D487 Secure Software Design Complete
Exam Study Guide 2026 | 130+ Questions &
Answers with Detailed Explanations |
Guaranteed Pass Exam Prep
Description
This complete exam study guide contains 130+ carefully structured
questions and answers designed to help students master the most
important exam topics and achieve outstanding results. Each question is
accompanied by a clear and detailed explanation, making it easier to
understand key concepts and strengthen exam preparation.
The guide is organized in a simple and student-friendly format,
allowing learners to review essential material quickly while practicing
realistic exam-style questions. By working through these 130+ Q&A,
students can reinforce their knowledge, identify important topics, and
improve their confidence before taking the exam.
This resource is ideal for final exam revision, self-testing, and
comprehensive exam preparation, making it a valuable tool for
students who want a reliable study guide and a higher chance of
passing their exam successfully.
Software Development Life Cycle (SDLC)
A structured process that enables the production of software
What are the 8 phases of the Software Development Lifecycle (SDLC)?
planning
requirements
design
implementation
testing
deployment
,maintenance
end of life
SDLC Phase 1
planning - a vision and next steps are created
SDLC Phase 2
requirements - necessary software requirements are determined
SDLC Phase 3
design - requirements are prepared for the technical design
SDLC Phase 4
implementation - the resources involved in the application from a known resource are
determined
SDLC Phase 5
testing - software is tested to verify its functions through a known environment
SDLC Phase 6
deployment - security is pushed out
SDLC Phase 7
maintenance - ongoing security monitoring is implemented
SDLC Phase 8
end of life - the proper steps for removing software completely are considered
Security Development Life Cycle (SDL)
A process that standardizes security best practices
Secure Code
A principle design in coding that refers to code security best practices, safeguards, and
protection against vulnerabilities
Threat Modeling
A structured process to protect against vulnerabilities
process to pinpoint security threats and potential vulnerabilities that will help prioritize
remediation
Application Security
developing, adding, and testing security features to prevent vulnerabilities within
applications
Building Security in Maturing Model (BSIMM)
a study of real-world software security that allows you to develop your software security
over time
OWASP Software Assurance Maturity Model (SAMM)
flexible framework for building security into a software development organization
Open Web Application Security Project (OWASP)
A flexible and prospective framework to build security into your software development
organization for web applications
Static Analysis
the analysis of computer software that is performed without executing programs
Dynamic Analysis
the analysis of computer software that is performed when executing programs on a real
or virtual processor in real time
Fuzz Testing
,automated or semi-automated testing that provides invalid, unexpected, or random data
to the computer software program
National Institute of Standards and Technology (NIST)
provides research, information, and tools for government and corporate information
security
Measurement Model
A set of data security methods that developers take to protect against vulnerabilities
Metric Model
Allows an organization to determine the effectiveness of its security controls
Waterfall Development
software development methodology that breaks down development activities into linear
sequential phases; each phase depends on the deliverables of the previous one and
corresponds to a specialization of tasks
Waterfall Phases (typical)
plan -> build -> test -> review -> deploy
Iterative Waterfall Development
each phase of a project is broken down into its own waterfall phases
Agile Development
software development methodology that delivers functionality in rapid iterations
called timeboxes, requiring limited planning but frequent communication. Mizes
traditional and new software development practices.
Scrum
framework for Agile that prescribes for teams to break work into goals to be completed
within sprints
flexible, holistic product development strategy where a development team works as a
unit to reach a common goal
Scrum Master (Scrum Role)
responsible for ensuring a Scrum team is operating as effectively as possible by
keeping the team on track, planning and leading meetings, and working out any
obstacles the team might face
Product Owner (Scrum Role)
ensures the Scrum team aligns with overall product goals by managing the product
backlog by ordering work by priority, setting the product vision for the team, and
communicating with external stakeholders to translate their needs to the team
Development Team (Scrum Role)
professionals who do the hands-on work of completing the tasks in a Scrum sprint by
lending their expertise to program, design, or improve products
Lean Development
software development methodology that focuses on further isolating risk to the level of
an individual feature
V-Model
a variation of the waterfall model, where the stage is turned back upwards after the
coding phase
Extreme Programming (XP)
an Agile methodology that is intended to improve software quality and responsiveness
Software Security Architect (SSA)
, ensures that the stakeholder security requirements necessary to protect the
organization's mission and business processes are adequately addressed
Software Security Champion (SSC)
an expert on promoting security awareness, best practices, and simplifying software
security
Software Security Evangelist (SSE)
an expert to promote awareness of products to the wider software community
Functional Requirements
describe what the system will do and its core purpose
Non-Functional Requirements
describe any constraints or restrictions on a design but do not impact the core purpose
of the system
Privacy Impact Assessment
process that evaluates issues and privacy impact rating in relation to the privacy of PII
in the software
Product Risk Profile
helps to determine the actual cost of the product from different perspectives
Requirement Traceability Matrix
a table that lists all of the security requirements
Threat Profile
environment in which the product will operate and potential threats in that environment
DREAD model
damage, reproducibility, exploitability, affected users, discoverability
PASTA
the process for attack simulation and threat analysis; gives a software security team a
repeatable framework for identifying threats
STRIDE
classifies threats into categories: spoofing, tampering, repudiation, information
disclosed, denial of service, and elevation of privilege
Spoofing
illegally accessing and using another user's credentials
Tampering
maliciously changing or modifying persistent data
Denial of Service
Denying access to valid users
Elevation of Privilege
privileged access to resources for gaining unauthorized access to information
Information Disclosure
Read a file that one was not granted access too
Repudiation
performing illegal operations in a system that lacks the ability to trace the prohibited
operations
Software Security Policy
defines what needs to be protected and how it will be protected
Risk Model
assess vulnerabilities during the software development process
Exam Study Guide 2026 | 130+ Questions &
Answers with Detailed Explanations |
Guaranteed Pass Exam Prep
Description
This complete exam study guide contains 130+ carefully structured
questions and answers designed to help students master the most
important exam topics and achieve outstanding results. Each question is
accompanied by a clear and detailed explanation, making it easier to
understand key concepts and strengthen exam preparation.
The guide is organized in a simple and student-friendly format,
allowing learners to review essential material quickly while practicing
realistic exam-style questions. By working through these 130+ Q&A,
students can reinforce their knowledge, identify important topics, and
improve their confidence before taking the exam.
This resource is ideal for final exam revision, self-testing, and
comprehensive exam preparation, making it a valuable tool for
students who want a reliable study guide and a higher chance of
passing their exam successfully.
Software Development Life Cycle (SDLC)
A structured process that enables the production of software
What are the 8 phases of the Software Development Lifecycle (SDLC)?
planning
requirements
design
implementation
testing
deployment
,maintenance
end of life
SDLC Phase 1
planning - a vision and next steps are created
SDLC Phase 2
requirements - necessary software requirements are determined
SDLC Phase 3
design - requirements are prepared for the technical design
SDLC Phase 4
implementation - the resources involved in the application from a known resource are
determined
SDLC Phase 5
testing - software is tested to verify its functions through a known environment
SDLC Phase 6
deployment - security is pushed out
SDLC Phase 7
maintenance - ongoing security monitoring is implemented
SDLC Phase 8
end of life - the proper steps for removing software completely are considered
Security Development Life Cycle (SDL)
A process that standardizes security best practices
Secure Code
A principle design in coding that refers to code security best practices, safeguards, and
protection against vulnerabilities
Threat Modeling
A structured process to protect against vulnerabilities
process to pinpoint security threats and potential vulnerabilities that will help prioritize
remediation
Application Security
developing, adding, and testing security features to prevent vulnerabilities within
applications
Building Security in Maturing Model (BSIMM)
a study of real-world software security that allows you to develop your software security
over time
OWASP Software Assurance Maturity Model (SAMM)
flexible framework for building security into a software development organization
Open Web Application Security Project (OWASP)
A flexible and prospective framework to build security into your software development
organization for web applications
Static Analysis
the analysis of computer software that is performed without executing programs
Dynamic Analysis
the analysis of computer software that is performed when executing programs on a real
or virtual processor in real time
Fuzz Testing
,automated or semi-automated testing that provides invalid, unexpected, or random data
to the computer software program
National Institute of Standards and Technology (NIST)
provides research, information, and tools for government and corporate information
security
Measurement Model
A set of data security methods that developers take to protect against vulnerabilities
Metric Model
Allows an organization to determine the effectiveness of its security controls
Waterfall Development
software development methodology that breaks down development activities into linear
sequential phases; each phase depends on the deliverables of the previous one and
corresponds to a specialization of tasks
Waterfall Phases (typical)
plan -> build -> test -> review -> deploy
Iterative Waterfall Development
each phase of a project is broken down into its own waterfall phases
Agile Development
software development methodology that delivers functionality in rapid iterations
called timeboxes, requiring limited planning but frequent communication. Mizes
traditional and new software development practices.
Scrum
framework for Agile that prescribes for teams to break work into goals to be completed
within sprints
flexible, holistic product development strategy where a development team works as a
unit to reach a common goal
Scrum Master (Scrum Role)
responsible for ensuring a Scrum team is operating as effectively as possible by
keeping the team on track, planning and leading meetings, and working out any
obstacles the team might face
Product Owner (Scrum Role)
ensures the Scrum team aligns with overall product goals by managing the product
backlog by ordering work by priority, setting the product vision for the team, and
communicating with external stakeholders to translate their needs to the team
Development Team (Scrum Role)
professionals who do the hands-on work of completing the tasks in a Scrum sprint by
lending their expertise to program, design, or improve products
Lean Development
software development methodology that focuses on further isolating risk to the level of
an individual feature
V-Model
a variation of the waterfall model, where the stage is turned back upwards after the
coding phase
Extreme Programming (XP)
an Agile methodology that is intended to improve software quality and responsiveness
Software Security Architect (SSA)
, ensures that the stakeholder security requirements necessary to protect the
organization's mission and business processes are adequately addressed
Software Security Champion (SSC)
an expert on promoting security awareness, best practices, and simplifying software
security
Software Security Evangelist (SSE)
an expert to promote awareness of products to the wider software community
Functional Requirements
describe what the system will do and its core purpose
Non-Functional Requirements
describe any constraints or restrictions on a design but do not impact the core purpose
of the system
Privacy Impact Assessment
process that evaluates issues and privacy impact rating in relation to the privacy of PII
in the software
Product Risk Profile
helps to determine the actual cost of the product from different perspectives
Requirement Traceability Matrix
a table that lists all of the security requirements
Threat Profile
environment in which the product will operate and potential threats in that environment
DREAD model
damage, reproducibility, exploitability, affected users, discoverability
PASTA
the process for attack simulation and threat analysis; gives a software security team a
repeatable framework for identifying threats
STRIDE
classifies threats into categories: spoofing, tampering, repudiation, information
disclosed, denial of service, and elevation of privilege
Spoofing
illegally accessing and using another user's credentials
Tampering
maliciously changing or modifying persistent data
Denial of Service
Denying access to valid users
Elevation of Privilege
privileged access to resources for gaining unauthorized access to information
Information Disclosure
Read a file that one was not granted access too
Repudiation
performing illegal operations in a system that lacks the ability to trace the prohibited
operations
Software Security Policy
defines what needs to be protected and how it will be protected
Risk Model
assess vulnerabilities during the software development process
