WGU D487 OBJECTIVE ASSESSMENT
SECURE SOFTWARE DESIGN (KEO1)
(PKEO) EXAM QUESTIONS WITH
CORRECT SOLUTIONS||100%
GUARANTEED PASS||A+
GRADED||<<RECENT VERSION>>
1. Which threat modeling process identifies threats to each individual object in
a data flow diagram? - ANSWER ✓ STRIDE-per-element
2. The DREAD methodology has been used to classify an identified exploit
where: the attacker could log in as an administrator (damage potential)
the attacker could log in at any time (reproducibility)
almost anybody could perform the attack (exploitability)
all system users could be affected (affected users)
any person who knows how to open dev tools in a browser could find the
vulnerability (discoverability)
3. Which rating should be assigned to the exploit after performing an analysis
using a ternary ranking scale where high risk = 3 points, medium risk = 2
points, and low risk = 1 point? - ANSWER ✓ High risk
4. What is the recommended way to mitigate a threat identified during threat
modeling? - ANSWER ✓ Apply a standard accepted countermeasure
5. The organization's testing team has created a catalog of test cases using the
source code and design documentation of the new product. Each test case
will be executed for each user role in the new product. Which type of
security testing technique is being performed? - ANSWER ✓ White-box
6. Security team members have been instructed to document which developers
and analysts will perform product testing and which tools they will use.
Which step of the security test plan is being performed? - ANSWER ✓
Identify internal resources
,7. What is the analysis of computer software that is performed by executing
programs on a real or virtual processor in real time?, - ANSWER ✓
Dynamic analysis
8. Which person is responsible for designing, planning, and implementing
secure coding practices and security testing methodologies? - ANSWER ✓
Software security architect
9. Security team members have been instructed to document how many users
will access the new product and what roles those users will play. Which step
of the security test plan is being performed? - ANSWER ✓ Define the user
community
10.The project team received a SonarQube report of their most recent stage
deployment that contains 15 vulnerabilities that must be fixed before the
product may be released to production. Which security testing technique is
being used? - ANSWER ✓ Source-code analysis
11.What is the application of multiple layers of protection so that, if one layer is
breached, the next layer provides protection? - ANSWER ✓ Defense in
depth
12.Which design and development deliverable details the progress of personal
information requirements created in earlier phases of the security
development lifecycle? - ANSWER ✓ Privacy compliance report
13.Which design and development deliverable contains technical and executive
level reports detailing any newly identified vulnerabilities? - ANSWER ✓
Updated threat modeling artifacts
14.Deployment Phase (SDLC) - ANSWER ✓ Security is pushed out
15.Design Phase (SDLC) - ANSWER ✓ Requirements are prepared for the
technical design
16.Implementation Phase - ANSWER ✓ The resources involved in the
application from a known resource are determined
, 17.Maintenance Phase - ANSWER ✓ Ongoing security monitoring is
implemented
18.Planning Phase of SDLC - ANSWER ✓ vision and next steps are created
19.secure code - ANSWER ✓ a principle design in coding that refers to code
security best practices, safeguards, and protection against vulnerabilities
20.threat modeling - ANSWER ✓ a structured process to protect against
vulnerabilities
21.What are the three core elements of security - ANSWER ✓ confidentiality,
integrity, and availability
22.8 phases of the SDLC - ANSWER ✓ planning, requirements, design,
implementation, testing, deployment, maintenance and end of life
23.What is software security - ANSWER ✓ Security that deals with securing
the foundational programmatic logic of the underlying software
24.Which part of the CIA keeps unauthorized users from accessing confidential
information - ANSWER ✓ Confidentiality
25.BSIMM - ANSWER ✓ a study of real-world software security that allows
you to develop your software security over time
26.dynamic analysis - ANSWER ✓ analysis of computer software that is
performed when executing the program on a real or virtual processor in real
time
27.fuzz testing - ANSWER ✓ automated or semi-automated testing that
provides invalid, unexpected, or random data to the computer program.
28.measure model - ANSWER ✓ A set of data security methods that developers
take to protect against vulnerabilities
29.metric model - ANSWER ✓ allows organizations to determine the
effectiveness of their security controls
SECURE SOFTWARE DESIGN (KEO1)
(PKEO) EXAM QUESTIONS WITH
CORRECT SOLUTIONS||100%
GUARANTEED PASS||A+
GRADED||<<RECENT VERSION>>
1. Which threat modeling process identifies threats to each individual object in
a data flow diagram? - ANSWER ✓ STRIDE-per-element
2. The DREAD methodology has been used to classify an identified exploit
where: the attacker could log in as an administrator (damage potential)
the attacker could log in at any time (reproducibility)
almost anybody could perform the attack (exploitability)
all system users could be affected (affected users)
any person who knows how to open dev tools in a browser could find the
vulnerability (discoverability)
3. Which rating should be assigned to the exploit after performing an analysis
using a ternary ranking scale where high risk = 3 points, medium risk = 2
points, and low risk = 1 point? - ANSWER ✓ High risk
4. What is the recommended way to mitigate a threat identified during threat
modeling? - ANSWER ✓ Apply a standard accepted countermeasure
5. The organization's testing team has created a catalog of test cases using the
source code and design documentation of the new product. Each test case
will be executed for each user role in the new product. Which type of
security testing technique is being performed? - ANSWER ✓ White-box
6. Security team members have been instructed to document which developers
and analysts will perform product testing and which tools they will use.
Which step of the security test plan is being performed? - ANSWER ✓
Identify internal resources
,7. What is the analysis of computer software that is performed by executing
programs on a real or virtual processor in real time?, - ANSWER ✓
Dynamic analysis
8. Which person is responsible for designing, planning, and implementing
secure coding practices and security testing methodologies? - ANSWER ✓
Software security architect
9. Security team members have been instructed to document how many users
will access the new product and what roles those users will play. Which step
of the security test plan is being performed? - ANSWER ✓ Define the user
community
10.The project team received a SonarQube report of their most recent stage
deployment that contains 15 vulnerabilities that must be fixed before the
product may be released to production. Which security testing technique is
being used? - ANSWER ✓ Source-code analysis
11.What is the application of multiple layers of protection so that, if one layer is
breached, the next layer provides protection? - ANSWER ✓ Defense in
depth
12.Which design and development deliverable details the progress of personal
information requirements created in earlier phases of the security
development lifecycle? - ANSWER ✓ Privacy compliance report
13.Which design and development deliverable contains technical and executive
level reports detailing any newly identified vulnerabilities? - ANSWER ✓
Updated threat modeling artifacts
14.Deployment Phase (SDLC) - ANSWER ✓ Security is pushed out
15.Design Phase (SDLC) - ANSWER ✓ Requirements are prepared for the
technical design
16.Implementation Phase - ANSWER ✓ The resources involved in the
application from a known resource are determined
, 17.Maintenance Phase - ANSWER ✓ Ongoing security monitoring is
implemented
18.Planning Phase of SDLC - ANSWER ✓ vision and next steps are created
19.secure code - ANSWER ✓ a principle design in coding that refers to code
security best practices, safeguards, and protection against vulnerabilities
20.threat modeling - ANSWER ✓ a structured process to protect against
vulnerabilities
21.What are the three core elements of security - ANSWER ✓ confidentiality,
integrity, and availability
22.8 phases of the SDLC - ANSWER ✓ planning, requirements, design,
implementation, testing, deployment, maintenance and end of life
23.What is software security - ANSWER ✓ Security that deals with securing
the foundational programmatic logic of the underlying software
24.Which part of the CIA keeps unauthorized users from accessing confidential
information - ANSWER ✓ Confidentiality
25.BSIMM - ANSWER ✓ a study of real-world software security that allows
you to develop your software security over time
26.dynamic analysis - ANSWER ✓ analysis of computer software that is
performed when executing the program on a real or virtual processor in real
time
27.fuzz testing - ANSWER ✓ automated or semi-automated testing that
provides invalid, unexpected, or random data to the computer program.
28.measure model - ANSWER ✓ A set of data security methods that developers
take to protect against vulnerabilities
29.metric model - ANSWER ✓ allows organizations to determine the
effectiveness of their security controls
