WGU D486 GOVERNANCE RISK AND
COMPLIANCE FINAL TEST 2026
QUESTIONS WITH CORRECT ANSWERS
GRADED A+
◍ How should an organization remediate databases installed with default
security settings?.
Answer: Ensure default accounts and passwords are disabled or removed
to prevent unauthorized access. Enforce strong authentication and
role-based access controls (RBAC). Regularly review and harden database
security settings.
◍ What is a Risk mitigation plan in A2 Architecture?.
Answer: A plan to mitigate, accept, or tolerate risk within the system.
◍ What does a Design security review focus on in A3 Design &
Development?.
Answer: It includes modifications to the design of software components
based on security assessments.
◍ How can static analysis help identify SQL injection vulnerabilities?.
Answer: Static analysis can detect SQL injection vulnerabilities by
analyzing the source code for patterns where user input is directly used in
queries without validation.Injection vulnerabilities remain a top OWASP
Top 10 issue and should be mitigated by using parameterized queries and
input validation.
◍ When must software code go through the SDL process again?.
Answer: When there is a new use of the software or an architectural change
to the code post-release.
,◍ What is the purpose of authentication in security design?.
Answer: Authentication ensures that users, systems, APIs, or components
are legitimate before granting access to services or functionality.
◍ What is a One-Time Requirement in Agile SDL?.
Answer: Security tasks implemented once and not repeated in every
sprint. Examples: Setting up secure build pipelines, configuring
encryption policies. Provides long-term foundational security.
◍ Why are Data Flow Diagrams (DFDs) critical in the threat modeling
process?.
Answer: They provide a visual representation of how data moves through
the software solution, clarifying the underlying architecture and processes.
By focusing on data flow (not just code flow), DFDs help identify potential
vulnerabilities at each step of data handling.
◍ What does PSIRT stand for in the context of software security?.
Answer: Product Security Incident Response Team
◍ Security team members have been instructed to document which developers
and analysts will perform product testing and which tools they will use.
Which step of the security test plan is being performed?.
Answer: Identify internal resources
◍ Core Activities in OpenSAMM.
Answer: Governance – Security policy, compliance, and
strategy.Construction – Security requirements, architecture, and
design.Verification – Code review, security testing, and
assurance.Deployment – Secure deployment, vulnerability management.
◍ Why is input validation critical in software security?.
Answer: All user input should be considered untrusted and must be validated
before being used to prevent injection attacks and other exploits.
◍ What is a countermeasure to the web application security frame (ASF)
configuration management threat category?.
, Answer: Service accounts have no administration capabilities.
◍ Code review actually happens in the ?.
Answer: In A4 (Design & Development), security testing activities
◍ What is the first step in the PSIRT case-handling process?.
Answer: Notification of vulnerability is received from an individual
discoverer or organization.
◍ Which secure coding best practice says that all information passed to other
systems should be encrypted?.
Answer: Communication SecurityExplanation:Encryption in transit protects
data from eavesdropping and man-in-the-middle (MITM) attacks.Secure
communication protocols like TLS (Transport Layer Security) and HTTPS
ensure confidentiality and integrity.End-to-end encryption prevents
unauthorized access during data exchange between systems.
◍ What is the role of Policy Compliance Analysis in the Ship (A5) phase of
SDL?.
Answer: Ensures security and privacy risks are reviewed in each SDL
phase. Updates policies based on new threats and best practices.
Standardizes compliance requirements across different project types.
Defines quality gates that must be met before software release.Final Policy
Compliance Analysis:Verifies policies align with development criteria (e.g.,
product type, platform, code).Confirms security controls meet
organizational and regulatory standards before release.
◍ What is the next step after the PSIRT determines a vulnerability is credible
and high severity?.
Answer: Identify resources and schedule the fix
◍ What is the Building Security In Maturity Model (BSIMM)?.
Answer: BSIMM is a data-driven model that evaluates and benchmarks
software security initiatives (SSIs) in organizations based on observed
practices from multiple companies. It helps organizations assess their
security maturity by comparing their security programs to industry leaders.
COMPLIANCE FINAL TEST 2026
QUESTIONS WITH CORRECT ANSWERS
GRADED A+
◍ How should an organization remediate databases installed with default
security settings?.
Answer: Ensure default accounts and passwords are disabled or removed
to prevent unauthorized access. Enforce strong authentication and
role-based access controls (RBAC). Regularly review and harden database
security settings.
◍ What is a Risk mitigation plan in A2 Architecture?.
Answer: A plan to mitigate, accept, or tolerate risk within the system.
◍ What does a Design security review focus on in A3 Design &
Development?.
Answer: It includes modifications to the design of software components
based on security assessments.
◍ How can static analysis help identify SQL injection vulnerabilities?.
Answer: Static analysis can detect SQL injection vulnerabilities by
analyzing the source code for patterns where user input is directly used in
queries without validation.Injection vulnerabilities remain a top OWASP
Top 10 issue and should be mitigated by using parameterized queries and
input validation.
◍ When must software code go through the SDL process again?.
Answer: When there is a new use of the software or an architectural change
to the code post-release.
,◍ What is the purpose of authentication in security design?.
Answer: Authentication ensures that users, systems, APIs, or components
are legitimate before granting access to services or functionality.
◍ What is a One-Time Requirement in Agile SDL?.
Answer: Security tasks implemented once and not repeated in every
sprint. Examples: Setting up secure build pipelines, configuring
encryption policies. Provides long-term foundational security.
◍ Why are Data Flow Diagrams (DFDs) critical in the threat modeling
process?.
Answer: They provide a visual representation of how data moves through
the software solution, clarifying the underlying architecture and processes.
By focusing on data flow (not just code flow), DFDs help identify potential
vulnerabilities at each step of data handling.
◍ What does PSIRT stand for in the context of software security?.
Answer: Product Security Incident Response Team
◍ Security team members have been instructed to document which developers
and analysts will perform product testing and which tools they will use.
Which step of the security test plan is being performed?.
Answer: Identify internal resources
◍ Core Activities in OpenSAMM.
Answer: Governance – Security policy, compliance, and
strategy.Construction – Security requirements, architecture, and
design.Verification – Code review, security testing, and
assurance.Deployment – Secure deployment, vulnerability management.
◍ Why is input validation critical in software security?.
Answer: All user input should be considered untrusted and must be validated
before being used to prevent injection attacks and other exploits.
◍ What is a countermeasure to the web application security frame (ASF)
configuration management threat category?.
, Answer: Service accounts have no administration capabilities.
◍ Code review actually happens in the ?.
Answer: In A4 (Design & Development), security testing activities
◍ What is the first step in the PSIRT case-handling process?.
Answer: Notification of vulnerability is received from an individual
discoverer or organization.
◍ Which secure coding best practice says that all information passed to other
systems should be encrypted?.
Answer: Communication SecurityExplanation:Encryption in transit protects
data from eavesdropping and man-in-the-middle (MITM) attacks.Secure
communication protocols like TLS (Transport Layer Security) and HTTPS
ensure confidentiality and integrity.End-to-end encryption prevents
unauthorized access during data exchange between systems.
◍ What is the role of Policy Compliance Analysis in the Ship (A5) phase of
SDL?.
Answer: Ensures security and privacy risks are reviewed in each SDL
phase. Updates policies based on new threats and best practices.
Standardizes compliance requirements across different project types.
Defines quality gates that must be met before software release.Final Policy
Compliance Analysis:Verifies policies align with development criteria (e.g.,
product type, platform, code).Confirms security controls meet
organizational and regulatory standards before release.
◍ What is the next step after the PSIRT determines a vulnerability is credible
and high severity?.
Answer: Identify resources and schedule the fix
◍ What is the Building Security In Maturity Model (BSIMM)?.
Answer: BSIMM is a data-driven model that evaluates and benchmarks
software security initiatives (SSIs) in organizations based on observed
practices from multiple companies. It helps organizations assess their
security maturity by comparing their security programs to industry leaders.
