WGU D487 Secure Software Design Questions 2025 | 55+
(2025–2026 A+ Confirmed) Exam Q&A | Complete Study Pack
The WGU D487 Secure Software Design (2025–2026 Edition) includes 55+ verified
and expertly solved exam questions with detailed answers based on the latest WGU
curriculum standards. This verified Q&A guide is carefully crafted to help students understand
and apply secure coding principles, risk mitigation strategies, and design best practices
effectively.
Introduction
This latest 2025–2026 A+ verified exam review provides the most up-to-date coverage of
critical topics such as secure coding techniques, software vulnerabilities, threat
modeling, encryption standards, input validation, authentication, authorization,
and error handling. All answers have been expert-reviewed and accuracy verified to
align with WGU’s official competencies for D487.
Answer Format
Each question features a clear and concise explanation, with the correct answers
highlighted in bold green for easy recognition. The rationales emphasize security
principles, practical examples, and industry best practices in secure software design.
This comprehensive guide ensures thorough understanding and exam readiness for every WGU
D487 learner pursuing excellence.
Questions 1–55
1. What is the primary goal of threat modeling in secure software design?
a) To increase development speed
b) To identify potential security threats and vulnerabilities
c) To reduce code documentation
d) To simplify user authentication
b) To identify potential security threats and vulnerabilities
Rationale: Threat modeling is a structured approach to identify, quantify, and address security
risks early in the software development lifecycle, helping prioritize mitigation strategies.
2. Which of the following is a common vulnerability associated with poor
input validation in web applications?
a) Cross-Site Scripting (XSS)
b) Secure Socket Layer (SSL) misconfiguration
c) Buffer Overflow
d) Denial of Service (DoS)
a) Cross-Site Scripting (XSS)
, Rationale: Poor input validation allows malicious scripts to be injected, leading to XSS attacks
where attackers execute scripts in users' browsers.
3. In secure software design, what does the principle of 'defense in depth'
emphasize?
a) Relying on a single layer of security
b) Implementing multiple, overlapping security controls
c) Focusing solely on encryption
d) Ignoring access controls
b) Implementing multiple, overlapping security controls
Rationale: Defense in depth uses layered security measures, so if one fails, others protect the
system.
4. What is the recommended encryption algorithm for protecting data at
rest in modern applications?
a) DES (Data Encryption Standard)
b) AES-256 (Advanced Encryption Standard)
c) MD5
d) RC4
b) AES-256 (Advanced Encryption Standard)
Rationale: AES-256 is a symmetric encryption standard recommended for data at rest due to its
robust security and widespread adoption.
5. Which secure coding practice helps prevent SQL injection attacks?
a) Using prepared statements or parameterized queries
b) Storing passwords in plain text
c) Allowing direct user input in queries
d) Disabling input sanitization
a) Using prepared statements or parameterized queries
Rationale: Prepared statements separate SQL code from user input, preventing malicious code
injection.
6. What is the purpose of 'least privilege' in secure software design?
a) To grant all users full system access
b) To limit user access to only what is necessary for their role
c) To increase user permissions over time
d) To eliminate authentication requirements
b) To limit user access to only what is necessary for their role
Rationale: The principle of least privilege minimizes damage from compromised accounts by
restricting unnecessary permissions.
7. Which threat modeling technique involves creating data flow diagrams?
a) STRIDE
b) PASTA
c) DREAD
d) Attack Trees
(2025–2026 A+ Confirmed) Exam Q&A | Complete Study Pack
The WGU D487 Secure Software Design (2025–2026 Edition) includes 55+ verified
and expertly solved exam questions with detailed answers based on the latest WGU
curriculum standards. This verified Q&A guide is carefully crafted to help students understand
and apply secure coding principles, risk mitigation strategies, and design best practices
effectively.
Introduction
This latest 2025–2026 A+ verified exam review provides the most up-to-date coverage of
critical topics such as secure coding techniques, software vulnerabilities, threat
modeling, encryption standards, input validation, authentication, authorization,
and error handling. All answers have been expert-reviewed and accuracy verified to
align with WGU’s official competencies for D487.
Answer Format
Each question features a clear and concise explanation, with the correct answers
highlighted in bold green for easy recognition. The rationales emphasize security
principles, practical examples, and industry best practices in secure software design.
This comprehensive guide ensures thorough understanding and exam readiness for every WGU
D487 learner pursuing excellence.
Questions 1–55
1. What is the primary goal of threat modeling in secure software design?
a) To increase development speed
b) To identify potential security threats and vulnerabilities
c) To reduce code documentation
d) To simplify user authentication
b) To identify potential security threats and vulnerabilities
Rationale: Threat modeling is a structured approach to identify, quantify, and address security
risks early in the software development lifecycle, helping prioritize mitigation strategies.
2. Which of the following is a common vulnerability associated with poor
input validation in web applications?
a) Cross-Site Scripting (XSS)
b) Secure Socket Layer (SSL) misconfiguration
c) Buffer Overflow
d) Denial of Service (DoS)
a) Cross-Site Scripting (XSS)
, Rationale: Poor input validation allows malicious scripts to be injected, leading to XSS attacks
where attackers execute scripts in users' browsers.
3. In secure software design, what does the principle of 'defense in depth'
emphasize?
a) Relying on a single layer of security
b) Implementing multiple, overlapping security controls
c) Focusing solely on encryption
d) Ignoring access controls
b) Implementing multiple, overlapping security controls
Rationale: Defense in depth uses layered security measures, so if one fails, others protect the
system.
4. What is the recommended encryption algorithm for protecting data at
rest in modern applications?
a) DES (Data Encryption Standard)
b) AES-256 (Advanced Encryption Standard)
c) MD5
d) RC4
b) AES-256 (Advanced Encryption Standard)
Rationale: AES-256 is a symmetric encryption standard recommended for data at rest due to its
robust security and widespread adoption.
5. Which secure coding practice helps prevent SQL injection attacks?
a) Using prepared statements or parameterized queries
b) Storing passwords in plain text
c) Allowing direct user input in queries
d) Disabling input sanitization
a) Using prepared statements or parameterized queries
Rationale: Prepared statements separate SQL code from user input, preventing malicious code
injection.
6. What is the purpose of 'least privilege' in secure software design?
a) To grant all users full system access
b) To limit user access to only what is necessary for their role
c) To increase user permissions over time
d) To eliminate authentication requirements
b) To limit user access to only what is necessary for their role
Rationale: The principle of least privilege minimizes damage from compromised accounts by
restricting unnecessary permissions.
7. Which threat modeling technique involves creating data flow diagrams?
a) STRIDE
b) PASTA
c) DREAD
d) Attack Trees
