WGU · SECURE SOFTWARE DESIGN · SDLC
2026/2027 WGU D487 OA TEST BANK WITH QUESTIONS AND CORRECT ANSWERS (100%
CORRECT ANSWERS) D487 SECURE SOFTWARE DESIGN OBJECTIVE ASSESSMENT
2026/2027 TEST BANK V1
2026/2027 Official Exam
A+ 5 100%
QUESTIONS EXAM DOMAINS RATIONALES
VERIFIED COVERED INCLUDED
CATEGORIES
■ Section 1: SDLC Security Principles, Frameworks & Secure Design (Q1–14)
■ Section 2: Threat Modeling & Risk Assessment (Q15–28)
■ Section 3: Secure Coding, Vulnerabilities & Controls (Q29–42)
■ Section 4: Security Testing Methodologies & Test Planning (Q43–56)
■ Section 5: DevSecOps, Agile Integration & Post-Release (Q57–70)
STUVIAACTUALEXAM
Original practice content aligned to publicly described WGU D487 Secure Software Design competencies. Not an official WGU product.
, SECTION 1: SDLC SECURITY PRINCIPLES, FRAMEWORKS & SECURE DESIGN
Q1. A product manager insists that security reviews can wait until the week before launch. The secure software lead explains that
postponing security work until late in the cycle typically causes:
A. Elimination of the need for threat modeling.
B. Higher remediation cost, schedule pressure, and greater likelihood that serious defects ship or force emergency redesign.
C. Lower overall project cost because security is cheaper at the end.
D. Automatic compliance with every regulatory framework.
Correct Answer: B
Rationale: Defects found late are far more expensive to fix; security by design reduces cost and risk by acting earlier.
Q2. An organization adopts the Microsoft SDL. One of the core practices expected during the requirements phase is:
A. Skipping architecture review for small features.
B. Disabling all logging to improve performance.
C. Defining security and privacy requirements and establishing quality gates that must be met before release.
D. Writing production exploit code for every anticipated vulnerability.
Correct Answer: C
Rationale: SDL front-loads security and privacy requirements and uses gates to enforce them.
Q3. A company uses BSIMM to benchmark its software security program against peer organizations. BSIMM’s value in this
context is that it:
A. Provides an empirical snapshot of activities actually performed so the firm can see relative maturity and target improvements.
B. Replaces the need for any internal security staff.
C. Dictates a single mandatory tool chain for every participant.
D. Guarantees that no vulnerabilities will appear in production.
Correct Answer: A
Rationale: BSIMM is observational and comparative, not a prescriptive checklist.
Q4. OWASP SAMM is selected to guide a multi-year improvement roadmap. SAMM is structured around:
A. Only the OWASP Top 10 vulnerability list without process guidance.
B. Hardware security module configuration exclusively.
C. Business functions such as governance, design, implementation, verification, and operations, each with successive maturity levels.
D. Marketing metrics for product launches.
Correct Answer: C
Rationale: SAMM organizes software assurance practices into measurable business functions and levels.
Q5. The secure design principle “complete mediation” requires that:
A. All users share one privileged service account.
B. Every request for a protected resource is checked for authorization, not merely the first request in a session.
C. Access control is implemented solely in client-side JavaScript.
D. Authorization is performed only at login and then cached forever.
Correct Answer: B
Rationale: Complete mediation ensures decisions reflect current policy on every access.
Q6. Applying the principle of least common mechanism means that:
A. Isolation between users is never required.
B. Shared resources or mechanisms among users are minimized because they can become channels for unintended information flow
or interference.
C. Every user must share the same memory space for efficiency.
D. A single global configuration file is preferred for all tenants.
Correct Answer: B
Rationale: Shared mechanisms can create covert channels and coupling; isolation improves security.
STUVIAACTUALEXAM | Page 2 of 14
2026/2027 WGU D487 OA TEST BANK WITH QUESTIONS AND CORRECT ANSWERS (100%
CORRECT ANSWERS) D487 SECURE SOFTWARE DESIGN OBJECTIVE ASSESSMENT
2026/2027 TEST BANK V1
2026/2027 Official Exam
A+ 5 100%
QUESTIONS EXAM DOMAINS RATIONALES
VERIFIED COVERED INCLUDED
CATEGORIES
■ Section 1: SDLC Security Principles, Frameworks & Secure Design (Q1–14)
■ Section 2: Threat Modeling & Risk Assessment (Q15–28)
■ Section 3: Secure Coding, Vulnerabilities & Controls (Q29–42)
■ Section 4: Security Testing Methodologies & Test Planning (Q43–56)
■ Section 5: DevSecOps, Agile Integration & Post-Release (Q57–70)
STUVIAACTUALEXAM
Original practice content aligned to publicly described WGU D487 Secure Software Design competencies. Not an official WGU product.
, SECTION 1: SDLC SECURITY PRINCIPLES, FRAMEWORKS & SECURE DESIGN
Q1. A product manager insists that security reviews can wait until the week before launch. The secure software lead explains that
postponing security work until late in the cycle typically causes:
A. Elimination of the need for threat modeling.
B. Higher remediation cost, schedule pressure, and greater likelihood that serious defects ship or force emergency redesign.
C. Lower overall project cost because security is cheaper at the end.
D. Automatic compliance with every regulatory framework.
Correct Answer: B
Rationale: Defects found late are far more expensive to fix; security by design reduces cost and risk by acting earlier.
Q2. An organization adopts the Microsoft SDL. One of the core practices expected during the requirements phase is:
A. Skipping architecture review for small features.
B. Disabling all logging to improve performance.
C. Defining security and privacy requirements and establishing quality gates that must be met before release.
D. Writing production exploit code for every anticipated vulnerability.
Correct Answer: C
Rationale: SDL front-loads security and privacy requirements and uses gates to enforce them.
Q3. A company uses BSIMM to benchmark its software security program against peer organizations. BSIMM’s value in this
context is that it:
A. Provides an empirical snapshot of activities actually performed so the firm can see relative maturity and target improvements.
B. Replaces the need for any internal security staff.
C. Dictates a single mandatory tool chain for every participant.
D. Guarantees that no vulnerabilities will appear in production.
Correct Answer: A
Rationale: BSIMM is observational and comparative, not a prescriptive checklist.
Q4. OWASP SAMM is selected to guide a multi-year improvement roadmap. SAMM is structured around:
A. Only the OWASP Top 10 vulnerability list without process guidance.
B. Hardware security module configuration exclusively.
C. Business functions such as governance, design, implementation, verification, and operations, each with successive maturity levels.
D. Marketing metrics for product launches.
Correct Answer: C
Rationale: SAMM organizes software assurance practices into measurable business functions and levels.
Q5. The secure design principle “complete mediation” requires that:
A. All users share one privileged service account.
B. Every request for a protected resource is checked for authorization, not merely the first request in a session.
C. Access control is implemented solely in client-side JavaScript.
D. Authorization is performed only at login and then cached forever.
Correct Answer: B
Rationale: Complete mediation ensures decisions reflect current policy on every access.
Q6. Applying the principle of least common mechanism means that:
A. Isolation between users is never required.
B. Shared resources or mechanisms among users are minimized because they can become channels for unintended information flow
or interference.
C. Every user must share the same memory space for efficiency.
D. A single global configuration file is preferred for all tenants.
Correct Answer: B
Rationale: Shared mechanisms can create covert channels and coupling; isolation improves security.
STUVIAACTUALEXAM | Page 2 of 14
