WGU D487 SOFTWARE EVALUATION TEST
QUESTIONS AND ANSWERS SET A+
✔✔What is the order that code reviews should follow in order to be effective? - Step 2 -
✔✔Preform preliminary scan
✔✔What is the order that code reviews should follow in order to be effective? - Step 3 -
✔✔Review code for security issues
✔✔What is the order that code reviews should follow in order to be effective? - Step 4 -
✔✔Review for security issues unique to the architecture
✔✔When a software application handles personally identifiable information (PII) data,
what will be the Privacy Impact Rating? - ✔✔P1: High privacy risk
✔✔Which key success factor identifies threats to the software? - ✔✔Effective threat
modeling
✔✔What is the goal of design security review deliverables? - ✔✔To make modifications
to the design of software components based on security assessments
✔✔Which application scanner component is useful in identifying vulnerabilities such as
cookie misconfigurations and insecure configuration of HTTP response headers? -
✔✔Passive scanner
✔✔Which type of attack occurs when an attacker uses malicious code in the data sent
in a form? - ✔✔Cross-site scripting
✔✔Which tools provide the given functions? - Self Managed Automatic Code Review
Product - ✔✔SonarQube
, ✔✔Which tools provide the given functions? - Proprietary issue tracking product -
✔✔JIRA
✔✔Which tools provide the given functions? - Open-source automation server -
✔✔Jenkins
✔✔Which tools provide the given functions? - AI-Powered managemnt soltuion -
✔✔Dynatrace
✔✔A new application is released, and users perform initial testing on the application.
Which type of testing are the users performing? - ✔✔Beta Testing
✔✔What is a non-system-related component in software security testing attack surface
validation? - ✔✔Users
✔✔When an application's input validation is not handled properly, it could result in
which kind of vulnerabilities? - ✔✔SQL injection, cross-site scripting
✔✔What are the advantages of the following security analysis tools? - Static Code
Analysis - ✔✔Access to the actual instructions the software will be guessing
✔✔What are the advantages of the following security analysis tools? - Dynamic Code
Analysis - ✔✔Tests a specific operational deployment
✔✔What are the advantages of the following security analysis tools? - Fuzz Testing -
✔✔Testing in a random approach
✔✔What are the advantages of the following security analysis tools? - Manual Code
Review - ✔✔Requires no supporting Technology
✔✔Which activity in the Ship (A5) phase of the security development cycle sets
requirements for quality gates that must be met before release? - ✔✔A5 policy
compliance analysis
✔✔Which post-release support activity should be completed when companies are
joining together? - ✔✔Security architectural reviews
✔✔The company's website uses querystring parameters to filter products by category.
The URL, when filtering on a product category, looks like this:
company.com/products?category=2.
QUESTIONS AND ANSWERS SET A+
✔✔What is the order that code reviews should follow in order to be effective? - Step 2 -
✔✔Preform preliminary scan
✔✔What is the order that code reviews should follow in order to be effective? - Step 3 -
✔✔Review code for security issues
✔✔What is the order that code reviews should follow in order to be effective? - Step 4 -
✔✔Review for security issues unique to the architecture
✔✔When a software application handles personally identifiable information (PII) data,
what will be the Privacy Impact Rating? - ✔✔P1: High privacy risk
✔✔Which key success factor identifies threats to the software? - ✔✔Effective threat
modeling
✔✔What is the goal of design security review deliverables? - ✔✔To make modifications
to the design of software components based on security assessments
✔✔Which application scanner component is useful in identifying vulnerabilities such as
cookie misconfigurations and insecure configuration of HTTP response headers? -
✔✔Passive scanner
✔✔Which type of attack occurs when an attacker uses malicious code in the data sent
in a form? - ✔✔Cross-site scripting
✔✔Which tools provide the given functions? - Self Managed Automatic Code Review
Product - ✔✔SonarQube
, ✔✔Which tools provide the given functions? - Proprietary issue tracking product -
✔✔JIRA
✔✔Which tools provide the given functions? - Open-source automation server -
✔✔Jenkins
✔✔Which tools provide the given functions? - AI-Powered managemnt soltuion -
✔✔Dynatrace
✔✔A new application is released, and users perform initial testing on the application.
Which type of testing are the users performing? - ✔✔Beta Testing
✔✔What is a non-system-related component in software security testing attack surface
validation? - ✔✔Users
✔✔When an application's input validation is not handled properly, it could result in
which kind of vulnerabilities? - ✔✔SQL injection, cross-site scripting
✔✔What are the advantages of the following security analysis tools? - Static Code
Analysis - ✔✔Access to the actual instructions the software will be guessing
✔✔What are the advantages of the following security analysis tools? - Dynamic Code
Analysis - ✔✔Tests a specific operational deployment
✔✔What are the advantages of the following security analysis tools? - Fuzz Testing -
✔✔Testing in a random approach
✔✔What are the advantages of the following security analysis tools? - Manual Code
Review - ✔✔Requires no supporting Technology
✔✔Which activity in the Ship (A5) phase of the security development cycle sets
requirements for quality gates that must be met before release? - ✔✔A5 policy
compliance analysis
✔✔Which post-release support activity should be completed when companies are
joining together? - ✔✔Security architectural reviews
✔✔The company's website uses querystring parameters to filter products by category.
The URL, when filtering on a product category, looks like this:
company.com/products?category=2.
