks."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Attack Frameworks and Methodologies