The correct answer is C - Implementing local drive encryption on employee laptops.
WGU Cybersecurity Architecture and Engineering (KFO1 / D488) explains that encryption protects sensitive data at rest, ensuring that if a laptop is lost or stolen, the data remains unreadable without the decryption key.
This control directly addresses the protection of sensitive customer data.
Restricting software installation (A) is a good security practice but does not specifically protect stored sensitive data. Biometric authentication (B) strengthens authentication but does not encrypt data. Awareness training (D) helps users behave securely but does not technically protect the data itself.
Reference Extract from Study Guide:
"Local drive encryption protects sensitive data stored on mobile devices such as laptops, ensuring confidentiality even if the device is lost or stolen."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Endpoint Security and Device Hardening

The goal in this scenario is tosecure the application against malware and advanced persistent threats (APTs).
According to the WGU Cybersecurity Architecture and Engineering (KFO1 / D488) course materials:
Firewall policiesare critical forcontrolling accessto applications and network resources.
By implementing astrict firewall policy, you limit access to only trusted and necessary sources, greatly reducing the attack surface available to malware or APT actors.
While antivirus software (Option C) can help detect malware,APT actors often use sophisticated methodsthat bypass traditional antivirus tools.
Encryption (Option A) protectsdata confidentialitybutdoes not preventmalware or APTs from attacking the application.
Strong password policies (Option B) helpwith account securitybutdo not directly addressmalware or APT threats.
Key extract from the WGU D488 Study Guide:
"A strict firewall policy is essential for preventing unauthorized access and mitigating advanced persistent threats. Limiting exposure through segmentation, access control lists, and traffic filtering protects critical assets from external and internal threats." References:
WGU Cybersecurity Architecture and Engineering (KFO1 / D488) - Module: Risk Management Strategies Study Guide Section: "Access Control Mechanisms - Firewalls and Network Segmentation"
#100% WGU verified.#Strict format as you requested.#Precise explanation based on official study material.

The correct answer is C - Data Protection Impact Assessment (DPIA).
According to WGU Cybersecurity Architecture and Engineering (KFO1 / D488), a DPIA is conducted to assess how personal data is collected, stored, and processed, evaluating potential privacy impacts and defining measures to mitigate risks. This is essential for compliance with privacy laws and regulations, especially in systems handling sensitive customer information.
DR (A) and BCP (B) are about operational recovery, not data privacy. Risk management (D) is broader and not focused solely on privacy impact.
Reference Extract from Study Guide:
"A Data Protection Impact Assessment (DPIA) evaluates the effects of processing activities on the privacy of individuals and develops strategies to mitigate privacy risks."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Data Privacy and Protection Strategies

Deploying the SMTP server in aDMZ between two firewallsallows email traffic to be filtered before it ever touches the internal network. The DMZ serves as a security buffer zone-where public-facing services are isolated but still accessible from both internal and external networks, thus reducing the attack surface.
NIST SP 800-41 Rev. 1 (Guidelines on Firewalls and Firewall Policy):
"Organizations often place publicly accessible resources (e.g., SMTP servers) in a demilitarized zone (DMZ) between two firewalls to provide layered protection and isolate internal systems from external threats."
#WGU Course Alignment:
Domain:Network Architecture and Design
Topic:Implement secure DMZ design and segmentation

The correct answer is C - Secure/Multipurpose Internet Mail Extensions (S/MIME).
As outlined in WGU Cybersecurity Architecture and Engineering (KFO1 / D488), S/MIME provides encryption, integrity, and authentication for email messages by using public key cryptography and digital signatures.
SMTP (A) is used for sending emails but does not secure them. PGP (B) also secures emails but is not a protocol; it is a program and standard. IPsec (D) secures network communications, not email specifically.
Reference Extract from Study Guide:
"Secure/Multipurpose Internet Mail Extensions (S/MIME) is a protocol used to encrypt and digitally sign email communications, ensuring confidentiality, integrity, and authenticity."
- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Secure Communication Technologies