WGU D487 Secure Software Design
Assessment 2026- Ultimate Exam Preparation
Guide | Practice Questions, Accurate Answers &
Detailed Solutions (Latest Update)
Description:
This study guide provides a complete set of practice questions
and verified answers to help students prepare effectively for
their exams. Each question is accompanied by a clear
explanation to support deeper understanding of the subject
matter. The structured format makes it easy to review important
concepts quickly while building confidence before the exam.
Privacy compliance report
Which design and development deliverable details the progress of personal information
requirements created in earlier phases of the security development lifecycle?
Updated threat modeling artifacts
Which design and development deliverable contains technical and executive-level
reports detailing any newly identified vulnerabilities?
C++
_______ is highly susceptible to buffer overflow vulnerabilities because it
allows direct memory access and pointer arithmetic without built-in safeguards like
bounds checking. This makes it a common target for memory corruption attacks.
Identify security code review objectives
What is the first step of the SDLC/SDL code review process?
Functional testing
Software testing performed when an analyst executes a series of test cases based on
application requirements.
Ensure server-side queries are parameterized
A method to adjust existing security controls to prevent SQL injection vulnerabilities.
Ensure third party libraries are kept up to date and reviewed consistently
A measure to adjust existing security controls after discovering a vulnerability in a third-
party logging tool.
Validate all user input
A security control adjustment to prevent unauthorized file uploads.
Remediation of database instances
,Addressing vulnerabilities discovered during an organizational security review of
multiple database instances installed with default settings.
Default accounts and passwords
Ensure default accounts and passwords are disabled or removed
Auditing and logging
Ensure auditing and logging is enabled on all servers
Access to configuration files
Ensure access to configuration files is limited to administrators
Server information exposure
Ensure servers are configured to return as little information as possible to network
requests
DOM-based cross-site scripting vulnerability
Enforce encoding of special characters
Data encryption in transit
Ensure all data is encrypted in transit
Audit trails for sensitive transactions
Ensure audit trails exist for all sensitive transactions
Principle of least privilege
Follow the principle of least privilege for user and system accounts
Simple hashes for passwords
Enforce the use of strong, salted hashing functions when storing passwords
Strong password complexity standards
Enforce strong password complexity standards
Regular password updates
Enforce regular password updates
Encryption on credentials in transit
Enforce encryption on credentials in transit
User privileges after exceptions
Ensure user privileges are restored to the appropriate level after exceptions
Centralized exception handling
Ensure exceptions are handled in a centralized, structured way
Error message sensitivity
Ensure error messages are scrubbed of any sensitive information
Audit log for sensitive transactions
Ensure there is an audit log for all sensitive transactions
Response to credible vulnerabilities
Identify resources and schedule the fix
Ownership of product vulnerabilities
Identify the team that owns the product
Customer notification of fixes
Notify customers that the fix is available
Vulnerability reporter analysis
Determine how the reporter was able to create the vulnerability
Security strategy for M&A products
Security strategy for M&A products
Post-release certifications
, Post-release certifications
Security strategy for legacy code
Security strategy for legacy code
Third-party security review
Third-party security review
RACI matrix for vulnerabilities
Creating a RACI matrix that will identify stakeholders by who is responsible,
accountable, consulted, and informed of any new vulnerabilities
External vulnerability disclosure response process
The process followed by the product security incident response team (PSIRT) after
determining a reported vulnerability was a credible claim, which includes working with
development teams to create and test a patch.
Notify customers that the fix is available
The next step for the response team after a patch has been created and tested.
Final security review
The activity where the security team determines that all security issues identified in
testing have been resolved and all SDL requirements have been met.
Passed
The result of the final security review when all security issues have been resolved.
Policy compliance analysis
The activity where the security team reviews whether new security requirements can be
implemented prior to releasing the new product.
Every-sprint requirement
A type of requirement that states all user input values must be validated by type, size,
and range.
Software security development life cycle (SSDL) touchpoints
The BSIMM domain being assessed when the software security group conducts a
maturity assessment focused on reviewing security testing results from recent
initiatives.
Final privacy review
An activity that may be performed during the Ship SDL phase to ensure compliance with
privacy requirements.
Penetration testing
An activity that involves testing the software product for vulnerabilities by simulating
attacks.
Vulnerability scan
An automated process to identify vulnerabilities in the software product.
Open-source licensing review
The process of reviewing open-source components for compliance with licensing
requirements.
Bucket requirement
A type of requirement that groups related security requirements together for better
management.
One-time requirement
A type of requirement that is only needed for a specific instance and not repeated in
future iterations.
Assessment 2026- Ultimate Exam Preparation
Guide | Practice Questions, Accurate Answers &
Detailed Solutions (Latest Update)
Description:
This study guide provides a complete set of practice questions
and verified answers to help students prepare effectively for
their exams. Each question is accompanied by a clear
explanation to support deeper understanding of the subject
matter. The structured format makes it easy to review important
concepts quickly while building confidence before the exam.
Privacy compliance report
Which design and development deliverable details the progress of personal information
requirements created in earlier phases of the security development lifecycle?
Updated threat modeling artifacts
Which design and development deliverable contains technical and executive-level
reports detailing any newly identified vulnerabilities?
C++
_______ is highly susceptible to buffer overflow vulnerabilities because it
allows direct memory access and pointer arithmetic without built-in safeguards like
bounds checking. This makes it a common target for memory corruption attacks.
Identify security code review objectives
What is the first step of the SDLC/SDL code review process?
Functional testing
Software testing performed when an analyst executes a series of test cases based on
application requirements.
Ensure server-side queries are parameterized
A method to adjust existing security controls to prevent SQL injection vulnerabilities.
Ensure third party libraries are kept up to date and reviewed consistently
A measure to adjust existing security controls after discovering a vulnerability in a third-
party logging tool.
Validate all user input
A security control adjustment to prevent unauthorized file uploads.
Remediation of database instances
,Addressing vulnerabilities discovered during an organizational security review of
multiple database instances installed with default settings.
Default accounts and passwords
Ensure default accounts and passwords are disabled or removed
Auditing and logging
Ensure auditing and logging is enabled on all servers
Access to configuration files
Ensure access to configuration files is limited to administrators
Server information exposure
Ensure servers are configured to return as little information as possible to network
requests
DOM-based cross-site scripting vulnerability
Enforce encoding of special characters
Data encryption in transit
Ensure all data is encrypted in transit
Audit trails for sensitive transactions
Ensure audit trails exist for all sensitive transactions
Principle of least privilege
Follow the principle of least privilege for user and system accounts
Simple hashes for passwords
Enforce the use of strong, salted hashing functions when storing passwords
Strong password complexity standards
Enforce strong password complexity standards
Regular password updates
Enforce regular password updates
Encryption on credentials in transit
Enforce encryption on credentials in transit
User privileges after exceptions
Ensure user privileges are restored to the appropriate level after exceptions
Centralized exception handling
Ensure exceptions are handled in a centralized, structured way
Error message sensitivity
Ensure error messages are scrubbed of any sensitive information
Audit log for sensitive transactions
Ensure there is an audit log for all sensitive transactions
Response to credible vulnerabilities
Identify resources and schedule the fix
Ownership of product vulnerabilities
Identify the team that owns the product
Customer notification of fixes
Notify customers that the fix is available
Vulnerability reporter analysis
Determine how the reporter was able to create the vulnerability
Security strategy for M&A products
Security strategy for M&A products
Post-release certifications
, Post-release certifications
Security strategy for legacy code
Security strategy for legacy code
Third-party security review
Third-party security review
RACI matrix for vulnerabilities
Creating a RACI matrix that will identify stakeholders by who is responsible,
accountable, consulted, and informed of any new vulnerabilities
External vulnerability disclosure response process
The process followed by the product security incident response team (PSIRT) after
determining a reported vulnerability was a credible claim, which includes working with
development teams to create and test a patch.
Notify customers that the fix is available
The next step for the response team after a patch has been created and tested.
Final security review
The activity where the security team determines that all security issues identified in
testing have been resolved and all SDL requirements have been met.
Passed
The result of the final security review when all security issues have been resolved.
Policy compliance analysis
The activity where the security team reviews whether new security requirements can be
implemented prior to releasing the new product.
Every-sprint requirement
A type of requirement that states all user input values must be validated by type, size,
and range.
Software security development life cycle (SSDL) touchpoints
The BSIMM domain being assessed when the software security group conducts a
maturity assessment focused on reviewing security testing results from recent
initiatives.
Final privacy review
An activity that may be performed during the Ship SDL phase to ensure compliance with
privacy requirements.
Penetration testing
An activity that involves testing the software product for vulnerabilities by simulating
attacks.
Vulnerability scan
An automated process to identify vulnerabilities in the software product.
Open-source licensing review
The process of reviewing open-source components for compliance with licensing
requirements.
Bucket requirement
A type of requirement that groups related security requirements together for better
management.
One-time requirement
A type of requirement that is only needed for a specific instance and not repeated in
future iterations.
