WGU D416 – Secure Software Design
Final Prep Exam (Latest Update
2026/2027) Questions and Verified
Answers | 100% Correct | Grade A.
1. Which principle requires that software components receive only the
minimum permissions necessary to perform their intended functions?
A. Defense in depth
B. Fail-safe defaults
C. Principle of least privilege
D. Separation of duties
The principle of least privilege limits user, process, and application
permissions to only what is required. This reduces the potential damage
caused by compromised accounts, malicious code, or programming
errors.
2. A developer wants to prevent unauthorized users from accessing
administrative functions in an application. Which security control
should be implemented?
A. Input compression
B. Access control authorization checks
,C. Database indexing
D. Code obfuscation
Authorization checks verify whether an authenticated user has
permission to perform a specific action. Authentication confirms
identity, while authorization determines allowed activities.
3. Which software development practice integrates security activities
throughout every phase of the software development lifecycle (SDLC)?
A. Waterfall development
B. Rapid application development
C. Secure software development lifecycle (SSDLC)
D. Prototype-only development
An SSDLC incorporates security requirements, threat modeling, code
reviews, testing, and vulnerability management throughout
development rather than adding security after deployment.
4. What is the primary purpose of threat modeling during software
design?
A. Increase application performance
B. Reduce development costs
C. Identify potential threats and design appropriate mitigations
D. Automatically generate source code
Threat modeling identifies assets, possible attackers, attack paths, and
weaknesses early in development. It allows security issues to be
addressed before implementation.
,5. Which vulnerability occurs when an application executes
unintended commands because user input is improperly handled?
A. Buffer overflow
B. Race condition
C. Injection attack
D. Session timeout
Injection attacks occur when untrusted input is interpreted as
commands or queries. Examples include SQL injection, command
injection, and LDAP injection.
6. Which coding practice best prevents SQL injection attacks?
A. Increasing database storage capacity
B. Disabling database logging
C. Using parameterized queries
D. Encrypting all database tables
Parameterized queries separate SQL commands from user-supplied
data, preventing attackers from modifying query logic through
malicious input.
7. What is the main purpose of input validation in secure software
design?
A. Improve graphical appearance
B. Reduce application size
C. Ensure user-provided data meets expected requirements before
, processing
D. Increase network bandwidth
Input validation checks that data conforms to expected formats, ranges,
and values. It helps prevent attacks caused by malicious or unexpected
input.
8. Which security principle recommends that systems should deny
access unless permission is explicitly granted?
A. Open design
B. Psychological acceptability
C. Fail-safe defaults
D. Economy of mechanism
Fail-safe defaults means systems should default to a secure state. Access
should be denied unless authorization is explicitly provided.
9. A developer reviews source code manually to identify security flaws
before release. What process is being performed?
A. Dynamic analysis
B. Penetration testing
C. Static application security testing (SAST)
D. Load testing
Static application security testing examines source code without
executing the application. It identifies issues such as insecure coding
practices and vulnerabilities.
Final Prep Exam (Latest Update
2026/2027) Questions and Verified
Answers | 100% Correct | Grade A.
1. Which principle requires that software components receive only the
minimum permissions necessary to perform their intended functions?
A. Defense in depth
B. Fail-safe defaults
C. Principle of least privilege
D. Separation of duties
The principle of least privilege limits user, process, and application
permissions to only what is required. This reduces the potential damage
caused by compromised accounts, malicious code, or programming
errors.
2. A developer wants to prevent unauthorized users from accessing
administrative functions in an application. Which security control
should be implemented?
A. Input compression
B. Access control authorization checks
,C. Database indexing
D. Code obfuscation
Authorization checks verify whether an authenticated user has
permission to perform a specific action. Authentication confirms
identity, while authorization determines allowed activities.
3. Which software development practice integrates security activities
throughout every phase of the software development lifecycle (SDLC)?
A. Waterfall development
B. Rapid application development
C. Secure software development lifecycle (SSDLC)
D. Prototype-only development
An SSDLC incorporates security requirements, threat modeling, code
reviews, testing, and vulnerability management throughout
development rather than adding security after deployment.
4. What is the primary purpose of threat modeling during software
design?
A. Increase application performance
B. Reduce development costs
C. Identify potential threats and design appropriate mitigations
D. Automatically generate source code
Threat modeling identifies assets, possible attackers, attack paths, and
weaknesses early in development. It allows security issues to be
addressed before implementation.
,5. Which vulnerability occurs when an application executes
unintended commands because user input is improperly handled?
A. Buffer overflow
B. Race condition
C. Injection attack
D. Session timeout
Injection attacks occur when untrusted input is interpreted as
commands or queries. Examples include SQL injection, command
injection, and LDAP injection.
6. Which coding practice best prevents SQL injection attacks?
A. Increasing database storage capacity
B. Disabling database logging
C. Using parameterized queries
D. Encrypting all database tables
Parameterized queries separate SQL commands from user-supplied
data, preventing attackers from modifying query logic through
malicious input.
7. What is the main purpose of input validation in secure software
design?
A. Improve graphical appearance
B. Reduce application size
C. Ensure user-provided data meets expected requirements before
, processing
D. Increase network bandwidth
Input validation checks that data conforms to expected formats, ranges,
and values. It helps prevent attacks caused by malicious or unexpected
input.
8. Which security principle recommends that systems should deny
access unless permission is explicitly granted?
A. Open design
B. Psychological acceptability
C. Fail-safe defaults
D. Economy of mechanism
Fail-safe defaults means systems should default to a secure state. Access
should be denied unless authorization is explicitly provided.
9. A developer reviews source code manually to identify security flaws
before release. What process is being performed?
A. Dynamic analysis
B. Penetration testing
C. Static application security testing (SAST)
D. Load testing
Static application security testing examines source code without
executing the application. It identifies issues such as insecure coding
practices and vulnerabilities.
