WGU D487 Oa 2026 Test EXAM With 80 Questions And Correct Answers (100% Correct Verified Answers) WITH RATIONALES /D487 Secure Software Design Objective Assessment 2026

Page 1 of 18
01 June 2026

WGU D487 Oa 2026 Test EXAM With 80 Questions
And Correct Answers (100% Correct Verified
Answers) WITH RATIONALES /D487 Secure Software
Design Objective Assessment 2026

1. Which practice in the Ship (A5) phase verifies whether the product meets security mandates?

A. Vulnerability scan
B. A5 policy compliance analysis
C. Threat modeling
D. Code review

Correct Answer: B
Rationale: A5 policy compliance analysis ensures the product meets required security policies and
standards before release.



2. Which post-release support activity defines how to communicate and respond to
vulnerabilities?

A. Security architectural reviews
B. External vulnerability disclosure response (PRSA1)
C. Threat modeling
D. Penetration testing

Correct Answer: B
Rationale: PRSA1 defines communication and handling of externally discovered vulnerabilities.



3. What are two core practice areas of OpenSAMM?

A. Testing and Deployment
B. Governance and Construction
C. Coding and Debugging
D. Analysis and Reporting

Correct Answer: B
Rationale: OpenSAMM core areas include Governance, Construction, Verification, and Deployment.



4. Which Ship (A5) practice identifies weaknesses using tools?

A. Policy compliance analysis
B. Vulnerability scan
C. Architecture review
D. Threat modeling

, Page 2 of 18
01 June 2026

Correct Answer: B
Rationale: Vulnerability scanning uses automated tools to detect security weaknesses.



5. Which post-release activity is important during company mergers?

A. Penetration testing
B. Security architectural reviews
C. Code review
D. Threat modeling

Correct Answer: B
Rationale: Mergers require reviewing combined system architectures for security risks.



6. What is delivered during A5 policy compliance analysis?

A. Source code
B. Analyze activities and standards
C. Deployment scripts
D. User documentation

Correct Answer: B
Rationale: This phase validates activities against defined security standards.



7. What is produced in code-assisted penetration testing?

A. Threat model
B. White-box security testing results
C. Risk register
D. Policy document

Correct Answer: B
Rationale: Code-assisted penetration testing is white-box testing using internal knowledge.



8. What is produced in open-source licensing review?

A. Threat report
B. License compliance
C. Risk score
D. Bug report

Correct Answer: B
Rationale: Ensures legal compliance with third-party software licenses.



9. What is produced in the final security review?

, Page 3 of 18
01 June 2026

A. Release and ship decision
B. Code documentation
C. Architecture diagram
D. Vulnerability scan

Correct Answer: A
Rationale: Final review determines readiness for release.



10. How is SDL established in Agile?

A. Waterfall process
B. Iterative development
C. Manual review only
D. Ad-hoc testing

Correct Answer: B
Rationale: Agile SDL integrates security into iterative cycles.



11. How is SDL established in DevOps?

A. Manual deployment
B. Continuous integration and deployment
C. Quarterly testing
D. Static documentation

Correct Answer: B
Rationale: DevOps relies on CI/CD pipelines for continuous security integration.



12. SDL in cloud environments is based on:

A. Local servers
B. API invocation processes
C. Manual coding
D. Paper-based audits

Correct Answer: B
Rationale: Cloud systems rely heavily on APIs for operations and security controls.



13. SDL in digital enterprise focuses on:

A. Hardware repair
B. Business activity enhancement
C. Gaming systems
D. Manual scripting

Correct Answer: B
Rationale: Digital enterprise SDL improves business processes and systems.