WGU D487 Oa 2026/2027 Test Bank 3 With 420
Questions And Correct Answers (100% Correct
Verified Answers) D487 Secure Software
Design Objective Assessment 2026/2027 Test
Bank V3 2026/2027
OBJECTIVE ASSESSMENT - EXAM
,2026/2027
, SECTIONS COVERED
1. Section 1: Secure Software Design Principles
2. Section 2: Threat Modeling and Risk Assessment
3. Section 3: Secure Coding Practices
4. Section 4: Authentication and Authorization
5. Section 5: Cryptography and Data Protection
6. Section 6: Security Architecture and Design Patterns
7. Section 7: Vulnerability Assessment and Testing
8. Section 8: Compliance and Regulations
, Section 1: Secure Software Design Principles
1. A healthcare application development team is designing a new patient portal that stores sensitive
medical records. The team wants to ensure that if one security control fails, alternative controls will still
protect the data. This principle requires implementing multiple defensive layers throughout the software
architecture. Which principle should guide their design approach?
A. Least privilege
B. Defense in depth
C. Separation of duties
D. Fail secure
Rationale: Defense in depth requires implementing multiple layers of security controls so that if one layer fails, others
continue to protect the system. Least privilege restricts access rights, separation of duties divides responsibilities, and fail
secure ensures systems default to a safe state upon failure.
2. A financial services company is developing a mobile banking application. The security architect
insists that users should only be granted the minimum permissions necessary to perform their specific
tasks, and these permissions should be reviewed quarterly. This approach limits the potential damage
from compromised accounts. Which secure design principle is being applied?
A. Defense in depth
B. Least privilege
C. Economy of mechanism
D. Open design
Rationale: Least privilege ensures users and processes receive only the minimum access rights necessary to perform their
functions, reducing the attack surface from compromised accounts. Defense in depth uses multiple layers, economy of
mechanism favors simplicity, and open design assumes security does not rely on secrecy.
3. A government contractor is designing a classified document management system. The project
manager requires that no single developer should be able to both write code and deploy it to production
without another person's review. This constraint prevents any one individual from having unchecked
control over critical operations. Which principle does this requirement enforce?
A. Least privilege
B. Separation of duties
C. Defense in depth
D. Complete mediation
Rationale: Separation of duties divides critical tasks among multiple individuals to prevent fraud and errors by ensuring no
single person has complete control. Least privilege limits access rights, defense in depth uses multiple layers, and complete
mediation requires every access request to be checked.
4. A startup building a password manager application decides to publish their cryptographic algorithms
for public review instead of keeping them secret. They believe that peer review will expose vulnerabilities
faster than obscurity. Their security model assumes that attackers already know the system design.
Which principle supports this approach?
A. Security through obscurity
B. Open design
C. Fail secure
D. Least common mechanism
Rationale: Open design states that security should not depend on the secrecy of the design or implementation, but rather
on the strength of the keys and mechanisms. Security through obscurity relies on hiding design details, fail secure ensures
systems default to safe states, and least common mechanism reduces shared resources.
Questions And Correct Answers (100% Correct
Verified Answers) D487 Secure Software
Design Objective Assessment 2026/2027 Test
Bank V3 2026/2027
OBJECTIVE ASSESSMENT - EXAM
,2026/2027
, SECTIONS COVERED
1. Section 1: Secure Software Design Principles
2. Section 2: Threat Modeling and Risk Assessment
3. Section 3: Secure Coding Practices
4. Section 4: Authentication and Authorization
5. Section 5: Cryptography and Data Protection
6. Section 6: Security Architecture and Design Patterns
7. Section 7: Vulnerability Assessment and Testing
8. Section 8: Compliance and Regulations
, Section 1: Secure Software Design Principles
1. A healthcare application development team is designing a new patient portal that stores sensitive
medical records. The team wants to ensure that if one security control fails, alternative controls will still
protect the data. This principle requires implementing multiple defensive layers throughout the software
architecture. Which principle should guide their design approach?
A. Least privilege
B. Defense in depth
C. Separation of duties
D. Fail secure
Rationale: Defense in depth requires implementing multiple layers of security controls so that if one layer fails, others
continue to protect the system. Least privilege restricts access rights, separation of duties divides responsibilities, and fail
secure ensures systems default to a safe state upon failure.
2. A financial services company is developing a mobile banking application. The security architect
insists that users should only be granted the minimum permissions necessary to perform their specific
tasks, and these permissions should be reviewed quarterly. This approach limits the potential damage
from compromised accounts. Which secure design principle is being applied?
A. Defense in depth
B. Least privilege
C. Economy of mechanism
D. Open design
Rationale: Least privilege ensures users and processes receive only the minimum access rights necessary to perform their
functions, reducing the attack surface from compromised accounts. Defense in depth uses multiple layers, economy of
mechanism favors simplicity, and open design assumes security does not rely on secrecy.
3. A government contractor is designing a classified document management system. The project
manager requires that no single developer should be able to both write code and deploy it to production
without another person's review. This constraint prevents any one individual from having unchecked
control over critical operations. Which principle does this requirement enforce?
A. Least privilege
B. Separation of duties
C. Defense in depth
D. Complete mediation
Rationale: Separation of duties divides critical tasks among multiple individuals to prevent fraud and errors by ensuring no
single person has complete control. Least privilege limits access rights, defense in depth uses multiple layers, and complete
mediation requires every access request to be checked.
4. A startup building a password manager application decides to publish their cryptographic algorithms
for public review instead of keeping them secret. They believe that peer review will expose vulnerabilities
faster than obscurity. Their security model assumes that attackers already know the system design.
Which principle supports this approach?
A. Security through obscurity
B. Open design
C. Fail secure
D. Least common mechanism
Rationale: Open design states that security should not depend on the secrecy of the design or implementation, but rather
on the strength of the keys and mechanisms. Security through obscurity relies on hiding design details, fail secure ensures
systems default to safe states, and least common mechanism reduces shared resources.
