1
WGU D487 SECURE SOFTWARE DESIGN ACTUAL EXAM 2026 |
Versions A & B | Complete Accurate Questions with Detailed
Verified Answers | Already Graded A+ | Pass Guaranteed
VERSION A - 60 QUESTIONS - ALREADY GRADED A+
A1: Secure Design Fundamentals & Threat Modeling (STRIDE, DREAD, PASTA) -
Q1-15
Q1. A development team is threat modeling a web application's authentication
subsystem using STRIDE. The team identifies that an attacker could intercept and replay
a valid authentication token to gain unauthorized access. Which STRIDE category best
describes this threat?
A. Spoofing
B. Tampering
C. Repudiation
D. Information Disclosure
Correct Answer: A. Spoofing [CORRECT]
Rationale: Replay attacks using intercepted tokens constitute spoofing because the
attacker impersonates a legitimate user by presenting a valid credential; tampering
involves unauthorized modification of data, repudiation involves denial of actions, and
information disclosure involves unauthorized data access rather than identity
impersonation.
Correct Answer: A
Q2. During a PASTA (Process for Attack Simulation and Threat Analysis) engagement,
the team has completed Stage 1 (Business Objective Definition) and Stage 2 (Technical
Scope Definition). Which activity is performed in Stage 3?
A. Prioritization of risks based on business impact
B. Application decomposition and identification of application controls
,2
C. Vulnerability and weakness analysis mapping threats to vulnerabilities
D. Attack simulation and residual risk analysis
Correct Answer: B. Application decomposition and identification of application
controls [CORRECT]
Rationale: PASTA Stage 3 (Application Decomposition) involves breaking down the
application architecture, identifying data flows, trust boundaries, and existing security
controls; risk prioritization occurs in Stage 5, vulnerability mapping in Stage 4, and
attack simulation in Stage 6.
Correct Answer: B
Q3. A team uses DREAD to score a cross-site scripting (XSS) vulnerability in a banking
application. The damage potential is rated 3 (high), reproducibility 3 (high),
exploitability 2 (medium), affected users 3 (high), and discoverability 3 (high). What is
the DREAD score, and what risk level does it indicate?
A. 14; low risk
B. 14; medium risk
C. 14; high risk
D. 15; critical risk
Correct Answer: C. 14; high risk [CORRECT]
Rationale: DREAD score = (3 + 3 + 2 + 3 + 3) = 14; the scale is 5–25, with 5–7 low, 8–11
medium, 12–15 high, and 16–25 critical; a score of 14 falls in the high-risk category due
to significant damage potential, broad user impact, and high discoverability.
Correct Answer: C
Q4. Which NIST SP 800-160 Vol. 1 security design principle requires that a system
should not reveal more information than necessary to perform its function, and that
information should be protected at all points where it exists?
,3
A. Least privilege
B. Defense in depth
C. Least common mechanism
D. Complete mediation
Correct Answer: B. Defense in depth [CORRECT]
Rationale: Defense in depth requires multiple overlapping security controls at every
layer and state where information exists, ensuring no single point of failure; least
privilege restricts access rights to minimum necessary, least common mechanism
minimizes shared resources, and complete mediation ensures every access is checked
against authorization policy.
Correct Answer: B
Q5. In STRIDE-per-element threat modeling, an attacker modifies a REST API request in
transit to change the amount field in a payment transaction. Which STRIDE category
applies, and which mitigation control is most appropriate?
A. Spoofing; implement mutual TLS authentication
B. Tampering; implement message integrity verification with HMAC or digital
signatures
C. Repudiation; implement comprehensive audit logging
D. Denial of Service; implement rate limiting
Correct Answer: B. Tampering; implement message integrity verification with
HMAC or digital signatures [CORRECT]
Rationale: Modifying data in transit is tampering, which is mitigated by cryptographic
integrity mechanisms such as HMAC or digital signatures; mutual TLS addresses
spoofing, audit logging addresses repudiation, and rate limiting addresses denial of
service, none of which match the described threat.
Correct Answer: B
, 4
Q6. A development team is applying the principle of "fail secure" to a biometric access
control system. Which design decision best exemplifies this principle?
A. If the biometric scanner loses power, all doors unlock to allow emergency egress
B. If the biometric scanner loses power, all doors remain locked and require physical
key override for emergency access
C. If the biometric scanner fails, the system defaults to no authentication required
D. If the biometric scanner fails, the system logs the failure but continues normal
operation
Correct Answer: B. If the biometric scanner loses power, all doors remain locked
and require physical key override for emergency access [CORRECT]
Rationale: Fail secure means the system defaults to a secure state upon failure;
remaining locked with controlled physical key override maintains security while
providing emergency access, whereas unlocking doors or bypassing authentication
creates unauthorized access opportunities.
Correct Answer: B
Q7. Which activity is performed during Stage 5 (Risk & Impact Analysis) of the PASTA
threat modeling methodology?
A. Mapping attack patterns to application components
B. Calculating risk scores using likelihood × impact and prioritizing threats for
mitigation
C. Decomposing the application into data flows and trust boundaries
D. Simulating attacks to validate control effectiveness
Correct Answer: B. Calculating risk scores using likelihood × impact and
prioritizing threats for mitigation [CORRECT]
Rationale: PASTA Stage 5 quantifies and prioritizes risks using likelihood and impact
calculations to guide resource allocation; attack pattern mapping occurs in Stage 4,
application decomposition in Stage 3, and attack simulation in Stage 6.
Correct Answer: B
WGU D487 SECURE SOFTWARE DESIGN ACTUAL EXAM 2026 |
Versions A & B | Complete Accurate Questions with Detailed
Verified Answers | Already Graded A+ | Pass Guaranteed
VERSION A - 60 QUESTIONS - ALREADY GRADED A+
A1: Secure Design Fundamentals & Threat Modeling (STRIDE, DREAD, PASTA) -
Q1-15
Q1. A development team is threat modeling a web application's authentication
subsystem using STRIDE. The team identifies that an attacker could intercept and replay
a valid authentication token to gain unauthorized access. Which STRIDE category best
describes this threat?
A. Spoofing
B. Tampering
C. Repudiation
D. Information Disclosure
Correct Answer: A. Spoofing [CORRECT]
Rationale: Replay attacks using intercepted tokens constitute spoofing because the
attacker impersonates a legitimate user by presenting a valid credential; tampering
involves unauthorized modification of data, repudiation involves denial of actions, and
information disclosure involves unauthorized data access rather than identity
impersonation.
Correct Answer: A
Q2. During a PASTA (Process for Attack Simulation and Threat Analysis) engagement,
the team has completed Stage 1 (Business Objective Definition) and Stage 2 (Technical
Scope Definition). Which activity is performed in Stage 3?
A. Prioritization of risks based on business impact
B. Application decomposition and identification of application controls
,2
C. Vulnerability and weakness analysis mapping threats to vulnerabilities
D. Attack simulation and residual risk analysis
Correct Answer: B. Application decomposition and identification of application
controls [CORRECT]
Rationale: PASTA Stage 3 (Application Decomposition) involves breaking down the
application architecture, identifying data flows, trust boundaries, and existing security
controls; risk prioritization occurs in Stage 5, vulnerability mapping in Stage 4, and
attack simulation in Stage 6.
Correct Answer: B
Q3. A team uses DREAD to score a cross-site scripting (XSS) vulnerability in a banking
application. The damage potential is rated 3 (high), reproducibility 3 (high),
exploitability 2 (medium), affected users 3 (high), and discoverability 3 (high). What is
the DREAD score, and what risk level does it indicate?
A. 14; low risk
B. 14; medium risk
C. 14; high risk
D. 15; critical risk
Correct Answer: C. 14; high risk [CORRECT]
Rationale: DREAD score = (3 + 3 + 2 + 3 + 3) = 14; the scale is 5–25, with 5–7 low, 8–11
medium, 12–15 high, and 16–25 critical; a score of 14 falls in the high-risk category due
to significant damage potential, broad user impact, and high discoverability.
Correct Answer: C
Q4. Which NIST SP 800-160 Vol. 1 security design principle requires that a system
should not reveal more information than necessary to perform its function, and that
information should be protected at all points where it exists?
,3
A. Least privilege
B. Defense in depth
C. Least common mechanism
D. Complete mediation
Correct Answer: B. Defense in depth [CORRECT]
Rationale: Defense in depth requires multiple overlapping security controls at every
layer and state where information exists, ensuring no single point of failure; least
privilege restricts access rights to minimum necessary, least common mechanism
minimizes shared resources, and complete mediation ensures every access is checked
against authorization policy.
Correct Answer: B
Q5. In STRIDE-per-element threat modeling, an attacker modifies a REST API request in
transit to change the amount field in a payment transaction. Which STRIDE category
applies, and which mitigation control is most appropriate?
A. Spoofing; implement mutual TLS authentication
B. Tampering; implement message integrity verification with HMAC or digital
signatures
C. Repudiation; implement comprehensive audit logging
D. Denial of Service; implement rate limiting
Correct Answer: B. Tampering; implement message integrity verification with
HMAC or digital signatures [CORRECT]
Rationale: Modifying data in transit is tampering, which is mitigated by cryptographic
integrity mechanisms such as HMAC or digital signatures; mutual TLS addresses
spoofing, audit logging addresses repudiation, and rate limiting addresses denial of
service, none of which match the described threat.
Correct Answer: B
, 4
Q6. A development team is applying the principle of "fail secure" to a biometric access
control system. Which design decision best exemplifies this principle?
A. If the biometric scanner loses power, all doors unlock to allow emergency egress
B. If the biometric scanner loses power, all doors remain locked and require physical
key override for emergency access
C. If the biometric scanner fails, the system defaults to no authentication required
D. If the biometric scanner fails, the system logs the failure but continues normal
operation
Correct Answer: B. If the biometric scanner loses power, all doors remain locked
and require physical key override for emergency access [CORRECT]
Rationale: Fail secure means the system defaults to a secure state upon failure;
remaining locked with controlled physical key override maintains security while
providing emergency access, whereas unlocking doors or bypassing authentication
creates unauthorized access opportunities.
Correct Answer: B
Q7. Which activity is performed during Stage 5 (Risk & Impact Analysis) of the PASTA
threat modeling methodology?
A. Mapping attack patterns to application components
B. Calculating risk scores using likelihood × impact and prioritizing threats for
mitigation
C. Decomposing the application into data flows and trust boundaries
D. Simulating attacks to validate control effectiveness
Correct Answer: B. Calculating risk scores using likelihood × impact and
prioritizing threats for mitigation [CORRECT]
Rationale: PASTA Stage 5 quantifies and prioritizes risks using likelihood and impact
calculations to guide resource allocation; attack pattern mapping occurs in Stage 4,
application decomposition in Stage 3, and attack simulation in Stage 6.
Correct Answer: B
