WGU D487 OA 2026/2027
Test Bank 3 With Questions And Correct Answers
Secure Software Design Objective Assessment
100% Correct Verified Answers
150 Questions | 8 Sections | Scenario-Based and Recall
Section 1: Secure Design Principles and Frameworks (Q1-Q25)
Q1: A software architect is designing a financial application that processes online transactions. The system must ensure
that transaction data is not altered during transmission and that the system remains operational even during peak trading
hours. Which two CIA Triad principles are most directly involved in these requirements?
A. Confidentiality and Integrity
B. Integrity and Availability
C. Confidentiality and Availability
D. Accountability and Integrity
Correct Answer: B
Rationale: Integrity ensures that transaction data is not altered during transmission, which is critical for financial accuracy. Availability
ensures the system remains operational during peak trading hours so users can complete transactions. Confidentiality relates to data
secrecy, which is not the primary concern described in the scenario. Accountability is part of IAAA, not the CIA Triad.
Q2: An organization implements a security model where users must present a smart card (something they have) and enter
a PIN (something they know) to access sensitive systems. Which IAAA component does this multi-factor approach
primarily strengthen?
A. Identification
B. Authentication
C. Authorization
D. Accountability
Correct Answer: B
Rationale: Authentication is the process of verifying a claimed identity, and multi-factor authentication strengthens this by requiring
multiple independent verification factors. Identification is merely claiming an identity (e.g., username). Authorization determines what
actions an authenticated user may perform. Accountability ensures actions are traceable to individuals through logging and auditing.
Q3: A security engineer recommends deploying network firewalls, host-based intrusion detection systems,
application-layer input validation, and database encryption for a web application. Which security strategy best describes
this multi-layered approach?
A. Zero Trust Architecture
B. Principle of Least Privilege
C. Defense-in-Depth
D. Attack Surface Minimization
Correct Answer: C
Rationale: Defense-in-Depth employs multiple overlapping security controls at different layers (network, host, application, and data) so
that if one control fails, others continue to protect the system. Zero Trust focuses on continuous verification rather than layered controls.
Least Privilege limits permissions but does not inherently involve multiple layers. Attack Surface Minimization reduces entry points but does
not describe the layered deployment strategy.
, WGU D487 Secure Software Design - Test Bank 3 (2026/2027)
Q4: A web application grants all authenticated users the 'admin' role by default, allowing them to access configuration
settings and user management functions. Which security principle is being violated?
A. Separation of Duties
B. Principle of Least Privilege
C. Defense-in-Depth
D. Fail-Safe Defaults
Correct Answer: B
Rationale: The Principle of Least Privilege states that users should be granted only the minimum permissions necessary to perform their
tasks. Granting all users admin access by default provides excessive permissions, increasing the attack surface and potential damage from
compromised accounts. Separation of Duties divides critical functions among multiple roles, which is related but distinct. Defense-in-Depth
involves multiple layers of controls, and Fail-Safe Defaults relates to default-deny configurations.
Q5: In a payment processing system, the same employee is authorized to both create new vendor records and approve
payments to those vendors. Which security principle is most directly violated by this configuration?
A. Principle of Least Privilege
B. Separation of Duties
C. Defense-in-Depth
D. Complete Mediation
Correct Answer: B
Rationale: Separation of Duties requires that critical functions be divided among multiple individuals to prevent fraud and errors. Allowing
one person to both create vendors and approve payments creates a single point of failure for embezzlement. Least Privilege limits
permission levels but does not specifically address dividing conflicting duties. Defense-in-Depth involves layered controls, and Complete
Mediation requires every access to be checked rather than addressing duty division.
Q6: A security auditor discovers that a production server has 15 open ports, with 9 of them supporting services that are no
longer used by the application. Which security principle should be applied to address this finding?
A. Attack Surface Minimization
B. Zero Trust Architecture
C. Separation of Privilege
D. Psychological Acceptability
Correct Answer: A
Rationale: Attack Surface Minimization involves reducing the number of entry points available to attackers by closing unused ports,
disabling unnecessary services, and removing unused functionality. The 9 unused open ports represent an unnecessarily large attack
surface. Zero Trust focuses on continuous verification of every access request. Separation of Privilege requires multiple conditions for
privileged operations. Psychological Acceptability ensures security measures are usable.
Q7: An organization has adopted a security model where no user, device, or network segment is inherently trusted,
regardless of its location relative to the network perimeter. Every access request must be authenticated, authorized, and
encrypted in real time. Which architecture does this describe?
A. Defense-in-Depth
B. Zero Trust Architecture
C. Border Security Model
D. Network Segmentation Strategy
Correct Answer: B
Rationale: Zero Trust Architecture operates on the principle of 'never trust, always verify,' eliminating the concept of a trusted internal
network. Every access request requires continuous authentication, authorization, and encryption regardless of network location.
Defense-in-Depth uses multiple overlapping layers but still may trust internal segments. Border Security Models rely on perimeter defenses.
Network Segmentation divides networks but does not inherently implement continuous verification.
Q8: According to the Saltzer and Schroeder security design principles, a system should default to denying access and
require explicit permission to grant access. Which specific principle does this describe?
A. Economy of Mechanism
B. Fail-Safe Defaults
C. Open Design
D. Complete Mediation
Page 2
, WGU D487 Secure Software Design - Test Bank 3 (2026/2027)
Correct Answer: B
Rationale: Fail-Safe Defaults states that the default access level should be 'no access,' and protection mechanisms should deny access by
default, requiring explicit permission to grant access. Economy of Mechanism advocates for simple security designs. Open Design suggests
that security should not depend on secrecy of design. Complete Mediation requires that every access be checked against the access control
system rather than cached.
Q9: A security designer proposes hiding the encryption algorithm used to protect sensitive data to prevent attackers from
analyzing and exploiting it. Which Saltzer and Schroeder principle does this approach violate?
A. Fail-Safe Defaults
B. Economy of Mechanism
C. Open Design
D. Least Privilege
Correct Answer: C
Rationale: The Open Design principle states that the security of a system should not depend on keeping its design or algorithms secret, as
security through obscurity is unreliable. Cryptographic algorithms should be publicly vetted and tested. Fail-Safe Defaults relates to
default-deny access policies. Economy of Mechanism favors simplicity. Least Privilege limits permissions to the minimum necessary.
Q10: A system caches user permissions after initial login and does not re-check access rights for subsequent requests
within the same session. Which Saltzer and Schroeder principle is most directly violated?
A. Complete Mediation
B. Fail-Safe Defaults
C. Economy of Mechanism
D. Least Common Mechanism
Correct Answer: A
Rationale: Complete Mediation requires that every access request be checked against the access control system, not just the first one.
Caching permissions without re-checking means that revoked permissions may still be effective within a session. Fail-Safe Defaults relates
to default-deny policies. Economy of Mechanism favors design simplicity. Least Common Mechanism aims to minimize shared
mechanisms between users.
Q11: An application uses a single shared memory space for all user sessions to reduce resource consumption. Which
Saltzer and Schroeder principle does this design most directly violate?
A. Economy of Mechanism
B. Least Common Mechanism
C. Psychological Acceptability
D. Separation of Privilege
Correct Answer: B
Rationale: Least Common Mechanism states that mechanisms should be minimized to reduce the potential for shared channels to be
exploited. A shared memory space for all sessions creates a common mechanism that could allow one user's data to leak to another.
Economy of Mechanism favors simplicity. Psychological Acceptability ensures usability. Separation of Privilege requires multiple
conditions for privileged operations.
Q12: A development team implements a highly complex security subsystem with 47 interdependent configuration
parameters to protect an application. Which Saltzer and Schroeder principle does this approach risk violating?
A. Economy of Mechanism
B. Open Design
C. Fail-Safe Defaults
D. Complete Mediation
Correct Answer: A
Rationale: Economy of Mechanism recommends that security designs should be as simple and small as possible, because complex
mechanisms are more likely to contain flaws and be difficult to verify. A subsystem with 47 interdependent parameters is overly complex
and prone to misconfiguration. Open Design relates to not relying on secrecy. Fail-Safe Defaults and Complete Mediation address
different aspects of access control.
Q13: A secure email system implements digital signatures by requiring two separate administrators to authorize the
release of a user's private key from the key escrow system. Which Saltzer and Schroeder principle does this best
illustrate?
Page 3
, WGU D487 Secure Software Design - Test Bank 3 (2026/2027)
A. Economy of Mechanism
B. Separation of Privilege
C. Psychological Acceptability
D. Least Common Mechanism
Correct Answer: B
Rationale: Separation of Privilege requires that access to sensitive operations should require multiple conditions or parties to be satisfied,
preventing any single individual from having complete control. Requiring two administrators to authorize key release ensures no single
point of compromise. Economy of Mechanism favors simplicity. Psychological Acceptability relates to usability. Least Common
Mechanism minimizes shared channels.
Q14: An organization deploys a security control that requires users to complete a 23-step authentication process with
multiple CAPTCHA challenges, hardware token rotations, and biometric scans for every single API call. Which principle
is most likely being violated?
A. Economy of Mechanism
B. Psychological Acceptability
C. Fail-Safe Defaults
D. Open Design
Correct Answer: B
Rationale: Psychological Acceptability states that security mechanisms should be easy to use and not unduly interfere with users' work, as
overly complex controls will be bypassed or resisted. A 23-step process for every API call is impractical and would likely be circumvented.
Economy of Mechanism addresses design simplicity. Fail-Safe Defaults and Open Design address access policies and transparency
respectively.
Q15: A microservices architecture implements mutual TLS (mTLS) between all services, enforces per-service JWT
validation, and applies network micro-segmentation to restrict lateral movement. Which security approach is most closely
aligned with this design?
A. Defense-in-Depth
B. Zero Trust Architecture
C. Attack Surface Minimization
D. Separation of Duties
Correct Answer: B
Rationale: Zero Trust Architecture emphasizes 'never trust, always verify' with micro-segmentation, continuous authentication (mTLS,
JWT), and least privilege access between services. While Defense-in-Depth also uses multiple layers, Zero Trust specifically focuses on
verifying every inter-service communication regardless of network location. Attack Surface Minimization reduces entry points, and
Separation of Duties divides responsibilities among people.
Q16: Which of the following best describes the relationship between the CIA Triad and secure software design?
A. The CIA Triad is outdated and has been replaced by the IAAA framework in modern secure design
B. The CIA Triad provides foundational goals that guide all secure design decisions throughout the SDLC
C. The CIA Triad applies only to network security and is irrelevant to application security
D. The CIA Triad is a compliance requirement only relevant to government systems
Correct Answer: B
Rationale: The CIA Triad (Confidentiality, Integrity, Availability) provides the three foundational security goals that guide all secure
software design decisions throughout the Software Development Lifecycle. These principles are not outdated and apply to all types of
systems, not just network security or government compliance. The IAAA framework complements rather than replaces the CIA Triad.
Q17: A healthcare application ensures that only authorized doctors can view patient records (Confidentiality), that records
cannot be tampered with (Integrity), and that records are accessible during emergencies (Availability). Which security
design approach is being demonstrated?
A. Risk-based security prioritization
B. Comprehensive application of the CIA Triad
C. Zero Trust Architecture implementation
D. Threat modeling using STRIDE
Correct Answer: B
Page 4
Test Bank 3 With Questions And Correct Answers
Secure Software Design Objective Assessment
100% Correct Verified Answers
150 Questions | 8 Sections | Scenario-Based and Recall
Section 1: Secure Design Principles and Frameworks (Q1-Q25)
Q1: A software architect is designing a financial application that processes online transactions. The system must ensure
that transaction data is not altered during transmission and that the system remains operational even during peak trading
hours. Which two CIA Triad principles are most directly involved in these requirements?
A. Confidentiality and Integrity
B. Integrity and Availability
C. Confidentiality and Availability
D. Accountability and Integrity
Correct Answer: B
Rationale: Integrity ensures that transaction data is not altered during transmission, which is critical for financial accuracy. Availability
ensures the system remains operational during peak trading hours so users can complete transactions. Confidentiality relates to data
secrecy, which is not the primary concern described in the scenario. Accountability is part of IAAA, not the CIA Triad.
Q2: An organization implements a security model where users must present a smart card (something they have) and enter
a PIN (something they know) to access sensitive systems. Which IAAA component does this multi-factor approach
primarily strengthen?
A. Identification
B. Authentication
C. Authorization
D. Accountability
Correct Answer: B
Rationale: Authentication is the process of verifying a claimed identity, and multi-factor authentication strengthens this by requiring
multiple independent verification factors. Identification is merely claiming an identity (e.g., username). Authorization determines what
actions an authenticated user may perform. Accountability ensures actions are traceable to individuals through logging and auditing.
Q3: A security engineer recommends deploying network firewalls, host-based intrusion detection systems,
application-layer input validation, and database encryption for a web application. Which security strategy best describes
this multi-layered approach?
A. Zero Trust Architecture
B. Principle of Least Privilege
C. Defense-in-Depth
D. Attack Surface Minimization
Correct Answer: C
Rationale: Defense-in-Depth employs multiple overlapping security controls at different layers (network, host, application, and data) so
that if one control fails, others continue to protect the system. Zero Trust focuses on continuous verification rather than layered controls.
Least Privilege limits permissions but does not inherently involve multiple layers. Attack Surface Minimization reduces entry points but does
not describe the layered deployment strategy.
, WGU D487 Secure Software Design - Test Bank 3 (2026/2027)
Q4: A web application grants all authenticated users the 'admin' role by default, allowing them to access configuration
settings and user management functions. Which security principle is being violated?
A. Separation of Duties
B. Principle of Least Privilege
C. Defense-in-Depth
D. Fail-Safe Defaults
Correct Answer: B
Rationale: The Principle of Least Privilege states that users should be granted only the minimum permissions necessary to perform their
tasks. Granting all users admin access by default provides excessive permissions, increasing the attack surface and potential damage from
compromised accounts. Separation of Duties divides critical functions among multiple roles, which is related but distinct. Defense-in-Depth
involves multiple layers of controls, and Fail-Safe Defaults relates to default-deny configurations.
Q5: In a payment processing system, the same employee is authorized to both create new vendor records and approve
payments to those vendors. Which security principle is most directly violated by this configuration?
A. Principle of Least Privilege
B. Separation of Duties
C. Defense-in-Depth
D. Complete Mediation
Correct Answer: B
Rationale: Separation of Duties requires that critical functions be divided among multiple individuals to prevent fraud and errors. Allowing
one person to both create vendors and approve payments creates a single point of failure for embezzlement. Least Privilege limits
permission levels but does not specifically address dividing conflicting duties. Defense-in-Depth involves layered controls, and Complete
Mediation requires every access to be checked rather than addressing duty division.
Q6: A security auditor discovers that a production server has 15 open ports, with 9 of them supporting services that are no
longer used by the application. Which security principle should be applied to address this finding?
A. Attack Surface Minimization
B. Zero Trust Architecture
C. Separation of Privilege
D. Psychological Acceptability
Correct Answer: A
Rationale: Attack Surface Minimization involves reducing the number of entry points available to attackers by closing unused ports,
disabling unnecessary services, and removing unused functionality. The 9 unused open ports represent an unnecessarily large attack
surface. Zero Trust focuses on continuous verification of every access request. Separation of Privilege requires multiple conditions for
privileged operations. Psychological Acceptability ensures security measures are usable.
Q7: An organization has adopted a security model where no user, device, or network segment is inherently trusted,
regardless of its location relative to the network perimeter. Every access request must be authenticated, authorized, and
encrypted in real time. Which architecture does this describe?
A. Defense-in-Depth
B. Zero Trust Architecture
C. Border Security Model
D. Network Segmentation Strategy
Correct Answer: B
Rationale: Zero Trust Architecture operates on the principle of 'never trust, always verify,' eliminating the concept of a trusted internal
network. Every access request requires continuous authentication, authorization, and encryption regardless of network location.
Defense-in-Depth uses multiple overlapping layers but still may trust internal segments. Border Security Models rely on perimeter defenses.
Network Segmentation divides networks but does not inherently implement continuous verification.
Q8: According to the Saltzer and Schroeder security design principles, a system should default to denying access and
require explicit permission to grant access. Which specific principle does this describe?
A. Economy of Mechanism
B. Fail-Safe Defaults
C. Open Design
D. Complete Mediation
Page 2
, WGU D487 Secure Software Design - Test Bank 3 (2026/2027)
Correct Answer: B
Rationale: Fail-Safe Defaults states that the default access level should be 'no access,' and protection mechanisms should deny access by
default, requiring explicit permission to grant access. Economy of Mechanism advocates for simple security designs. Open Design suggests
that security should not depend on secrecy of design. Complete Mediation requires that every access be checked against the access control
system rather than cached.
Q9: A security designer proposes hiding the encryption algorithm used to protect sensitive data to prevent attackers from
analyzing and exploiting it. Which Saltzer and Schroeder principle does this approach violate?
A. Fail-Safe Defaults
B. Economy of Mechanism
C. Open Design
D. Least Privilege
Correct Answer: C
Rationale: The Open Design principle states that the security of a system should not depend on keeping its design or algorithms secret, as
security through obscurity is unreliable. Cryptographic algorithms should be publicly vetted and tested. Fail-Safe Defaults relates to
default-deny access policies. Economy of Mechanism favors simplicity. Least Privilege limits permissions to the minimum necessary.
Q10: A system caches user permissions after initial login and does not re-check access rights for subsequent requests
within the same session. Which Saltzer and Schroeder principle is most directly violated?
A. Complete Mediation
B. Fail-Safe Defaults
C. Economy of Mechanism
D. Least Common Mechanism
Correct Answer: A
Rationale: Complete Mediation requires that every access request be checked against the access control system, not just the first one.
Caching permissions without re-checking means that revoked permissions may still be effective within a session. Fail-Safe Defaults relates
to default-deny policies. Economy of Mechanism favors design simplicity. Least Common Mechanism aims to minimize shared
mechanisms between users.
Q11: An application uses a single shared memory space for all user sessions to reduce resource consumption. Which
Saltzer and Schroeder principle does this design most directly violate?
A. Economy of Mechanism
B. Least Common Mechanism
C. Psychological Acceptability
D. Separation of Privilege
Correct Answer: B
Rationale: Least Common Mechanism states that mechanisms should be minimized to reduce the potential for shared channels to be
exploited. A shared memory space for all sessions creates a common mechanism that could allow one user's data to leak to another.
Economy of Mechanism favors simplicity. Psychological Acceptability ensures usability. Separation of Privilege requires multiple
conditions for privileged operations.
Q12: A development team implements a highly complex security subsystem with 47 interdependent configuration
parameters to protect an application. Which Saltzer and Schroeder principle does this approach risk violating?
A. Economy of Mechanism
B. Open Design
C. Fail-Safe Defaults
D. Complete Mediation
Correct Answer: A
Rationale: Economy of Mechanism recommends that security designs should be as simple and small as possible, because complex
mechanisms are more likely to contain flaws and be difficult to verify. A subsystem with 47 interdependent parameters is overly complex
and prone to misconfiguration. Open Design relates to not relying on secrecy. Fail-Safe Defaults and Complete Mediation address
different aspects of access control.
Q13: A secure email system implements digital signatures by requiring two separate administrators to authorize the
release of a user's private key from the key escrow system. Which Saltzer and Schroeder principle does this best
illustrate?
Page 3
, WGU D487 Secure Software Design - Test Bank 3 (2026/2027)
A. Economy of Mechanism
B. Separation of Privilege
C. Psychological Acceptability
D. Least Common Mechanism
Correct Answer: B
Rationale: Separation of Privilege requires that access to sensitive operations should require multiple conditions or parties to be satisfied,
preventing any single individual from having complete control. Requiring two administrators to authorize key release ensures no single
point of compromise. Economy of Mechanism favors simplicity. Psychological Acceptability relates to usability. Least Common
Mechanism minimizes shared channels.
Q14: An organization deploys a security control that requires users to complete a 23-step authentication process with
multiple CAPTCHA challenges, hardware token rotations, and biometric scans for every single API call. Which principle
is most likely being violated?
A. Economy of Mechanism
B. Psychological Acceptability
C. Fail-Safe Defaults
D. Open Design
Correct Answer: B
Rationale: Psychological Acceptability states that security mechanisms should be easy to use and not unduly interfere with users' work, as
overly complex controls will be bypassed or resisted. A 23-step process for every API call is impractical and would likely be circumvented.
Economy of Mechanism addresses design simplicity. Fail-Safe Defaults and Open Design address access policies and transparency
respectively.
Q15: A microservices architecture implements mutual TLS (mTLS) between all services, enforces per-service JWT
validation, and applies network micro-segmentation to restrict lateral movement. Which security approach is most closely
aligned with this design?
A. Defense-in-Depth
B. Zero Trust Architecture
C. Attack Surface Minimization
D. Separation of Duties
Correct Answer: B
Rationale: Zero Trust Architecture emphasizes 'never trust, always verify' with micro-segmentation, continuous authentication (mTLS,
JWT), and least privilege access between services. While Defense-in-Depth also uses multiple layers, Zero Trust specifically focuses on
verifying every inter-service communication regardless of network location. Attack Surface Minimization reduces entry points, and
Separation of Duties divides responsibilities among people.
Q16: Which of the following best describes the relationship between the CIA Triad and secure software design?
A. The CIA Triad is outdated and has been replaced by the IAAA framework in modern secure design
B. The CIA Triad provides foundational goals that guide all secure design decisions throughout the SDLC
C. The CIA Triad applies only to network security and is irrelevant to application security
D. The CIA Triad is a compliance requirement only relevant to government systems
Correct Answer: B
Rationale: The CIA Triad (Confidentiality, Integrity, Availability) provides the three foundational security goals that guide all secure
software design decisions throughout the Software Development Lifecycle. These principles are not outdated and apply to all types of
systems, not just network security or government compliance. The IAAA framework complements rather than replaces the CIA Triad.
Q17: A healthcare application ensures that only authorized doctors can view patient records (Confidentiality), that records
cannot be tampered with (Integrity), and that records are accessible during emergencies (Availability). Which security
design approach is being demonstrated?
A. Risk-based security prioritization
B. Comprehensive application of the CIA Triad
C. Zero Trust Architecture implementation
D. Threat modeling using STRIDE
Correct Answer: B
Page 4
