, WGU D487 Secure Software Design OA Test Bank 3 |
2026/2027 Edition | 200 Verified Questions - 195 Questions
with Answers
WGU D487 Secure Software Design OA 2026-195 QUESTIONS AND ANSWERS ALREADY GRADED A+. 100%
Verified Solutions | Updated Per Latest Guidelines | Graded A+
This comprehensive test bank for WGU D487 Secure Software Design provides 200 verified questions
covering all major domains of secure software development. Each question is accompanied by detailed
rationales to reinforce understanding of key concepts. Designed to mirror the actual OA format, this
resource ensures thorough preparation for the 2026/2027 exam. With a focus on practical application
and theoretical foundations, it is an essential tool for achieving a passing score with confidence.
Key Features:
Secure Software Development Lifecycle (SSDLC) and methodologies
Threat modeling and risk assessment techniques
Secure coding practices and common vulnerabilities (OWASP Top 10)
Authentication, authorization, and access control models
Cryptography fundamentals and application in software
Secure design principles and architecture patterns
Input validation, output encoding, and injection prevention
Session management and secure communication
Security testing: static analysis, dynamic analysis, and penetration testing
Secure deployment, configuration, and maintenance
Incident response and security logging
Compliance, standards, and regulatory frameworks (e.g., NIST, ISO 27001)
Cloud security and secure DevOps (CI/CD)
Mobile and IoT security considerations
Privacy by design and data protection
Secure software requirements and design documentation
Updates for 2026:
- Aligned with the latest 2026/2027 WGU D487 course objectives
- Incorporated recent OWASP Top 10 and CWE/SANS updates
- Added new questions on cloud-native and container security
- Expanded rationales to include real-world examples and common pitfalls
- Updated to reflect current industry best practices and standards
Abstract:
The WGU D487 Secure Software Design course focuses on integrating security throughout the software
development lifecycle. This test bank offers a rigorous assessment of knowledge in threat modeling, secure coding,
cryptography, and security testing. It emphasizes practical skills for identifying and mitigating vulnerabilities in
software systems. The questions are designed to challenge both conceptual understanding and application in
realistic scenarios. Detailed rationales provide insight into the reasoning behind correct answers, enhancing
learning. This resource is indispensable for students aiming to excel in the OA and apply secure design principles
professionally.
Keywords:
Page 1
,Secure Software Design, Threat Modeling, OWASP Top 10, Cryptography, Secure Coding, Access Control,
Security Testing, SSDLC
Answer Format:
Each question is followed by the correct answer and a comprehensive rationale explaining why it is correct and
why the other options are incorrect. Rationales include references to industry standards and best practices, ensuring
a deep understanding of the material.
Compliance Checklist:
Covers all WGU D487 course competencies
Verified against official exam blueprint
Includes detailed rationales for every question
Updated for 2026/2027 academic year
Pass guarantee with A+ grading support
100% authentic test bank questions
Content Area Overview:
Content Area Questions Key Topics Weight
Secure Software Development 1-30 SSDLC phases, Agile/Waterfall, Security 15%
Lifecycle requirements
Threat Modeling and Risk 31-60 STRIDE, DREAD, Attack trees, Risk 15%
Assessment analysis
Secure Coding and Common 61-90 OWASP Top 10, Injection, XSS, CSRF, 15%
Vulnerabilities Buffer overflows
Authentication and 91-110 RBAC, ABAC, MFA, Session management, 10%
Authorization OAuth
Cryptography 111-130 Symmetric/Asymmetric encryption, 10%
Hashing, Digital signatures, PKI
Secure Design Principles and 131-150 Least privilege, Defense in depth, Secure 10%
Architecture defaults, Trust boundaries
Security Testing 151-170 SAST, DAST, Penetration testing, Fuzzing, 10%
Code review
Secure Deployment and 171-185 Configuration management, Patch 7.5%
Operations management, Secure CI/CD, Logging
Compliance and Standards 186-195 NIST, ISO 27001, GDPR, HIPAA, PCI DSS 5%
Emerging Topics 196-200 Cloud security, IoT, Mobile security, AI/ML 2.5%
security
Page 2
, Q1. During a threat modeling session, a software architect identifies that a
microservices-based application uses JWT for authentication. The JWT is signed with
RS256, but the server also accepts 'none' algorithm to support legacy clients. Which
attack is most likely to succeed?
A. Key confusion attack using the server's public key as the HMAC secret
B. Algorithm substitution attack where the token is re-signed with 'none'
C. Replay attack using a captured JWT before expiry
D. Padding oracle attack on the RSA encrypted payload
Correct Answer: B. Algorithm substitution attack where the token is re-signed with
'none'
Rationale: Accepting the 'none' algorithm allows an attacker to forge a token by setting
the algorithm to 'none' and omitting the signature, bypassing verification. Key confusion
attacks exploit servers that use the same key for HMAC and RSA, but here the issue is the
explicit acceptance of 'none'. Replay attacks require a valid token and are not specific to
this misconfiguration. Padding oracle attacks target CBC mode encryption, not JWT
signatures.
Why Wrong:
A - Key confusion attack requires a server that incorrectly uses the public key as an
HMAC secret, which is not mentioned.
C - Replay attacks are a concern but not directly due to the 'none' algorithm
acceptance.
D - Padding oracle attacks apply to encryption, not to JWT signature verification.
Reference: OWASP JWT Cheat Sheet (2026)
Q2. In a zero-trust architecture, a network segment is configured to enforce
micro-segmentation. A developer proposes to add a service-to-service authentication
using mTLS. Which additional control is essential to ensure the security of this
model?
A. Static API keys for service-to-service communication
B. Short-lived certificates with automated rotation
C. Shared secrets stored in configuration files
D. Reliance on network perimeter firewalls
Correct Answer: B. Short-lived certificates with automated rotation
Rationale: Short-lived certificates with automated rotation minimize the impact of key
compromise and are essential in a zero-trust model where trust is never implicit. Static
API keys and shared secrets introduce long-lived credentials that violate the principle of
least privilege and are prone to leakage. Relying on perimeter firewalls contradicts the
zero-trust principle of not trusting any network.
Page 3
2026/2027 Edition | 200 Verified Questions - 195 Questions
with Answers
WGU D487 Secure Software Design OA 2026-195 QUESTIONS AND ANSWERS ALREADY GRADED A+. 100%
Verified Solutions | Updated Per Latest Guidelines | Graded A+
This comprehensive test bank for WGU D487 Secure Software Design provides 200 verified questions
covering all major domains of secure software development. Each question is accompanied by detailed
rationales to reinforce understanding of key concepts. Designed to mirror the actual OA format, this
resource ensures thorough preparation for the 2026/2027 exam. With a focus on practical application
and theoretical foundations, it is an essential tool for achieving a passing score with confidence.
Key Features:
Secure Software Development Lifecycle (SSDLC) and methodologies
Threat modeling and risk assessment techniques
Secure coding practices and common vulnerabilities (OWASP Top 10)
Authentication, authorization, and access control models
Cryptography fundamentals and application in software
Secure design principles and architecture patterns
Input validation, output encoding, and injection prevention
Session management and secure communication
Security testing: static analysis, dynamic analysis, and penetration testing
Secure deployment, configuration, and maintenance
Incident response and security logging
Compliance, standards, and regulatory frameworks (e.g., NIST, ISO 27001)
Cloud security and secure DevOps (CI/CD)
Mobile and IoT security considerations
Privacy by design and data protection
Secure software requirements and design documentation
Updates for 2026:
- Aligned with the latest 2026/2027 WGU D487 course objectives
- Incorporated recent OWASP Top 10 and CWE/SANS updates
- Added new questions on cloud-native and container security
- Expanded rationales to include real-world examples and common pitfalls
- Updated to reflect current industry best practices and standards
Abstract:
The WGU D487 Secure Software Design course focuses on integrating security throughout the software
development lifecycle. This test bank offers a rigorous assessment of knowledge in threat modeling, secure coding,
cryptography, and security testing. It emphasizes practical skills for identifying and mitigating vulnerabilities in
software systems. The questions are designed to challenge both conceptual understanding and application in
realistic scenarios. Detailed rationales provide insight into the reasoning behind correct answers, enhancing
learning. This resource is indispensable for students aiming to excel in the OA and apply secure design principles
professionally.
Keywords:
Page 1
,Secure Software Design, Threat Modeling, OWASP Top 10, Cryptography, Secure Coding, Access Control,
Security Testing, SSDLC
Answer Format:
Each question is followed by the correct answer and a comprehensive rationale explaining why it is correct and
why the other options are incorrect. Rationales include references to industry standards and best practices, ensuring
a deep understanding of the material.
Compliance Checklist:
Covers all WGU D487 course competencies
Verified against official exam blueprint
Includes detailed rationales for every question
Updated for 2026/2027 academic year
Pass guarantee with A+ grading support
100% authentic test bank questions
Content Area Overview:
Content Area Questions Key Topics Weight
Secure Software Development 1-30 SSDLC phases, Agile/Waterfall, Security 15%
Lifecycle requirements
Threat Modeling and Risk 31-60 STRIDE, DREAD, Attack trees, Risk 15%
Assessment analysis
Secure Coding and Common 61-90 OWASP Top 10, Injection, XSS, CSRF, 15%
Vulnerabilities Buffer overflows
Authentication and 91-110 RBAC, ABAC, MFA, Session management, 10%
Authorization OAuth
Cryptography 111-130 Symmetric/Asymmetric encryption, 10%
Hashing, Digital signatures, PKI
Secure Design Principles and 131-150 Least privilege, Defense in depth, Secure 10%
Architecture defaults, Trust boundaries
Security Testing 151-170 SAST, DAST, Penetration testing, Fuzzing, 10%
Code review
Secure Deployment and 171-185 Configuration management, Patch 7.5%
Operations management, Secure CI/CD, Logging
Compliance and Standards 186-195 NIST, ISO 27001, GDPR, HIPAA, PCI DSS 5%
Emerging Topics 196-200 Cloud security, IoT, Mobile security, AI/ML 2.5%
security
Page 2
, Q1. During a threat modeling session, a software architect identifies that a
microservices-based application uses JWT for authentication. The JWT is signed with
RS256, but the server also accepts 'none' algorithm to support legacy clients. Which
attack is most likely to succeed?
A. Key confusion attack using the server's public key as the HMAC secret
B. Algorithm substitution attack where the token is re-signed with 'none'
C. Replay attack using a captured JWT before expiry
D. Padding oracle attack on the RSA encrypted payload
Correct Answer: B. Algorithm substitution attack where the token is re-signed with
'none'
Rationale: Accepting the 'none' algorithm allows an attacker to forge a token by setting
the algorithm to 'none' and omitting the signature, bypassing verification. Key confusion
attacks exploit servers that use the same key for HMAC and RSA, but here the issue is the
explicit acceptance of 'none'. Replay attacks require a valid token and are not specific to
this misconfiguration. Padding oracle attacks target CBC mode encryption, not JWT
signatures.
Why Wrong:
A - Key confusion attack requires a server that incorrectly uses the public key as an
HMAC secret, which is not mentioned.
C - Replay attacks are a concern but not directly due to the 'none' algorithm
acceptance.
D - Padding oracle attacks apply to encryption, not to JWT signature verification.
Reference: OWASP JWT Cheat Sheet (2026)
Q2. In a zero-trust architecture, a network segment is configured to enforce
micro-segmentation. A developer proposes to add a service-to-service authentication
using mTLS. Which additional control is essential to ensure the security of this
model?
A. Static API keys for service-to-service communication
B. Short-lived certificates with automated rotation
C. Shared secrets stored in configuration files
D. Reliance on network perimeter firewalls
Correct Answer: B. Short-lived certificates with automated rotation
Rationale: Short-lived certificates with automated rotation minimize the impact of key
compromise and are essential in a zero-trust model where trust is never implicit. Static
API keys and shared secrets introduce long-lived credentials that violate the principle of
least privilege and are prone to leakage. Relying on perimeter firewalls contradicts the
zero-trust principle of not trusting any network.
Page 3
