WGU D487 Secure Software Design Practice Test – Full Guide & Practice Questions 2025

WGU D487 Secure Software Design - 300 Question
Practice Test
1. What is the primary goal of Least privilege?
A. Use default configurations for faster deployment.
B. Ensure data confidentiality and integrity.
C. Limit permissions to ...
D. Limit permissions to the minimum necessary for a role or process.
2. Give a concise definition of Defense in depth.
A. Use multiple layers of security controls to protect assets.
B. Use multiple layers ...
C. Use default configurations for faster deployment.
D. Disable encryption for local debugging.
3. Why is Fail-safe defaults important in secure software design?
A. Ignore input validation to save performance.
B. Disable encryption for local debugging.
C. Default to denying access unless explicitly allowed.
D. Use default configurations for faster deployment.
4. Name one common vulnerability or issue related to Economy of mechanism.
A. Disable encryption for local debugging.
B. Ensure data confidentiality and integrity.
C. Keep designs simple to reduce errors and attack surface.
D. Use default configurations for faster deployment.
5. Provide a best practice for implementing Separation of duties.
A. Divide critical tasks among different individuals or processes.
B. Ignore input validation to save performance.
C. Disable encryption for local debugging.
D. Use default configurations for faster deployment.
6. When assessing STRIDE, what is a common mitigation?
A. Ensure data confidentiality and integrity.
B. Disable encryption for local debugging.
C. A threat model mnemonic: Spoofing, Tampering, Repudiation, Information disclosure, Denial of
service, Elevation of privilege.
D. Ignore input validation to save performance.
7. How does DREAD relate to the OWASP Top 10?
A. Disable encryption for local debugging.
B. Ensure data confidentiality and integrity.
C. Ignore input validation to save performance.
D. A risk assessment model: Damage, Reproducibility, Exploitability, Affected users, Discoverability.
8. List a tool or technique used to evaluate Attack surface.
A. Ensure data confidentiality and integrity.
B. All points where ...
C. All points where an attacker can interact with the system.
D. Disable encryption for local debugging.
9. What is a common mistake developers make regarding Data flow diagram?
A. A visual representation of data movement used for threat modeling.

,B. Ensure data confidentiality and integrity.
C. A visual representation ...
D. Disable encryption for local debugging.
10. Explain how Threat enumeration impacts confidentiality, integrity, or availability.
A. Ensure data confidentiality and integrity.
B. Systematic listing of threats that could affect an application.
C. Disable encryption for local debugging.
D. Use default configurations for faster deployment.

,11. What is the primary goal of A1: Injection?
A. When untrusted input gets executed as code or query (e.g., SQL injection).
B. Ensure data confidentiality and integrity.
C. Use default configurations for faster deployment.
D. Disable encryption for local debugging.
12. Give a concise definition of A2: Broken Authentication.
A. Authentication guarantees are flawed allowing account compromise.
B. Ensure data confidentiality and integrity.
C. Use default configurations for faster deployment.
D. Disable encryption for local debugging.
13. Why is A3: Sensitive Data Exposure important in secure software design?
A. Disable encryption for local debugging.
B. Failure to protect sensitive data at rest or in transit.
C. Ignore input validation to save performance.
D. Use default configurations for faster deployment.
14. Name one common vulnerability or issue related to A4: XML External Entities (XXE).
A. Ensure data confidentiality and integrity.
B. Disable encryption for local debugging.
C. Definition or practice related to A4: XML External Entities (XXE).
D. Definition or practice ...
15. Provide a best practice for implementing A5: Broken Access Control.
A. Users can act outside their intended permissions.
B. Use default configurations for faster deployment.
C. Disable encryption for local debugging.
D. Ignore input validation to save performance.
16. When assessing A6: Security Misconfiguration, what is a common mitigation?
A. Ignore input validation to save performance.
B. Use default configurations for faster deployment.
C. Default or insecure ...
D. Default or insecure settings left in production.
17. How does A7: Cross-Site Scripting (XSS) relate to the OWASP Top 10?
A. Disable encryption for local debugging.
B. Definition or practice related to A7: Cross-Site Scripting (XSS).
C. Use default configurations for faster deployment.
D. Definition or practice ...
18. List a tool or technique used to evaluate A8: Insecure Deserialization.
A. Ensure data confidentiality and integrity.
B. Ignore input validation to save performance.
C. Unsafe deserialization leads to remote code execution or privilege escalation.
D. Unsafe deserialization leads ...
19. What is a common mistake developers make regarding A9: Using Components with Known
Vulnerabilities?
A. Ensure data confidentiality and integrity.
B. Inclusion of vulnerable libraries or components.
C. Inclusion of vulnerable ...
D. Disable encryption for local debugging.
20. Explain how A10: Insufficient Logging & Monitoring impacts confidentiality, integrity, or availability.
A. Ensure data confidentiality and integrity.

, B. Use default configurations for faster deployment.
C. Lack of observability to detect and respond to breaches.
D. Lack of observability ...