WGU D487 SECURE SOFTWARE DESIGN OBJECTIVE
ASSESSMENT (OA) EXAM BANK VERIFIED QUESTIONS WITH
EXPERT RATIONALES LATEST 2026 UPDATE |
ACCURATE & VERIFIED
SECTION 1: SECURE SOFTWARE DEVELOPMENT LIFECYCLE (SDLC) (Questions 1–50)
Q1. The ______ report should provide progress against privacy requirements
provided in earlier phases and note any new laws/regulations to roadmap.
A. Security Testing Report
B. Privacy Compliance Report
C. Remediation Dashboard
D. Final Privacy Review
Correct Answer: B
Rationale: The Privacy Compliance Report tracks progress against earlier privacy
requirements and documents any new laws or regulations that may impact the
software development roadmap[reference:0].
Q2. A findings summary should be prepared for manual code review,
static/dynamic
analysis, pen testing, and fuzzing. These are:
A. Remediation Reports
B. Final Security Reviews
C. Security Testing Reports
D. Metrics Templates
Correct Answer: C
Rationale: Security Testing Reports summarize the findings from various testing
methods including manual code review, static/dynamic analysis, penetration
1
,testing, and fuzzing[reference:1].
Q3. A ______ report/dashboard should be prepared and updated to show
technical
security posture and risk.
A. Security Metrics
B. Compliance Dashboard
C. Remediation Dashboard
D. Threat Modeling Report
Correct Answer: C
Rationale: A Remediation Dashboard is prepared and updated to show the
current
technical security posture and risk levels, tracking progress on identified
vulnerabilities[reference:2].
Q4. What is the primary goal of secure software design?
A) To enhance user experience
B) To mitigate security risks throughout the software lifecycle
C) To reduce development time
D) To comply with regulatory requirements
Correct Answer: B
Rationale: The primary goal of secure software design is to mitigate security
risks throughout the software development lifecycle by building security into
the design from the outset[reference:3][reference:4].
Q5. Which SDLC phase is most critical for integrating security?
2
,A) Testing
B) Requirements gathering
C) Deployment
D) Maintenance
Correct Answer: B
Rationale: Early integration in the requirements phase ensures security is built
into the software from the beginning. Addressing security in requirements is
far more cost-effective than fixing vulnerabilities later[reference:5].
Q6. What is the primary benefit of performing security reviews early in the
SDLC?
A) Reduced development time
B) Lower cost of fixing vulnerabilities
C) Increased code complexity
D) Fewer developers needed
Correct Answer: B
Rationale: Identifying and fixing vulnerabilities early in the SDLC is
significantly less expensive than fixing them later[reference:6].
Q7. Which of the following is a key deliverable in the Security Development
Lifecycle (SDL)?
A) User Interface Design Document
B) Privacy Compliance Report
C) Marketing Strategy
D) Project Budget
3
, Correct Answer: B
Rationale: The Privacy Compliance Report is a key SDL deliverable that tracks
progress against privacy requirements[reference:7].
Q8. In the Ship (A5) phase of the security development cycle, the team must
verify that all security mandates have been met before release. This activity is
best described as:
A) Vulnerability scanning
B) Code-assisted penetration testing
C) Open-source licensing review
D) A5 policy compliance analysis
Correct Answer: D
Rationale: A5 policy compliance analysis ensures that all security mandates and
compliance activities have been met at each SDL phase before
release[reference:8].
Q9. During which phase of the SDLC should threat modeling be performed?
A) Deployment
B) Maintenance
C) Design
D) Testing
Correct Answer: C
Rationale: Threat modeling should be performed during the design phase to
identify potential security threats and vulnerabilities early when they are
easier and cheaper to address[reference:9].
4
ASSESSMENT (OA) EXAM BANK VERIFIED QUESTIONS WITH
EXPERT RATIONALES LATEST 2026 UPDATE |
ACCURATE & VERIFIED
SECTION 1: SECURE SOFTWARE DEVELOPMENT LIFECYCLE (SDLC) (Questions 1–50)
Q1. The ______ report should provide progress against privacy requirements
provided in earlier phases and note any new laws/regulations to roadmap.
A. Security Testing Report
B. Privacy Compliance Report
C. Remediation Dashboard
D. Final Privacy Review
Correct Answer: B
Rationale: The Privacy Compliance Report tracks progress against earlier privacy
requirements and documents any new laws or regulations that may impact the
software development roadmap[reference:0].
Q2. A findings summary should be prepared for manual code review,
static/dynamic
analysis, pen testing, and fuzzing. These are:
A. Remediation Reports
B. Final Security Reviews
C. Security Testing Reports
D. Metrics Templates
Correct Answer: C
Rationale: Security Testing Reports summarize the findings from various testing
methods including manual code review, static/dynamic analysis, penetration
1
,testing, and fuzzing[reference:1].
Q3. A ______ report/dashboard should be prepared and updated to show
technical
security posture and risk.
A. Security Metrics
B. Compliance Dashboard
C. Remediation Dashboard
D. Threat Modeling Report
Correct Answer: C
Rationale: A Remediation Dashboard is prepared and updated to show the
current
technical security posture and risk levels, tracking progress on identified
vulnerabilities[reference:2].
Q4. What is the primary goal of secure software design?
A) To enhance user experience
B) To mitigate security risks throughout the software lifecycle
C) To reduce development time
D) To comply with regulatory requirements
Correct Answer: B
Rationale: The primary goal of secure software design is to mitigate security
risks throughout the software development lifecycle by building security into
the design from the outset[reference:3][reference:4].
Q5. Which SDLC phase is most critical for integrating security?
2
,A) Testing
B) Requirements gathering
C) Deployment
D) Maintenance
Correct Answer: B
Rationale: Early integration in the requirements phase ensures security is built
into the software from the beginning. Addressing security in requirements is
far more cost-effective than fixing vulnerabilities later[reference:5].
Q6. What is the primary benefit of performing security reviews early in the
SDLC?
A) Reduced development time
B) Lower cost of fixing vulnerabilities
C) Increased code complexity
D) Fewer developers needed
Correct Answer: B
Rationale: Identifying and fixing vulnerabilities early in the SDLC is
significantly less expensive than fixing them later[reference:6].
Q7. Which of the following is a key deliverable in the Security Development
Lifecycle (SDL)?
A) User Interface Design Document
B) Privacy Compliance Report
C) Marketing Strategy
D) Project Budget
3
, Correct Answer: B
Rationale: The Privacy Compliance Report is a key SDL deliverable that tracks
progress against privacy requirements[reference:7].
Q8. In the Ship (A5) phase of the security development cycle, the team must
verify that all security mandates have been met before release. This activity is
best described as:
A) Vulnerability scanning
B) Code-assisted penetration testing
C) Open-source licensing review
D) A5 policy compliance analysis
Correct Answer: D
Rationale: A5 policy compliance analysis ensures that all security mandates and
compliance activities have been met at each SDL phase before
release[reference:8].
Q9. During which phase of the SDLC should threat modeling be performed?
A) Deployment
B) Maintenance
C) Design
D) Testing
Correct Answer: C
Rationale: Threat modeling should be performed during the design phase to
identify potential security threats and vulnerabilities early when they are
easier and cheaper to address[reference:9].
4
