. WGU - D487 latest version
97. What is OpenSAMM?: OpenSAMM is an open security framework developed by OWASP to help organizations define
and measure their software security assurance activities. It provides a roadmap and self-assessment tool for improving security
at various maturity levels.
98. What is the main difference between BSIMM and OpenSAMM?: BSIMM is observational and focuses on benchmarking
real-world security practices from top organizations.
OpenSAMM is prescriptive, providing a structured roadmap and guidance on improving security practices.
99. What are the four focus areas of BSIMM?: Governance - Managing security initiatives.
Intelligence - Collecting security knowledge and tools.
SSDL Touchpoints - Applying security to the software development lifecycle.
Deployment - Security controls for operations.
100. Core Activities in OpenSAMM: Governance - Security policy, compliance, and strategy.
Construction - Security requirements, architecture, and design.
Verification - Code review, security testing, and assurance.
Deployment - Secure deployment, vulnerability management.
101. What are the Governance practices in BSIMM?: Strategy & Metrics Compliance & Policy
Training
105 What are the Intelligence practices in BSIMM?: Attack Models
Security Features & Design6
Standards & Requirements
106. What are the SSDL Touchpoints practices in BSIMM?: Architecture Analysis
Code Review
Security Testing
107. What are the Deployment practices in BSIMM?: Penetration Testing
Software Environment
Configuration & Vulnerability Management
108. What are the Governance practices in OpenSAMM?: Strategy & Metrics - Security planning & monitoring.
Policy & Compliance - Security regulations and risk management.
Education & Guidance - Developer security training.
, 109. What are the Construction practices in OpenSAMM?: Security Requirements - Define security needs.
Threat Assessment - Identify software threats.
Secure Architecture - Enforce security design.
110. What are the Verification practices in OpenSAMM?: Design Review - Security in the design phase.
Code Review - Secure coding analysis.
Security Testing - Dynamic/static application security testing.
111. What are the Deployment practices in OpenSAMM?: Environment Hardening - Secure infrastructure
configurations.
Vulnerability Management - Identify and fix security issues.
Operational Enablement - Secure product release & monitoring.
112. What type of model is BSIMM?: Observational - it studies existing security practices in organizations.
113. What type of model is OpenSAMM?: Prescriptive - it provides a roadmap to improve security practices.
114. What are the four focus areas of OpenSAMM?: Governance, Construction, Verification, and Deployment.
115. How is OpenSAMM primarily used?: OpenSAMM is designed for organizations to actively improve their security
practices through a structured roadmap. It facilitates ongoing measurement and improvement by defining security-
related activities, capturing scores at intervals, and using scorecards to assess changes over time
116. How is BSIMM primarily used?: BSIMM measures maturity over time by tracking and comparing an
organization's security maturity across different domains
, WGU - D487
Study online at https://quizlet.com/_gpcp9p
based on real-world data from multiple companies. It provides a benchmarking approach that helps organizations determine
where they stand relative to industry peers and track improvement over time
117. SSDL BSIMM: SSDL Touchpoints in BSIMM focuses on activities directly related to the software security
development lifecycle (SSDL), including security testing, code review, and architecture analysis.
118. The software security group is conducting a maturity assessment using the Building Security in Maturity Model
(BSIMM). They are currently focused on reviewing security testing results from recently completed initiatives. Which
BSIMM domain is being assessed?: Software security development life cycle (SSDL) touchpoints
119. In an Agile SDL, which type of requirement includes Remote Procedure Call (RPC) fuzz testing?: Bucket
Requirement Explanation:
Bucket requirements are security activities that do not need to be performed every sprint but should be addressed within a set
timeframe (e.g., every quarter, release cycle, or milestone).
RPC fuzz testing is a security testing activity that can be scheduled periodically, making it a bucket requirement rather than an
every-sprint requirement. Unlike one-time requirements, which are implemented once and do not repeat, bucket requirements
recur on a structured schedule.
120. Which secure coding best practice includes using parameterized queries, encrypted connection strings, and
strong authentication?: Database Security 121. Which secure coding best practice says that all information passed to
other systems should be encrypted?: Communication Security Explanation:
Encryption in transit protects data from eavesdropping and man-in-the-middle (MITM) attacks.
Secure communication protocols like TLS (Transport Layer Security) and HTTPS ensure confidentiality and integrity.
End-to-end encryption prevents unauthorized access during data exchange between systems.
122. A software security team member has created data flow diagrams, chosen the STRIDE methodology to perform threat
reviews, and created the security assessment for a new product.
Which category of secure software best practices did the team member perform?: Architecture Analysis is a best practice that
helps organizations identify security risks early in the design phase before implementation.
123 What does the acronym DREAD stand for in Microsoft's risk model?: -
Damage potential, Reproducibility, Exploitability, Affected users, Discoverability
124. How does the DREAD model rank security risks?: Uses a scale from 0 to 10 for each factor
125. What is the primary difference between STRIDE and DREAD in threat modeling?: STRIDE identifies types of
threats, while DREAD ranks and prioritizes risks.
=9STRIDE = Threat categorization model =Ì
=9DREAD = Risk assessment model =Ê
126. STRIDE: Spoofing = (u B Impersonating another user)
97. What is OpenSAMM?: OpenSAMM is an open security framework developed by OWASP to help organizations define
and measure their software security assurance activities. It provides a roadmap and self-assessment tool for improving security
at various maturity levels.
98. What is the main difference between BSIMM and OpenSAMM?: BSIMM is observational and focuses on benchmarking
real-world security practices from top organizations.
OpenSAMM is prescriptive, providing a structured roadmap and guidance on improving security practices.
99. What are the four focus areas of BSIMM?: Governance - Managing security initiatives.
Intelligence - Collecting security knowledge and tools.
SSDL Touchpoints - Applying security to the software development lifecycle.
Deployment - Security controls for operations.
100. Core Activities in OpenSAMM: Governance - Security policy, compliance, and strategy.
Construction - Security requirements, architecture, and design.
Verification - Code review, security testing, and assurance.
Deployment - Secure deployment, vulnerability management.
101. What are the Governance practices in BSIMM?: Strategy & Metrics Compliance & Policy
Training
105 What are the Intelligence practices in BSIMM?: Attack Models
Security Features & Design6
Standards & Requirements
106. What are the SSDL Touchpoints practices in BSIMM?: Architecture Analysis
Code Review
Security Testing
107. What are the Deployment practices in BSIMM?: Penetration Testing
Software Environment
Configuration & Vulnerability Management
108. What are the Governance practices in OpenSAMM?: Strategy & Metrics - Security planning & monitoring.
Policy & Compliance - Security regulations and risk management.
Education & Guidance - Developer security training.
, 109. What are the Construction practices in OpenSAMM?: Security Requirements - Define security needs.
Threat Assessment - Identify software threats.
Secure Architecture - Enforce security design.
110. What are the Verification practices in OpenSAMM?: Design Review - Security in the design phase.
Code Review - Secure coding analysis.
Security Testing - Dynamic/static application security testing.
111. What are the Deployment practices in OpenSAMM?: Environment Hardening - Secure infrastructure
configurations.
Vulnerability Management - Identify and fix security issues.
Operational Enablement - Secure product release & monitoring.
112. What type of model is BSIMM?: Observational - it studies existing security practices in organizations.
113. What type of model is OpenSAMM?: Prescriptive - it provides a roadmap to improve security practices.
114. What are the four focus areas of OpenSAMM?: Governance, Construction, Verification, and Deployment.
115. How is OpenSAMM primarily used?: OpenSAMM is designed for organizations to actively improve their security
practices through a structured roadmap. It facilitates ongoing measurement and improvement by defining security-
related activities, capturing scores at intervals, and using scorecards to assess changes over time
116. How is BSIMM primarily used?: BSIMM measures maturity over time by tracking and comparing an
organization's security maturity across different domains
, WGU - D487
Study online at https://quizlet.com/_gpcp9p
based on real-world data from multiple companies. It provides a benchmarking approach that helps organizations determine
where they stand relative to industry peers and track improvement over time
117. SSDL BSIMM: SSDL Touchpoints in BSIMM focuses on activities directly related to the software security
development lifecycle (SSDL), including security testing, code review, and architecture analysis.
118. The software security group is conducting a maturity assessment using the Building Security in Maturity Model
(BSIMM). They are currently focused on reviewing security testing results from recently completed initiatives. Which
BSIMM domain is being assessed?: Software security development life cycle (SSDL) touchpoints
119. In an Agile SDL, which type of requirement includes Remote Procedure Call (RPC) fuzz testing?: Bucket
Requirement Explanation:
Bucket requirements are security activities that do not need to be performed every sprint but should be addressed within a set
timeframe (e.g., every quarter, release cycle, or milestone).
RPC fuzz testing is a security testing activity that can be scheduled periodically, making it a bucket requirement rather than an
every-sprint requirement. Unlike one-time requirements, which are implemented once and do not repeat, bucket requirements
recur on a structured schedule.
120. Which secure coding best practice includes using parameterized queries, encrypted connection strings, and
strong authentication?: Database Security 121. Which secure coding best practice says that all information passed to
other systems should be encrypted?: Communication Security Explanation:
Encryption in transit protects data from eavesdropping and man-in-the-middle (MITM) attacks.
Secure communication protocols like TLS (Transport Layer Security) and HTTPS ensure confidentiality and integrity.
End-to-end encryption prevents unauthorized access during data exchange between systems.
122. A software security team member has created data flow diagrams, chosen the STRIDE methodology to perform threat
reviews, and created the security assessment for a new product.
Which category of secure software best practices did the team member perform?: Architecture Analysis is a best practice that
helps organizations identify security risks early in the design phase before implementation.
123 What does the acronym DREAD stand for in Microsoft's risk model?: -
Damage potential, Reproducibility, Exploitability, Affected users, Discoverability
124. How does the DREAD model rank security risks?: Uses a scale from 0 to 10 for each factor
125. What is the primary difference between STRIDE and DREAD in threat modeling?: STRIDE identifies types of
threats, while DREAD ranks and prioritizes risks.
=9STRIDE = Threat categorization model =Ì
=9DREAD = Risk assessment model =Ê
126. STRIDE: Spoofing = (u B Impersonating another user)
