, WGU D487 Secure Software Design OA Test Bank 3 |
2026/2027 Edition | 200 Verified Questions - 150 Questions
with Answers
WGU D487 Secure Software Design OA Test Bank 3 2026-150 QUESTIONS AND ANSWERS ALREADY
GRADED A+. 100% Verified Solutions | Updated Per Latest Guidelines | Graded A+
This comprehensive test bank for WGU D487 Secure Software Design provides 200 verified questions
covering all major domains of secure software development. Each question includes detailed rationales
to reinforce understanding of security principles, threat modeling, secure coding practices, and
compliance standards. Designed to mirror the actual OA format, this resource ensures thorough
preparation for the 2026/2027 exam. With a pass guarantee and A+ grading, it is the ultimate study
companion for WGU students.
Key Features:
Security Fundamentals and Core Principles
Threat Modeling and Risk Assessment
Secure Software Development Lifecycle (SDLC)
Secure Design Principles and Patterns
Secure Coding Practices and Common Vulnerabilities
Authentication, Authorization, and Access Control
Cryptography and Key Management
Input Validation and Output Encoding
Error Handling and Logging
Security Testing and Code Review
Secure Deployment and Operations
Compliance, Governance, and Legal Frameworks
Cloud Security and Virtualization
Mobile and IoT Security
API Security and Web Services
Data Protection and Privacy
Incident Response and Recovery
Emerging Threats and Trends
Updates for 2026:
- Updated to reflect the latest 2026/2027 WGU D487 curriculum changes
- Incorporated new questions on cloud-native security and zero-trust architecture
- Enhanced rationales with real-world examples and common pitfalls
- Aligned with current industry standards (OWASP, NIST, ISO 27001)
- Expanded coverage of secure DevOps and CI/CD pipeline security
Abstract:
The WGU D487 Secure Software Design course emphasizes the integration of security throughout the software
development lifecycle. This test bank offers a rigorous assessment of key concepts including threat modeling,
secure architecture, and defensive programming. Each of the 200 questions is accompanied by a detailed rationale
that explains not only the correct answer but also why the distractors are incorrect, fostering deeper
comprehension. The content spans from foundational security principles to advanced topics like cryptography and
Page 1
,cloud security, ensuring a holistic review. By practicing with these verified questions, students can identify
knowledge gaps and build confidence for the objective assessment. The material is meticulously updated for the
2026/2027 academic year, aligning with the latest WGU guidelines and industry best practices. This resource is an
indispensable tool for achieving a high pass rate and earning an A+ grade.
Keywords:
Secure Software Design, WGU D487, Test Bank, OA Exam Prep, Threat Modeling, Secure Coding, Cryptography,
2026/2027
Answer Format:
Each question is presented in multiple-choice format with four options. The correct answer is followed by a
comprehensive rationale explaining the underlying security concept, why the correct choice is valid, and why each
distractor is incorrect. This approach reinforces learning and helps students apply principles to new scenarios.
Compliance Checklist:
200 verified questions covering all D487 domains
Detailed rationales for every question
Updated to 2026/2027 curriculum and industry standards
Aligned with WGU objective assessment format
Pass guarantee and A+ grading assurance
Suitable for self-assessment and final review
Content Area Overview:
Content Area Questions Key Topics Weight
Security Fundamentals 1-20 CIA triad, risk management, security 10%
policies, security principles
Threat Modeling 21-40 STRIDE, DREAD, attack surfaces, threat 10%
intelligence
Secure SDLC 41-60 Phases, security requirements, design 10%
review, security testing
Secure Design Principles 61-80 Least privilege, defense in depth, fail secure, 10%
secure defaults
Secure Coding Practices 81-100 Buffer overflows, injection flaws, XSS, 10%
CSRF, secure error handling
Authentication and 101-120 Password security, multi-factor 10%
Authorization authentication, RBAC, session management
Cryptography 121-140 Symmetric/asymmetric encryption, hashing, 10%
digital signatures, PKI
Input Validation and Output 141-160 Validation techniques, canonicalization, 10%
Encoding output encoding, SQL injection prevention
Security Testing and Code 161-180 Static/dynamic analysis, penetration testing, 10%
Review code review best practices
Deployment, Operations, and 181-200 Secure configuration, patch management, 10%
Compliance incident response, GDPR, HIPAA
Page 2
, Q1. In a microservices architecture, a developer proposes to use mutual TLS (mTLS)
for service-to-service authentication. Which additional control is essential to prevent
service impersonation in a dynamic orchestration environment?
A. Short-lived certificates with automatic rotation
B. Static API keys stored in environment variables
C. Centralized OAuth2 token validation
D. Network segmentation using VPC peering
Correct Answer: A. Short-lived certificates with automatic rotation
Rationale: Short-lived certificates with automatic rotation limit the window of compromise
and ensure that compromised credentials become invalid quickly, which is crucial in
dynamic environments where services are frequently created and destroyed. Static API
keys (B) are long-lived and prone to leakage. OAuth2 tokens (C) are for user-level access,
not service-to-service authentication. Network segmentation (D) does not address service
identity.
Why Wrong:
B - Static API keys lack expiry and rotation, increasing the risk of long-term
compromise.
C - OAuth2 is designed for user delegation, not for establishing service identity in
mTLS.
D - Network segmentation controls traffic flow but does not authenticate the calling
service.
Reference: OWASP ASVS, NIST SP 800-204B, Secure Design Principles
Q2. A software architect is evaluating a system that handles sensitive user data. The
system must ensure that even if a database is compromised, the data is unusable
without the application's decryption keys. Which approach best achieves this?
A. Encrypting data in transit using TLS
B. Implementing field-level encryption with keys held in a hardware security module
(HSM)
C. Hashing all data with SHA-256
D. Using transparent data encryption (TDE) with keys stored on the same server
Correct Answer: B. Implementing field-level encryption with keys held in a hardware
security module (HSM)
Rationale: Field-level encryption with keys in an HSM ensures that even if the database is
exfiltrated, the ciphertext cannot be decrypted without the HSM, which is physically and
logically secured. TLS (A) protects data in transit, not at rest. Hashing (C) is not
reversible and unsuitable for data that needs to be read. TDE (D) with keys on the same
server is vulnerable if the server is fully compromised.
Page 3
2026/2027 Edition | 200 Verified Questions - 150 Questions
with Answers
WGU D487 Secure Software Design OA Test Bank 3 2026-150 QUESTIONS AND ANSWERS ALREADY
GRADED A+. 100% Verified Solutions | Updated Per Latest Guidelines | Graded A+
This comprehensive test bank for WGU D487 Secure Software Design provides 200 verified questions
covering all major domains of secure software development. Each question includes detailed rationales
to reinforce understanding of security principles, threat modeling, secure coding practices, and
compliance standards. Designed to mirror the actual OA format, this resource ensures thorough
preparation for the 2026/2027 exam. With a pass guarantee and A+ grading, it is the ultimate study
companion for WGU students.
Key Features:
Security Fundamentals and Core Principles
Threat Modeling and Risk Assessment
Secure Software Development Lifecycle (SDLC)
Secure Design Principles and Patterns
Secure Coding Practices and Common Vulnerabilities
Authentication, Authorization, and Access Control
Cryptography and Key Management
Input Validation and Output Encoding
Error Handling and Logging
Security Testing and Code Review
Secure Deployment and Operations
Compliance, Governance, and Legal Frameworks
Cloud Security and Virtualization
Mobile and IoT Security
API Security and Web Services
Data Protection and Privacy
Incident Response and Recovery
Emerging Threats and Trends
Updates for 2026:
- Updated to reflect the latest 2026/2027 WGU D487 curriculum changes
- Incorporated new questions on cloud-native security and zero-trust architecture
- Enhanced rationales with real-world examples and common pitfalls
- Aligned with current industry standards (OWASP, NIST, ISO 27001)
- Expanded coverage of secure DevOps and CI/CD pipeline security
Abstract:
The WGU D487 Secure Software Design course emphasizes the integration of security throughout the software
development lifecycle. This test bank offers a rigorous assessment of key concepts including threat modeling,
secure architecture, and defensive programming. Each of the 200 questions is accompanied by a detailed rationale
that explains not only the correct answer but also why the distractors are incorrect, fostering deeper
comprehension. The content spans from foundational security principles to advanced topics like cryptography and
Page 1
,cloud security, ensuring a holistic review. By practicing with these verified questions, students can identify
knowledge gaps and build confidence for the objective assessment. The material is meticulously updated for the
2026/2027 academic year, aligning with the latest WGU guidelines and industry best practices. This resource is an
indispensable tool for achieving a high pass rate and earning an A+ grade.
Keywords:
Secure Software Design, WGU D487, Test Bank, OA Exam Prep, Threat Modeling, Secure Coding, Cryptography,
2026/2027
Answer Format:
Each question is presented in multiple-choice format with four options. The correct answer is followed by a
comprehensive rationale explaining the underlying security concept, why the correct choice is valid, and why each
distractor is incorrect. This approach reinforces learning and helps students apply principles to new scenarios.
Compliance Checklist:
200 verified questions covering all D487 domains
Detailed rationales for every question
Updated to 2026/2027 curriculum and industry standards
Aligned with WGU objective assessment format
Pass guarantee and A+ grading assurance
Suitable for self-assessment and final review
Content Area Overview:
Content Area Questions Key Topics Weight
Security Fundamentals 1-20 CIA triad, risk management, security 10%
policies, security principles
Threat Modeling 21-40 STRIDE, DREAD, attack surfaces, threat 10%
intelligence
Secure SDLC 41-60 Phases, security requirements, design 10%
review, security testing
Secure Design Principles 61-80 Least privilege, defense in depth, fail secure, 10%
secure defaults
Secure Coding Practices 81-100 Buffer overflows, injection flaws, XSS, 10%
CSRF, secure error handling
Authentication and 101-120 Password security, multi-factor 10%
Authorization authentication, RBAC, session management
Cryptography 121-140 Symmetric/asymmetric encryption, hashing, 10%
digital signatures, PKI
Input Validation and Output 141-160 Validation techniques, canonicalization, 10%
Encoding output encoding, SQL injection prevention
Security Testing and Code 161-180 Static/dynamic analysis, penetration testing, 10%
Review code review best practices
Deployment, Operations, and 181-200 Secure configuration, patch management, 10%
Compliance incident response, GDPR, HIPAA
Page 2
, Q1. In a microservices architecture, a developer proposes to use mutual TLS (mTLS)
for service-to-service authentication. Which additional control is essential to prevent
service impersonation in a dynamic orchestration environment?
A. Short-lived certificates with automatic rotation
B. Static API keys stored in environment variables
C. Centralized OAuth2 token validation
D. Network segmentation using VPC peering
Correct Answer: A. Short-lived certificates with automatic rotation
Rationale: Short-lived certificates with automatic rotation limit the window of compromise
and ensure that compromised credentials become invalid quickly, which is crucial in
dynamic environments where services are frequently created and destroyed. Static API
keys (B) are long-lived and prone to leakage. OAuth2 tokens (C) are for user-level access,
not service-to-service authentication. Network segmentation (D) does not address service
identity.
Why Wrong:
B - Static API keys lack expiry and rotation, increasing the risk of long-term
compromise.
C - OAuth2 is designed for user delegation, not for establishing service identity in
mTLS.
D - Network segmentation controls traffic flow but does not authenticate the calling
service.
Reference: OWASP ASVS, NIST SP 800-204B, Secure Design Principles
Q2. A software architect is evaluating a system that handles sensitive user data. The
system must ensure that even if a database is compromised, the data is unusable
without the application's decryption keys. Which approach best achieves this?
A. Encrypting data in transit using TLS
B. Implementing field-level encryption with keys held in a hardware security module
(HSM)
C. Hashing all data with SHA-256
D. Using transparent data encryption (TDE) with keys stored on the same server
Correct Answer: B. Implementing field-level encryption with keys held in a hardware
security module (HSM)
Rationale: Field-level encryption with keys in an HSM ensures that even if the database is
exfiltrated, the ciphertext cannot be decrypted without the HSM, which is physically and
logically secured. TLS (A) protects data in transit, not at rest. Hashing (C) is not
reversible and unsuitable for data that needs to be read. TDE (D) with keys on the same
server is vulnerable if the server is fully compromised.
Page 3
