WGU D487 CERTIFICATION SCRIPT 2026
QUESTIONS WITH SOLUTIONS GRADED A+
◍ When a software application handles personally identifiable information
(PII) data, what will be the Privacy Impact Rating?.
Answer: P1: High privacy risk
◍ A potential threat was discovered during functional testing of a file upload
component when a QA analyst was allowed to upload a shell script. Users
should only be allowed to upload image files.How should existing security
controls be adjusted to prevent this in the future?.
Answer: Validate all user input
◍ After the developer is done coding a functionality, when should code review
be completed?.
Answer: Within hours or the same day
◍ Which shape indicates each type of flow diagram element? - Trust Boundry.
Answer: Dashed Line
◍ Which software security testing technique tests the software from an
external perspective?.
Answer: Black box
◍ What is the reason software security teams host discovery meetings with
stakeholders early in the development life cycle?.
Answer: To ensure that security is built into the product from the start
◍ The company's website uses querystring parameters to filter products by
category. The URL, when filtering on a product category, looks like this:
company.com/products?category=2.If the security team saw a URL of
company.com/products?category=2 OR 1=1 in the logs, what assumption
should they make?.
, Answer: An attacker is attempting to use SQL injection to gain access to
information.
◍ How can you establish your own SDL to build security into a process
appropriate for your organization's needs based on the given environments?
- Agile.
Answer: Iterative Development
◍ During penetration testing, an analyst discovered a DOM-based (document
object model) cross-site scripting vulnerability within the applications
search bar that could allow an attacker to insert malicious code. How should
the organization remediate this vulnerability?.
Answer: Enforce encoding of special characters
◍ Which type of requirement specifies that credit card numbers are designated
as highly sensitive confidential personal information?.
Answer: Data classification requirement
◍ A software security team member has created data flow diagrams, chosen
the STRIDE methodology to perform threat reviews, and created the
security assessment for the new product. Which category of secure software
best practices did the team member perform?.
Answer: Architecture analysis
◍ Which type of software testing is being performed when an analyst executes
a series of test cases based on application requirements?.
Answer: Functional testing
◍ When an application's input validation is not handled properly, it could
result in which kind of vulnerabilities?.
Answer: SQL injection, cross-site scripting
◍ Security team members have been instructed to document how many users
will access the new product and what roles those users will play. Which step
of the security test plan is being performed?.
Answer: Define the user community
, ◍ What is a non-system-related component in software security testing attack
surface validation?.
Answer: Users
◍ Which privacy impact statement requirement type defines how personal
information is protected on devices used by more than a single associate?.
Answer: Privacy control requirements
◍ Which person is responsible for designing, planning, and implementing
secure coding practices and security testing methodologies?.
Answer: Software security architect
◍ Which type of requirement specifies that file formats the application sends
to financial institutions must be certified every four years?.
Answer: Compliance requirement
◍ A security tester changed the application URL from
www.app.com/account?id='3' to www.app.com/account?id='3 or 1=1',
which returned a collection of account information. Database logs showed
that the query that was executed was SELECT * FROM ACCOUNTS
WHERE accountId=3 or 1=1.How should existing security controls be
adjusted to prevent this in the future?.
Answer: Ensure server-side queries are parameterized
◍ Which activity in the Ship (A5) phase of the security development cycle sets
requirements for quality gates that must be met before release?.
Answer: A5 policy compliance analysis
◍ Which software methodology resembles an assembly-line approach?.
Answer: Waterfall model
◍ Which shape indicates each type of flow diagram element? - Data Store.
Answer: Two Parallel horizontal lines
◍ Which design and development deliverable details the progress of personal
information requirements created in earlier phases of the security
development lifecycle?.
QUESTIONS WITH SOLUTIONS GRADED A+
◍ When a software application handles personally identifiable information
(PII) data, what will be the Privacy Impact Rating?.
Answer: P1: High privacy risk
◍ A potential threat was discovered during functional testing of a file upload
component when a QA analyst was allowed to upload a shell script. Users
should only be allowed to upload image files.How should existing security
controls be adjusted to prevent this in the future?.
Answer: Validate all user input
◍ After the developer is done coding a functionality, when should code review
be completed?.
Answer: Within hours or the same day
◍ Which shape indicates each type of flow diagram element? - Trust Boundry.
Answer: Dashed Line
◍ Which software security testing technique tests the software from an
external perspective?.
Answer: Black box
◍ What is the reason software security teams host discovery meetings with
stakeholders early in the development life cycle?.
Answer: To ensure that security is built into the product from the start
◍ The company's website uses querystring parameters to filter products by
category. The URL, when filtering on a product category, looks like this:
company.com/products?category=2.If the security team saw a URL of
company.com/products?category=2 OR 1=1 in the logs, what assumption
should they make?.
, Answer: An attacker is attempting to use SQL injection to gain access to
information.
◍ How can you establish your own SDL to build security into a process
appropriate for your organization's needs based on the given environments?
- Agile.
Answer: Iterative Development
◍ During penetration testing, an analyst discovered a DOM-based (document
object model) cross-site scripting vulnerability within the applications
search bar that could allow an attacker to insert malicious code. How should
the organization remediate this vulnerability?.
Answer: Enforce encoding of special characters
◍ Which type of requirement specifies that credit card numbers are designated
as highly sensitive confidential personal information?.
Answer: Data classification requirement
◍ A software security team member has created data flow diagrams, chosen
the STRIDE methodology to perform threat reviews, and created the
security assessment for the new product. Which category of secure software
best practices did the team member perform?.
Answer: Architecture analysis
◍ Which type of software testing is being performed when an analyst executes
a series of test cases based on application requirements?.
Answer: Functional testing
◍ When an application's input validation is not handled properly, it could
result in which kind of vulnerabilities?.
Answer: SQL injection, cross-site scripting
◍ Security team members have been instructed to document how many users
will access the new product and what roles those users will play. Which step
of the security test plan is being performed?.
Answer: Define the user community
, ◍ What is a non-system-related component in software security testing attack
surface validation?.
Answer: Users
◍ Which privacy impact statement requirement type defines how personal
information is protected on devices used by more than a single associate?.
Answer: Privacy control requirements
◍ Which person is responsible for designing, planning, and implementing
secure coding practices and security testing methodologies?.
Answer: Software security architect
◍ Which type of requirement specifies that file formats the application sends
to financial institutions must be certified every four years?.
Answer: Compliance requirement
◍ A security tester changed the application URL from
www.app.com/account?id='3' to www.app.com/account?id='3 or 1=1',
which returned a collection of account information. Database logs showed
that the query that was executed was SELECT * FROM ACCOUNTS
WHERE accountId=3 or 1=1.How should existing security controls be
adjusted to prevent this in the future?.
Answer: Ensure server-side queries are parameterized
◍ Which activity in the Ship (A5) phase of the security development cycle sets
requirements for quality gates that must be met before release?.
Answer: A5 policy compliance analysis
◍ Which software methodology resembles an assembly-line approach?.
Answer: Waterfall model
◍ Which shape indicates each type of flow diagram element? - Data Store.
Answer: Two Parallel horizontal lines
◍ Which design and development deliverable details the progress of personal
information requirements created in earlier phases of the security
development lifecycle?.
