WGU · SECURE SOFTWARE DESIGN
2026/2027 D487 SECURE SOFTWARE DESIGN PREP QUESTIONS AND A+
CORRECT ANSWERS WITH RATIONALES FOR OA AND
PRE-ASSESSMENT PRACTICE PLUS STUDY GUIDE | WGU D487 EXAM
PREP TEST BANK 2026/2027
2026/2027
Official-Style Examination · Application & Analysis Level · Verified Rationales
A+ 5 100%
QUESTIONS EXAM DOMAINS RATIONALES
VERIFIED COVERED INCLUDED
CATEGORIES
■ 1. Secure SDLC & Security Requirements
■ 2. Threat Modeling & Risk Assessment
■ 3. Secure Architecture & Design Principles
■ 4. Security Testing & Vulnerability Analysis
■ 5. DevSecOps, Compliance & Privacy
Passing Score: 75% | Marks: 1 per question | Total: 70 marks
STUVIAACTUALEXAM
STUVIAACTUALEXAM Page 1
, SECTION 1 — Secure SDLC & Security Requirements
Q1. A development team traditionally added security testing only in the final week before release. The security architect recommends
adopting Security Development Lifecycle (SDL) practices. The primary benefit of integrating security earlier in the SDLC is to:
A. Eliminate the need for any testing after coding begins
B. Replace all functional requirements with security requirements
C. Guarantee that no vulnerabilities will ever exist in production
D. Identify and remediate defects when they are less costly and less disruptive to fix
Correct Answer: D
Rationale: Defects found late are far more expensive to fix. SDL shifts security activities left so threats and weaknesses are addressed during requirements,
design, and implementation rather than only at the end.
Q2. During the security assessment phase of an SDL project, the team produces a product risk profile. This deliverable is mainly used to:
A. Characterize the product’s exposure, data sensitivity, and regulatory context so that subsequent SDL activities can be scoped appropriately
B. Replace the need for threat modeling later
C. List only the names of developers on the project
D. Document marketing claims about security features
Correct Answer: A
Rationale: A risk profile guides how much security rigor is needed—high-risk products handling sensitive data receive deeper threat modeling, testing, and
review than low-risk internal tools.
Q3. A product owner asks why security requirements cannot simply be copied from a previous project. The best explanation is that:
A. Security requirements are identical for every application
B. Security requirements are written only by external auditors
C. Security requirements must reflect the specific assets, threats, compliance obligations, and architecture of the current system
D. Functional requirements already cover all security needs
Correct Answer: C
Rationale: Threats, data classification, and regulatory scope differ by product. Tailored security requirements ensure controls match actual risk rather than
generic checklists.
Q4. In an Agile team practicing DevSecOps, security user stories are added to the backlog. This practice primarily supports:
A. Deferring all security work to a hardening sprint after feature complete
B. Treating security as a first-class requirement that is estimated, prioritized, and verified within normal iterations
C. Eliminating the role of security champions
D. Removing automated tests from the pipeline
Correct Answer: B
Rationale: Backlog security stories make security visible, prioritizable, and testable alongside functional work, which is essential for continuous delivery of
secure software.
Q5. A privacy impact assessment (PIA) is most appropriate when:
A. The system will collect, process, or share personal data and the organization needs to evaluate privacy risks and controls
B. The system stores only public marketing brochures
C. The project has no external users
D. The only concern is password length
Correct Answer: A
Rationale: PIAs systematically examine how personal data is handled, identify privacy risks, and document mitigations—especially important under GDPR,
CCPA, and similar regimes.
Q6. The difference between the SDL and a generic SDLC is best described as:
A. SDL replaces the entire software development process with penetration testing only
B. SDL is used only for hardware projects
C. SDL embeds specific security activities, gates, and deliverables into each phase of the broader SDLC
D. SDLC never includes testing of any kind
Correct Answer: C
Rationale: SDLC is the overall process of building software. SDL is the set of security-focused practices integrated into that lifecycle so security is designed
in rather than bolted on.
Q7. A security gate at the end of the design phase requires evidence of completed threat modeling before coding begins. This gate exists
primarily to:
A. Slow the project for bureaucratic reasons
B. Replace code review entirely
C. Allow developers to skip unit testing
D. Ensure critical design-level security decisions are made before implementation locks in architecture that is hard to change
Correct Answer: D
Rationale: Gates enforce completion of high-value security activities at points where findings can still influence design. Skipping design-time analysis often
leads to expensive rework.
STUVIAACTUALEXAM Page 2
2026/2027 D487 SECURE SOFTWARE DESIGN PREP QUESTIONS AND A+
CORRECT ANSWERS WITH RATIONALES FOR OA AND
PRE-ASSESSMENT PRACTICE PLUS STUDY GUIDE | WGU D487 EXAM
PREP TEST BANK 2026/2027
2026/2027
Official-Style Examination · Application & Analysis Level · Verified Rationales
A+ 5 100%
QUESTIONS EXAM DOMAINS RATIONALES
VERIFIED COVERED INCLUDED
CATEGORIES
■ 1. Secure SDLC & Security Requirements
■ 2. Threat Modeling & Risk Assessment
■ 3. Secure Architecture & Design Principles
■ 4. Security Testing & Vulnerability Analysis
■ 5. DevSecOps, Compliance & Privacy
Passing Score: 75% | Marks: 1 per question | Total: 70 marks
STUVIAACTUALEXAM
STUVIAACTUALEXAM Page 1
, SECTION 1 — Secure SDLC & Security Requirements
Q1. A development team traditionally added security testing only in the final week before release. The security architect recommends
adopting Security Development Lifecycle (SDL) practices. The primary benefit of integrating security earlier in the SDLC is to:
A. Eliminate the need for any testing after coding begins
B. Replace all functional requirements with security requirements
C. Guarantee that no vulnerabilities will ever exist in production
D. Identify and remediate defects when they are less costly and less disruptive to fix
Correct Answer: D
Rationale: Defects found late are far more expensive to fix. SDL shifts security activities left so threats and weaknesses are addressed during requirements,
design, and implementation rather than only at the end.
Q2. During the security assessment phase of an SDL project, the team produces a product risk profile. This deliverable is mainly used to:
A. Characterize the product’s exposure, data sensitivity, and regulatory context so that subsequent SDL activities can be scoped appropriately
B. Replace the need for threat modeling later
C. List only the names of developers on the project
D. Document marketing claims about security features
Correct Answer: A
Rationale: A risk profile guides how much security rigor is needed—high-risk products handling sensitive data receive deeper threat modeling, testing, and
review than low-risk internal tools.
Q3. A product owner asks why security requirements cannot simply be copied from a previous project. The best explanation is that:
A. Security requirements are identical for every application
B. Security requirements are written only by external auditors
C. Security requirements must reflect the specific assets, threats, compliance obligations, and architecture of the current system
D. Functional requirements already cover all security needs
Correct Answer: C
Rationale: Threats, data classification, and regulatory scope differ by product. Tailored security requirements ensure controls match actual risk rather than
generic checklists.
Q4. In an Agile team practicing DevSecOps, security user stories are added to the backlog. This practice primarily supports:
A. Deferring all security work to a hardening sprint after feature complete
B. Treating security as a first-class requirement that is estimated, prioritized, and verified within normal iterations
C. Eliminating the role of security champions
D. Removing automated tests from the pipeline
Correct Answer: B
Rationale: Backlog security stories make security visible, prioritizable, and testable alongside functional work, which is essential for continuous delivery of
secure software.
Q5. A privacy impact assessment (PIA) is most appropriate when:
A. The system will collect, process, or share personal data and the organization needs to evaluate privacy risks and controls
B. The system stores only public marketing brochures
C. The project has no external users
D. The only concern is password length
Correct Answer: A
Rationale: PIAs systematically examine how personal data is handled, identify privacy risks, and document mitigations—especially important under GDPR,
CCPA, and similar regimes.
Q6. The difference between the SDL and a generic SDLC is best described as:
A. SDL replaces the entire software development process with penetration testing only
B. SDL is used only for hardware projects
C. SDL embeds specific security activities, gates, and deliverables into each phase of the broader SDLC
D. SDLC never includes testing of any kind
Correct Answer: C
Rationale: SDLC is the overall process of building software. SDL is the set of security-focused practices integrated into that lifecycle so security is designed
in rather than bolted on.
Q7. A security gate at the end of the design phase requires evidence of completed threat modeling before coding begins. This gate exists
primarily to:
A. Slow the project for bureaucratic reasons
B. Replace code review entirely
C. Allow developers to skip unit testing
D. Ensure critical design-level security decisions are made before implementation locks in architecture that is hard to change
Correct Answer: D
Rationale: Gates enforce completion of high-value security activities at points where findings can still influence design. Skipping design-time analysis often
leads to expensive rework.
STUVIAACTUALEXAM Page 2
