WGU D487 – Secure Software Design OA Exam Prep | Complete
Exam Questions with Verified Correct Answers and Detailed
Explanations – Latest Update 2026/2027 | Graded A+
Question 1
Which secure software design principle requires that security decisions
should be simple enough that users do not need extensive security knowledge
to operate the system?
A. Least Privilege
B. Psychological Acceptability
C. Open Design
D. Complete Mediation
✅ Correct Answer: B. Psychological Acceptability
Explanation:
Psychological acceptability means security mechanisms should be easy to
understand and use. If security controls are too complex, users may attempt to
bypass them.
Question 2
A development team integrates security activities throughout requirements,
design, coding, testing, deployment, and maintenance phases. Which approach
is being used?
A. Waterfall Model
B. Security Development Lifecycle (SDL)
C. Rapid Application Development
D. Prototype Model
✅ Correct Answer: B. Security Development Lifecycle (SDL)
pg. 1
,Explanation:
The SDL embeds security into every phase of software development instead of
adding security after development is complete.
Question 3
Which security principle assumes that attackers know the system design but
security depends on protected keys and credentials?
A. Security Through Obscurity
B. Open Design
C. Fail-Safe Defaults
D. Separation of Duties
✅ Correct Answer: B. Open Design
Explanation:
Open Design follows the idea that systems should remain secure even when
the design is publicly known.
Question 4
A developer removes unnecessary administrator privileges from an
application account. Which security principle is being applied?
A. Least Privilege
B. Defense in Depth
C. Open Design
D. Psychological Acceptability
✅ Correct Answer: A. Least Privilege
Explanation:
Least privilege gives users and processes only the permissions required to
perform their tasks.
pg. 2
,Question 5
Which activity identifies potential threats, attack paths, and vulnerabilities
before software development begins?
A. Code Refactoring
B. Threat Modeling
C. Unit Testing
D. Performance Testing
✅ Correct Answer: B. Threat Modeling
Explanation:
Threat modeling helps developers identify security risks early and design
appropriate controls.
Question 6
A company uses multiple security layers including encryption, authentication,
firewalls, and monitoring. Which principle does this represent?
A. Defense in Depth
B. Single Sign-On
C. Data Minimization
D. Separation of Duties
✅ Correct Answer: A. Defense in Depth
Explanation:
Defense in depth uses multiple security controls so failure of one control does
not compromise the entire system.
Question 7
Which type of security testing examines source code without executing the
application?
pg. 3
, A. Dynamic Application Security Testing (DAST)
B. Static Application Security Testing (SAST)
C. Penetration Testing
D. User Acceptance Testing
✅ Correct Answer: B. Static Application Security Testing (SAST)
Explanation:
SAST analyzes source code for vulnerabilities before the application runs.
Question 8
A vulnerability allows an attacker to insert malicious SQL commands into an
application input field. What type of attack is this?
A. Cross-Site Request Forgery
B. SQL Injection
C. Buffer Overflow
D. Privilege Escalation
✅ Correct Answer: B. SQL Injection
Explanation:
SQL injection occurs when untrusted input is improperly handled and
modifies database queries.
Question 9
Which security goal ensures information is protected from unauthorized
disclosure?
A. Integrity
B. Availability
C. Confidentiality
D. Authentication
✅ Correct Answer: C. Confidentiality
pg. 4
Exam Questions with Verified Correct Answers and Detailed
Explanations – Latest Update 2026/2027 | Graded A+
Question 1
Which secure software design principle requires that security decisions
should be simple enough that users do not need extensive security knowledge
to operate the system?
A. Least Privilege
B. Psychological Acceptability
C. Open Design
D. Complete Mediation
✅ Correct Answer: B. Psychological Acceptability
Explanation:
Psychological acceptability means security mechanisms should be easy to
understand and use. If security controls are too complex, users may attempt to
bypass them.
Question 2
A development team integrates security activities throughout requirements,
design, coding, testing, deployment, and maintenance phases. Which approach
is being used?
A. Waterfall Model
B. Security Development Lifecycle (SDL)
C. Rapid Application Development
D. Prototype Model
✅ Correct Answer: B. Security Development Lifecycle (SDL)
pg. 1
,Explanation:
The SDL embeds security into every phase of software development instead of
adding security after development is complete.
Question 3
Which security principle assumes that attackers know the system design but
security depends on protected keys and credentials?
A. Security Through Obscurity
B. Open Design
C. Fail-Safe Defaults
D. Separation of Duties
✅ Correct Answer: B. Open Design
Explanation:
Open Design follows the idea that systems should remain secure even when
the design is publicly known.
Question 4
A developer removes unnecessary administrator privileges from an
application account. Which security principle is being applied?
A. Least Privilege
B. Defense in Depth
C. Open Design
D. Psychological Acceptability
✅ Correct Answer: A. Least Privilege
Explanation:
Least privilege gives users and processes only the permissions required to
perform their tasks.
pg. 2
,Question 5
Which activity identifies potential threats, attack paths, and vulnerabilities
before software development begins?
A. Code Refactoring
B. Threat Modeling
C. Unit Testing
D. Performance Testing
✅ Correct Answer: B. Threat Modeling
Explanation:
Threat modeling helps developers identify security risks early and design
appropriate controls.
Question 6
A company uses multiple security layers including encryption, authentication,
firewalls, and monitoring. Which principle does this represent?
A. Defense in Depth
B. Single Sign-On
C. Data Minimization
D. Separation of Duties
✅ Correct Answer: A. Defense in Depth
Explanation:
Defense in depth uses multiple security controls so failure of one control does
not compromise the entire system.
Question 7
Which type of security testing examines source code without executing the
application?
pg. 3
, A. Dynamic Application Security Testing (DAST)
B. Static Application Security Testing (SAST)
C. Penetration Testing
D. User Acceptance Testing
✅ Correct Answer: B. Static Application Security Testing (SAST)
Explanation:
SAST analyzes source code for vulnerabilities before the application runs.
Question 8
A vulnerability allows an attacker to insert malicious SQL commands into an
application input field. What type of attack is this?
A. Cross-Site Request Forgery
B. SQL Injection
C. Buffer Overflow
D. Privilege Escalation
✅ Correct Answer: B. SQL Injection
Explanation:
SQL injection occurs when untrusted input is improperly handled and
modifies database queries.
Question 9
Which security goal ensures information is protected from unauthorized
disclosure?
A. Integrity
B. Availability
C. Confidentiality
D. Authentication
✅ Correct Answer: C. Confidentiality
pg. 4
