WGU D487 Secure Software Design
Exam Review | Complete Practice Exam
with 100% Verified Correct Answers and
Detailed Rationales | Latest Update -
2026/2027 | Already Graded A+
Question 1
What are the two deliverables of the Architecture phase of the SDL?
A. Application decomposition & Threat modeling artifacts
B. Information disclosure & Attack Modeling
C. Threat Modeling artifacts & Policy compliance analysis
D. Policy compliance analysis & Attack modeling
Answer: A
Rationale: The Architecture phase of the Security Development Lifecycle (SDL)
produces application decomposition (breaking down the application into
components) and threat modeling artifacts (documenting potential threats and
mitigations). These are the primary deliverables used to guide security design
decisions.
Question 2
What happens during a dynamic code review?
A. Programmers monitor system memory, functional behavior, response times, and
overall performance.
B. Customers perform tests to check software meets requirements.
C. An analysis of computer programs without executing them is performed.
D. Input fields are supplied with unexpected input and tested.
Answer: A
Rationale: Dynamic code review (or dynamic analysis) involves executing the
program and monitoring its behavior in real-time, including system memory,
pg. 1
,functional behavior, response times, and overall performance. Static code analysis
is performed without executing the code. Fuzz testing involves supplying
unexpected input.
Question 3
What are the advantages of the following security analysis tools? - Fuzz Testing
A. Access to the actual instructions the software will be guessing
B. Tests a specific operational deployment
C. Requires no supporting Technology
D. Testing in a random approach
Answer: B
Rationale: Fuzz testing tests a specific operational deployment by providing
invalid, unexpected, or random data as inputs to a computer program. It is effective
for finding buffer overflows, input validation errors, and other vulnerabilities. It
does not require access to source code.
Question 4
What is the goal of design security review deliverables?
A. To make modifications to the design of software components based on security
assessments
B. To create data flow diagrams, elements, and threat listings
C. To analyze adherence to company policies
D. To plan to mitigate, accept, or tolerate risk
Answer: A
Rationale: The goal of design security review deliverables is to make
modifications to the design of software components based on security assessments,
ensuring that security is built into the architecture from the start.
Question 5
How can you establish your own SDL to build security into a process appropriate
for your organization's needs based on the given environments? - Cloud
A. Enables and improves business activities
pg. 2
,B. Continues integration and continuous development
C. API invocation processes
D. Iterative Development
Answer: A
Rationale: In a cloud environment, establishing an SDL should enable and
improve business activities. The cloud environment is dynamic and requires
security to be integrated in a way that supports business agility and scalability.
Question 6
Which step will you find in the SANS Institute Cyber Defense seven-step recipe
for conducting threat modeling and application risk analysis?
A. Demonstrate improvement
B. Brainstorm threats from adversaries
C. Threat assessment
D. Conduct a BSIMM assessment
Answer: B
Rationale: The SANS Institute Cyber Defense seven-step recipe includes
"Brainstorm threats from adversaries" as a key step. This involves thinking like an
attacker to identify potential threats and vulnerabilities.
Question 7
Which phase of penetration testing allows for remediation to be performed?
A. Deploy
B. Identify
C. Assess
D. Evaluation and plan
Answer: D
Rationale: The Evaluation and plan phase of penetration testing allows for
remediation to be performed. After vulnerabilities are identified and assessed, the
organization can plan and implement remediation measures before final
deployment.
pg. 3
, Question 8
The company's website uses querystring parameters to filter products by category.
The URL, when filtering on a product category, looks like
this: company.com/products?category=2. If the security team saw a URL
of company.com/products?category=2 OR 1=1 in the logs, what assumption should
they make?
A. An attacker is attempting to access the system using credentials that do not
belong to them.
B. An attacker is attempting to force the application to throw an exception so they
may view exploitable information.
C. An attacker is attempting to use SQL injection to gain access to information.
D. An attacker is attempting to enter invalid characters in a textbox on the products
page.
Answer: C
Rationale: The input "2 OR 1=1" is a classic SQL injection attempt. The attacker
is trying to manipulate the SQL query to return all records (since 1=1 is always
true). This is a common technique to bypass authentication or extract data.
Question 9
Which security goal is defined by "guarding against improper information
modification or destruction and ensuring information non-repudiation and
authenticity"?
A. Reliability
B. Integrity
C. Availability
D. Quality
Answer: B
Rationale: Integrity is the security goal that guards against improper information
modification or destruction and ensures non-repudiation and authenticity.
Confidentiality is about keeping information secret; availability is about ensuring
access when needed.
pg. 4
Exam Review | Complete Practice Exam
with 100% Verified Correct Answers and
Detailed Rationales | Latest Update -
2026/2027 | Already Graded A+
Question 1
What are the two deliverables of the Architecture phase of the SDL?
A. Application decomposition & Threat modeling artifacts
B. Information disclosure & Attack Modeling
C. Threat Modeling artifacts & Policy compliance analysis
D. Policy compliance analysis & Attack modeling
Answer: A
Rationale: The Architecture phase of the Security Development Lifecycle (SDL)
produces application decomposition (breaking down the application into
components) and threat modeling artifacts (documenting potential threats and
mitigations). These are the primary deliverables used to guide security design
decisions.
Question 2
What happens during a dynamic code review?
A. Programmers monitor system memory, functional behavior, response times, and
overall performance.
B. Customers perform tests to check software meets requirements.
C. An analysis of computer programs without executing them is performed.
D. Input fields are supplied with unexpected input and tested.
Answer: A
Rationale: Dynamic code review (or dynamic analysis) involves executing the
program and monitoring its behavior in real-time, including system memory,
pg. 1
,functional behavior, response times, and overall performance. Static code analysis
is performed without executing the code. Fuzz testing involves supplying
unexpected input.
Question 3
What are the advantages of the following security analysis tools? - Fuzz Testing
A. Access to the actual instructions the software will be guessing
B. Tests a specific operational deployment
C. Requires no supporting Technology
D. Testing in a random approach
Answer: B
Rationale: Fuzz testing tests a specific operational deployment by providing
invalid, unexpected, or random data as inputs to a computer program. It is effective
for finding buffer overflows, input validation errors, and other vulnerabilities. It
does not require access to source code.
Question 4
What is the goal of design security review deliverables?
A. To make modifications to the design of software components based on security
assessments
B. To create data flow diagrams, elements, and threat listings
C. To analyze adherence to company policies
D. To plan to mitigate, accept, or tolerate risk
Answer: A
Rationale: The goal of design security review deliverables is to make
modifications to the design of software components based on security assessments,
ensuring that security is built into the architecture from the start.
Question 5
How can you establish your own SDL to build security into a process appropriate
for your organization's needs based on the given environments? - Cloud
A. Enables and improves business activities
pg. 2
,B. Continues integration and continuous development
C. API invocation processes
D. Iterative Development
Answer: A
Rationale: In a cloud environment, establishing an SDL should enable and
improve business activities. The cloud environment is dynamic and requires
security to be integrated in a way that supports business agility and scalability.
Question 6
Which step will you find in the SANS Institute Cyber Defense seven-step recipe
for conducting threat modeling and application risk analysis?
A. Demonstrate improvement
B. Brainstorm threats from adversaries
C. Threat assessment
D. Conduct a BSIMM assessment
Answer: B
Rationale: The SANS Institute Cyber Defense seven-step recipe includes
"Brainstorm threats from adversaries" as a key step. This involves thinking like an
attacker to identify potential threats and vulnerabilities.
Question 7
Which phase of penetration testing allows for remediation to be performed?
A. Deploy
B. Identify
C. Assess
D. Evaluation and plan
Answer: D
Rationale: The Evaluation and plan phase of penetration testing allows for
remediation to be performed. After vulnerabilities are identified and assessed, the
organization can plan and implement remediation measures before final
deployment.
pg. 3
, Question 8
The company's website uses querystring parameters to filter products by category.
The URL, when filtering on a product category, looks like
this: company.com/products?category=2. If the security team saw a URL
of company.com/products?category=2 OR 1=1 in the logs, what assumption should
they make?
A. An attacker is attempting to access the system using credentials that do not
belong to them.
B. An attacker is attempting to force the application to throw an exception so they
may view exploitable information.
C. An attacker is attempting to use SQL injection to gain access to information.
D. An attacker is attempting to enter invalid characters in a textbox on the products
page.
Answer: C
Rationale: The input "2 OR 1=1" is a classic SQL injection attempt. The attacker
is trying to manipulate the SQL query to return all records (since 1=1 is always
true). This is a common technique to bypass authentication or extract data.
Question 9
Which security goal is defined by "guarding against improper information
modification or destruction and ensuring information non-repudiation and
authenticity"?
A. Reliability
B. Integrity
C. Availability
D. Quality
Answer: B
Rationale: Integrity is the security goal that guards against improper information
modification or destruction and ensures non-repudiation and authenticity.
Confidentiality is about keeping information secret; availability is about ensuring
access when needed.
pg. 4
