2025 D487 SECURE SOFTWARE DESIGN 200
PREP QUESTIONS AND CORRECT ANSWERS
WITH RATIONALES FOR OA AND PRE-
ASSESSMENT PRACTICE PLUS STUDY GUIDE/
WGU D487 EXAM PREP TEST BANK 2025
What is the reason software security teams host discovery meetings with
stakeholders early in the development life cycle?
To determine how much budget is available for new security tools
To meet the development team
To refactor functional requirements to ensure security is included
To ensure that security is built into the product from the start
To ensure that security is built into the product from the start
To correctly and cost-effectively introduce security into the software development
life cycle, it needs to be done early.
Why should a security team provide documented certification requirements during
the software assessment phase?
Certification is required if the organization wants to move to the cloud.
Depending on the environment in which the product resides, certifications may be
required by corporate or government entities before the software can be released to
customers.
By ensuring software products are certified, the organization is protected from
future litigation.
By ensuring all developers have security certifications before writing any code,
teams can forego discovery sessions.
Depending on the environment in which the product resides, certifications may be
required by corporate or government entities before the software can be released to
customers.
Any new product may need to be certified based on the data it stores, the
frameworks it uses, or the domain in which it resides. Those certification
pg. 1
,requirements need to be analyzed and documented early in the development life
cycle.
Which type of attack occurs when an attacker uses malicious code in the data sent
in a form?
SQL injection
Distributed Denial-of-Service (DDoS)
Cross-site scripting
Man-in-the-middle attack
Cross-site scripting
Cross-site scripting (XSS) attacks are a type of injection in which attackers use
scripts that are injected into otherwise benign and trusted websites.
Which step will you find in the SANS Institute Cyber Defense seven-step recipe
for conducting threat modeling and application risk analysis?
Threat assessment
Conduct a BSIMM assessment
Demonstrate improvement
Brainstorm threats from adversaries
Brainstorm threats from adversaries
Brainstorm threats from adversaries is step 4 in the SANS Institute recipe.
In which OpenSAMM core practice area would one find environment hardening?
Governance
Deployment
Verification
Construction
Deployment
The deployment core practice area contains environment hardening, vulnerability
management, and operational enablement.
What are two steps of the threat modeling process?Choose 2 answers.
Survey the application
Decompose the application
Redesign the process to eliminate the threat
pg. 2
,Transfer the risk
Identify business requirements
Survey the application
Decompose the application
"Survey the application" is correct. Surveying the application is a way to gain
knowledge of how the product works by reading product documentation and
interviewing the development team.
"Decompose the application" is correct. Decomposing the application can be done
by doing a deep dive into the code and understanding how it works behind the
scenes.
What are the two common best principles of software applications in the
development process? Choose 2 answers.
Quality code
Secure code
Information security
Integrity
Availability
Quality code
Secure code
"Quality code" is correct. Quality code is efficient code that is easy to maintain and
reusable.
"Secure code" is correct. Secure code authorizes and authenticates every user
transaction, logs the transaction, and denies all unauthorized requisitions.
The company's website uses querystring parameters to filter products by category.
The URL, when filtering on a product category, looks like
this: company.com/products?category=2.If the security team saw a URL
of company.com/products?category=2 OR 1=1 in the logs, what assumption
should they make?
An attacker is attempting to enter invalid characters in a textbox on the products
page.
An attacker is attempting to use SQL injection to gain access to information.
pg. 3
, An attacker is attempting to force the application to throw an exception so they
may view exploitable information.
An attacker is attempting to access the system using credentials that do not belong
to them.
An attacker is attempting to use SQL injection to gain access to information.
An SQL injection attack attempts to gain access to information with malformed
query parameters.
What determines the order of items in a product backlog in Scrum?
Order is decided by the Scrum Team
Order is decided by the ScrumMaster
Order is decided by the project manager
Order is decided based on value of the items being delivered
Order is decided based on value of the items being delivered
Order is decided based on the value of the item/requirement in the backlog as it
helps business when the item is done and business can start using it. The Product
Owner decides the order of items in the backlog.
Which post-release support activity (PRSA) details the process for investigating,
mitigating, and communicating findings when security vulnerabilities are
discovered in a software product?
Internal review for new product combinations or cloud deployment
Third-party reviews
Post-release certifications
External vulnerability disclosure response
External vulnerability disclosure response
The external vulnerability disclosure response (PRSA1) defines processes to
evaluate and mitigate security vulnerabilities discovered after release. It also
details how the organization will communicate to customers.
What ensures that the user has the appropriate role and privilege to view data?
Authentication
Multi-factor authentication
Encryption
pg. 4
PREP QUESTIONS AND CORRECT ANSWERS
WITH RATIONALES FOR OA AND PRE-
ASSESSMENT PRACTICE PLUS STUDY GUIDE/
WGU D487 EXAM PREP TEST BANK 2025
What is the reason software security teams host discovery meetings with
stakeholders early in the development life cycle?
To determine how much budget is available for new security tools
To meet the development team
To refactor functional requirements to ensure security is included
To ensure that security is built into the product from the start
To ensure that security is built into the product from the start
To correctly and cost-effectively introduce security into the software development
life cycle, it needs to be done early.
Why should a security team provide documented certification requirements during
the software assessment phase?
Certification is required if the organization wants to move to the cloud.
Depending on the environment in which the product resides, certifications may be
required by corporate or government entities before the software can be released to
customers.
By ensuring software products are certified, the organization is protected from
future litigation.
By ensuring all developers have security certifications before writing any code,
teams can forego discovery sessions.
Depending on the environment in which the product resides, certifications may be
required by corporate or government entities before the software can be released to
customers.
Any new product may need to be certified based on the data it stores, the
frameworks it uses, or the domain in which it resides. Those certification
pg. 1
,requirements need to be analyzed and documented early in the development life
cycle.
Which type of attack occurs when an attacker uses malicious code in the data sent
in a form?
SQL injection
Distributed Denial-of-Service (DDoS)
Cross-site scripting
Man-in-the-middle attack
Cross-site scripting
Cross-site scripting (XSS) attacks are a type of injection in which attackers use
scripts that are injected into otherwise benign and trusted websites.
Which step will you find in the SANS Institute Cyber Defense seven-step recipe
for conducting threat modeling and application risk analysis?
Threat assessment
Conduct a BSIMM assessment
Demonstrate improvement
Brainstorm threats from adversaries
Brainstorm threats from adversaries
Brainstorm threats from adversaries is step 4 in the SANS Institute recipe.
In which OpenSAMM core practice area would one find environment hardening?
Governance
Deployment
Verification
Construction
Deployment
The deployment core practice area contains environment hardening, vulnerability
management, and operational enablement.
What are two steps of the threat modeling process?Choose 2 answers.
Survey the application
Decompose the application
Redesign the process to eliminate the threat
pg. 2
,Transfer the risk
Identify business requirements
Survey the application
Decompose the application
"Survey the application" is correct. Surveying the application is a way to gain
knowledge of how the product works by reading product documentation and
interviewing the development team.
"Decompose the application" is correct. Decomposing the application can be done
by doing a deep dive into the code and understanding how it works behind the
scenes.
What are the two common best principles of software applications in the
development process? Choose 2 answers.
Quality code
Secure code
Information security
Integrity
Availability
Quality code
Secure code
"Quality code" is correct. Quality code is efficient code that is easy to maintain and
reusable.
"Secure code" is correct. Secure code authorizes and authenticates every user
transaction, logs the transaction, and denies all unauthorized requisitions.
The company's website uses querystring parameters to filter products by category.
The URL, when filtering on a product category, looks like
this: company.com/products?category=2.If the security team saw a URL
of company.com/products?category=2 OR 1=1 in the logs, what assumption
should they make?
An attacker is attempting to enter invalid characters in a textbox on the products
page.
An attacker is attempting to use SQL injection to gain access to information.
pg. 3
, An attacker is attempting to force the application to throw an exception so they
may view exploitable information.
An attacker is attempting to access the system using credentials that do not belong
to them.
An attacker is attempting to use SQL injection to gain access to information.
An SQL injection attack attempts to gain access to information with malformed
query parameters.
What determines the order of items in a product backlog in Scrum?
Order is decided by the Scrum Team
Order is decided by the ScrumMaster
Order is decided by the project manager
Order is decided based on value of the items being delivered
Order is decided based on value of the items being delivered
Order is decided based on the value of the item/requirement in the backlog as it
helps business when the item is done and business can start using it. The Product
Owner decides the order of items in the backlog.
Which post-release support activity (PRSA) details the process for investigating,
mitigating, and communicating findings when security vulnerabilities are
discovered in a software product?
Internal review for new product combinations or cloud deployment
Third-party reviews
Post-release certifications
External vulnerability disclosure response
External vulnerability disclosure response
The external vulnerability disclosure response (PRSA1) defines processes to
evaluate and mitigate security vulnerabilities discovered after release. It also
details how the organization will communicate to customers.
What ensures that the user has the appropriate role and privilege to view data?
Authentication
Multi-factor authentication
Encryption
pg. 4
