WGU D487 SECURE SW DESIGN OA EXAM
2026/2027/2028 Testing Cycle | Newly Released
80 Q & A with Expert, Verified Rationales.
Guaranteed Pass | Graded A+ | Complete Guide
Western Governors University- WGU
Q1. During the final pre-release validation cycle, a software team reviews the threat model to
confirm all identified risks have been mitigated or formally accepted, and updates the
architecture documentation to reflect any last-minute design changes before submitting for
deployment authorization. According to the Microsoft SDL, which phase includes this final
threat model review?
A. A4: Ship
B. A3: Design and Development
C. A2: Architecture
D. A5: Post-Release Support
Correct Answer: A
Rationale: Correct because the A4 Ship phase includes the final threat model review to validate
that all identified risks have been addressed, mitigated, or formally accepted before the product is
authorized for deployment. This final review ensures the threat model remains accurate and
complete as the product transitions from development to release. A2 involves initial threat
modeling, A3 focuses on development and interim testing, and A5 handles post-deployment
support.
Q2. A security engineer develops an automated harness that feeds millions of randomly
generated malformed HTTP requests with unexpected Unicode characters, oversized headers,
and invalid content types into a REST API gateway to trigger crashes and memory leaks. Which
security testing technique is being employed?
A. Dynamic Application Security Testing (DAST)
B. Static Application Security Testing (SAST)
C. Penetration Testing
D. Fuzzing
Correct Answer: D
Rationale: Correct because Fuzzing is a black-box testing technique that supplies unexpected,
malformed, or random data to application inputs to discover crashes, memory leaks, and security
vulnerabilities. The automated generation of malformed HTTP requests to identify unintended
,behavior is a classic fuzzing approach used during the A3 or A4 testing phases. DAST tests
running applications for operational flaws, SAST analyzes source code without execution, and
Penetration Testing simulates targeted adversarial attacks rather than automated random input
injection.
Q3. A cloud-native application assigns each containerized microservice a dedicated identity with
permissions strictly scoped to the specific cloud APIs and database tables that service requires to
perform its function. Which secure design principle does this architecture enforce?
A. Defense in Depth
B. Least Privilege
C. Economy of Mechanism
D. Complete Mediation
Correct Answer: B
Rationale: Correct because Least Privilege requires that every process, service, or user receive
only the minimum permissions necessary to perform its designated function, which is exactly
what dedicated service identities with scoped API access accomplish. This limits the blast radius
if a microservice is compromised by ensuring it cannot access resources beyond its operational
needs. Defense in Depth employs multiple security layers, Economy of Mechanism reduces
complexity, and Complete Mediation checks every access request.
Q4. A multinational bank participates in an annual industry study where its software security
initiatives are measured against empirical data collected from hundreds of peer financial
institutions to benchmark its maturity. Which maturity model provides this observational, data-
driven assessment?
A. OpenSAMM
B. OWASP SAMM
C. BSIMM
D. Microsoft SDL
Correct Answer: C
Rationale: Correct because the Building Security In Maturity Model (BSIMM) is an
observational framework that measures actual software security practices by analyzing real-
world data from participating organizations for benchmarking purposes. It describes what
companies are actually doing rather than prescribing what they should do, making it ideal for
comparative assessment against industry peers. OpenSAMM is prescriptive, OWASP SAMM
provides improvement roadmaps, and Microsoft SDL is a development lifecycle methodology.
Q5. A development team must choose between a proprietary cryptographic library with 60,000
lines of custom code and a standardized implementation using 6,000 lines of well-vetted FIPS-
certified modules. Which Saltzer and Schroeder principle supports selecting the smaller,
standardized implementation?
,A. Economy of Mechanism
B. Defense in Depth
C. Least Privilege
D. Open Design
Correct Answer: A
Rationale: Correct because Economy of Mechanism dictates that software designs should be
kept as simple and small as possible to minimize the attack surface and reduce opportunities for
bugs or exploits. Selecting the smaller implementation using well-vetted certified modules
reduces complexity and leverages proven security controls rather than introducing novel,
untested code. Defense in Depth employs multiple layers, Least Privilege restricts access rights,
and Open Design avoids security through obscurity.
Q6. A standard user in a project management portal discovers that modifying a hidden form field
from "role=employee" to "role=super_admin" grants unrestricted access to all project financials
without server-side authorization checks. Which STRIDE threat category does this represent?
A. Spoofing
B. Tampering
C. Information Disclosure
D. Elevation of Privilege
Correct Answer: D
Rationale: Correct because Elevation of Privilege is the STRIDE category describing
unauthorized acquisition of higher-level permissions, violating the authorization property.
Modifying a client-side parameter to gain administrative capabilities without proper server-side
validation is a direct example of privilege escalation. Spoofing involves identity impersonation,
Tampering involves unauthorized data modification, and Information Disclosure involves
unauthorized exposure of sensitive data.
Q7. Before releasing a healthcare analytics platform, the security team must formally
demonstrate that the product meets HIPAA privacy standards and EU GDPR data protection
requirements. Which A4 deliverable satisfies this regulatory need?
A. Security Test Execution Report
B. Privacy Compliance Report
C. Remediation Plan
D. Threat Model Documentation
Correct Answer: B
Rationale: Correct because the Privacy Compliance Report is the formal A4 Ship phase
deliverable that certifies the product meets applicable privacy standards and regulatory
requirements such as HIPAA and GDPR. This document is essential for the final sign-off and
readiness certification before deployment. The Security Test Execution Report is an interim A3
, deliverable, the Remediation Plan tracks findings resolution, and Threat Model Documentation is
primarily an A2 deliverable.
Q8. A security architect integrates an automated tool into the CI/CD pipeline that scans every
code commit for hardcoded secrets, buffer overflow vulnerabilities, and insecure cryptographic
patterns without compiling or executing the application. Which tool category is being used?
A. Dynamic Application Security Testing (DAST)
B. Interactive Application Security Testing (IAST)
C. Static Application Security Testing (SAST)
D. Web Application Firewall (WAF)
Correct Answer: C
Rationale: Correct because Static Application Security Testing (SAST) analyzes source code
without execution to identify coding flaws such as hardcoded credentials, buffer overflows, and
insecure cryptography. Integrating SAST into the CI/CD pipeline enables shift-left security by
detecting vulnerabilities early in the A3 Design and Development phase. DAST requires runtime
execution, IAST monitors during execution, and WAF provides runtime protection as a
compensating control.
Q9. An attacker sends emails impersonating the company's Chief Financial Officer to payroll
staff, requesting urgent wire transfers to a fraudulent offshore account. According to STRIDE,
which threat category is being demonstrated?
A. Spoofing
B. Tampering
C. Information Disclosure
D. Repudiation
Correct Answer: A
Rationale: Correct because Spoofing in the STRIDE framework represents impersonation of a
user, process, or device, violating the authenticity property. By impersonating the CFO to
deceive employees, the attacker is directly spoofing identity to facilitate fraud. Tampering
involves data modification, Information Disclosure involves unauthorized data access, and
Repudiation involves denying performed actions.
Q10. After completing static and dynamic analysis during the A3 and A4 phases, the security
team produces a formal document that assigns each vulnerability a priority rating, an owner, and
a target closure date. Which deliverable has been created?
A. Security Testing Report
B. Privacy Compliance Report
C. Security Test Execution Report
D. Remediation Report
2026/2027/2028 Testing Cycle | Newly Released
80 Q & A with Expert, Verified Rationales.
Guaranteed Pass | Graded A+ | Complete Guide
Western Governors University- WGU
Q1. During the final pre-release validation cycle, a software team reviews the threat model to
confirm all identified risks have been mitigated or formally accepted, and updates the
architecture documentation to reflect any last-minute design changes before submitting for
deployment authorization. According to the Microsoft SDL, which phase includes this final
threat model review?
A. A4: Ship
B. A3: Design and Development
C. A2: Architecture
D. A5: Post-Release Support
Correct Answer: A
Rationale: Correct because the A4 Ship phase includes the final threat model review to validate
that all identified risks have been addressed, mitigated, or formally accepted before the product is
authorized for deployment. This final review ensures the threat model remains accurate and
complete as the product transitions from development to release. A2 involves initial threat
modeling, A3 focuses on development and interim testing, and A5 handles post-deployment
support.
Q2. A security engineer develops an automated harness that feeds millions of randomly
generated malformed HTTP requests with unexpected Unicode characters, oversized headers,
and invalid content types into a REST API gateway to trigger crashes and memory leaks. Which
security testing technique is being employed?
A. Dynamic Application Security Testing (DAST)
B. Static Application Security Testing (SAST)
C. Penetration Testing
D. Fuzzing
Correct Answer: D
Rationale: Correct because Fuzzing is a black-box testing technique that supplies unexpected,
malformed, or random data to application inputs to discover crashes, memory leaks, and security
vulnerabilities. The automated generation of malformed HTTP requests to identify unintended
,behavior is a classic fuzzing approach used during the A3 or A4 testing phases. DAST tests
running applications for operational flaws, SAST analyzes source code without execution, and
Penetration Testing simulates targeted adversarial attacks rather than automated random input
injection.
Q3. A cloud-native application assigns each containerized microservice a dedicated identity with
permissions strictly scoped to the specific cloud APIs and database tables that service requires to
perform its function. Which secure design principle does this architecture enforce?
A. Defense in Depth
B. Least Privilege
C. Economy of Mechanism
D. Complete Mediation
Correct Answer: B
Rationale: Correct because Least Privilege requires that every process, service, or user receive
only the minimum permissions necessary to perform its designated function, which is exactly
what dedicated service identities with scoped API access accomplish. This limits the blast radius
if a microservice is compromised by ensuring it cannot access resources beyond its operational
needs. Defense in Depth employs multiple security layers, Economy of Mechanism reduces
complexity, and Complete Mediation checks every access request.
Q4. A multinational bank participates in an annual industry study where its software security
initiatives are measured against empirical data collected from hundreds of peer financial
institutions to benchmark its maturity. Which maturity model provides this observational, data-
driven assessment?
A. OpenSAMM
B. OWASP SAMM
C. BSIMM
D. Microsoft SDL
Correct Answer: C
Rationale: Correct because the Building Security In Maturity Model (BSIMM) is an
observational framework that measures actual software security practices by analyzing real-
world data from participating organizations for benchmarking purposes. It describes what
companies are actually doing rather than prescribing what they should do, making it ideal for
comparative assessment against industry peers. OpenSAMM is prescriptive, OWASP SAMM
provides improvement roadmaps, and Microsoft SDL is a development lifecycle methodology.
Q5. A development team must choose between a proprietary cryptographic library with 60,000
lines of custom code and a standardized implementation using 6,000 lines of well-vetted FIPS-
certified modules. Which Saltzer and Schroeder principle supports selecting the smaller,
standardized implementation?
,A. Economy of Mechanism
B. Defense in Depth
C. Least Privilege
D. Open Design
Correct Answer: A
Rationale: Correct because Economy of Mechanism dictates that software designs should be
kept as simple and small as possible to minimize the attack surface and reduce opportunities for
bugs or exploits. Selecting the smaller implementation using well-vetted certified modules
reduces complexity and leverages proven security controls rather than introducing novel,
untested code. Defense in Depth employs multiple layers, Least Privilege restricts access rights,
and Open Design avoids security through obscurity.
Q6. A standard user in a project management portal discovers that modifying a hidden form field
from "role=employee" to "role=super_admin" grants unrestricted access to all project financials
without server-side authorization checks. Which STRIDE threat category does this represent?
A. Spoofing
B. Tampering
C. Information Disclosure
D. Elevation of Privilege
Correct Answer: D
Rationale: Correct because Elevation of Privilege is the STRIDE category describing
unauthorized acquisition of higher-level permissions, violating the authorization property.
Modifying a client-side parameter to gain administrative capabilities without proper server-side
validation is a direct example of privilege escalation. Spoofing involves identity impersonation,
Tampering involves unauthorized data modification, and Information Disclosure involves
unauthorized exposure of sensitive data.
Q7. Before releasing a healthcare analytics platform, the security team must formally
demonstrate that the product meets HIPAA privacy standards and EU GDPR data protection
requirements. Which A4 deliverable satisfies this regulatory need?
A. Security Test Execution Report
B. Privacy Compliance Report
C. Remediation Plan
D. Threat Model Documentation
Correct Answer: B
Rationale: Correct because the Privacy Compliance Report is the formal A4 Ship phase
deliverable that certifies the product meets applicable privacy standards and regulatory
requirements such as HIPAA and GDPR. This document is essential for the final sign-off and
readiness certification before deployment. The Security Test Execution Report is an interim A3
, deliverable, the Remediation Plan tracks findings resolution, and Threat Model Documentation is
primarily an A2 deliverable.
Q8. A security architect integrates an automated tool into the CI/CD pipeline that scans every
code commit for hardcoded secrets, buffer overflow vulnerabilities, and insecure cryptographic
patterns without compiling or executing the application. Which tool category is being used?
A. Dynamic Application Security Testing (DAST)
B. Interactive Application Security Testing (IAST)
C. Static Application Security Testing (SAST)
D. Web Application Firewall (WAF)
Correct Answer: C
Rationale: Correct because Static Application Security Testing (SAST) analyzes source code
without execution to identify coding flaws such as hardcoded credentials, buffer overflows, and
insecure cryptography. Integrating SAST into the CI/CD pipeline enables shift-left security by
detecting vulnerabilities early in the A3 Design and Development phase. DAST requires runtime
execution, IAST monitors during execution, and WAF provides runtime protection as a
compensating control.
Q9. An attacker sends emails impersonating the company's Chief Financial Officer to payroll
staff, requesting urgent wire transfers to a fraudulent offshore account. According to STRIDE,
which threat category is being demonstrated?
A. Spoofing
B. Tampering
C. Information Disclosure
D. Repudiation
Correct Answer: A
Rationale: Correct because Spoofing in the STRIDE framework represents impersonation of a
user, process, or device, violating the authenticity property. By impersonating the CFO to
deceive employees, the attacker is directly spoofing identity to facilitate fraud. Tampering
involves data modification, Information Disclosure involves unauthorized data access, and
Repudiation involves denying performed actions.
Q10. After completing static and dynamic analysis during the A3 and A4 phases, the security
team produces a formal document that assigns each vulnerability a priority rating, an owner, and
a target closure date. Which deliverable has been created?
A. Security Testing Report
B. Privacy Compliance Report
C. Security Test Execution Report
D. Remediation Report
