WGU D487 COMPREHENSIVE STUDY GUIDE
2026 FULL QUESTIONS AND SOLUTIONS
GRADED A+
◍ Why are Third-party security reviews important in PRSA?.
Answer: They involve security assessments performed by independent
groups to ensure objectivity and compliance.
◍ What is a non-system-related component in software security testing attack
surface validation.
Answer: Users
◍ How can you establish your own SDL to build security into a process
appropriate for your organization's needs based on the given
environments?-Continuous integration and continuous deployment -API
invocation processes -Iterative development -Enables and improves business
activitiesQuestion 7a:AgileQuestion 7b:DevOpsQuestion 7c:CloudQuestion
7d:Digital enterprise.
Answer: Iterative developmentThis method uses requirements and solutions
evolving through collaboration.Continuous integration and continuous
deployment This method involves teams working together as partners as
they learn how their product operates in the real world.API invocation
processes This method uses new ways of data to rethink how applications
are built, deployed, and used.Enables and improves business activitiesThis
method involves digitizing systems rapidly and dramatically.
◍ Deployment Phase (SDLC).
Answer: Security is pushed out
◍ Organizational leadership is considering buying a competitor and has asked
the software security team to develop a plan to ensure the competitor's
, point-of-sale system complies with organizational policies. Which
post-release deliverable is being described?.
Answer: Security strategy for M&A products
◍ What is the analysis of computer software that is performed by executing
programs on a real or virtual processor in real time?,.
Answer: Dynamic analysis
◍ What is the order that code reviews should follow in order to be
effective?-Perform preliminary scan -Review code for security issues
-Identify security code review objectives -Review for security issues unique
to the architectureQuestion 2a:Step 1Question 2b:Step 2Question 2c:Step 3
Question 2d:Step 4.
Answer: Identify security code review objectivesEstablish goals and
constraints for the review as the foundation for the overall plan.Perform
preliminary scan Complete a static analysis to find any initial security
issues.Review code for security issues Review any vulnerabilities that were
detected.Review for security issues unique to the architectureExperts apply
their knowledge of the business to identify vulnerabilities and reduce the
likelihood of false or negative positives.
◍ A new application is released, and users perform initial testing on the
application.Which type of testing are the users performing?Alpha
testingUnit testingBeta testingIntegration testing.
Answer: Beta testingBeta testing samples the intended audience to try the
product out and analyze its functionality.
◍ The organization is moving from a waterfall to an agile software
development methodology, so the software security group must adapt the
security development life cycle as well. They have decided to break out
security requirements and deliverables to fit better in the iterative life cycle
by defining every-sprint requirements, one-time requirements, bucket
requirements, and final security review requirements. Which type of
requirement states that the team must perform remote procedure call (RPC)
fuzz testing?.
, Answer: Bucket requirement
◍ How is OpenSAMM primarily used?.
Answer: OpenSAMM is designed for organizations to actively improve their
security practices through a structured roadmap. It facilitates ongoing
measurement and improvement by defining security-related activities,
capturing scores at intervals, and using scorecards to assess changes over
time
◍ pull request.
Answer: a request to merge your code into another branch
◍ Design and Development (A3) phase.
Answer: the third phase of the security development life cycle, in which you
analyze and test software to determine security and privacy issues as you
make informed decisions moving forward with your software
◍ Which activity in the Ship (A5) phase of the security development cycle sets
requirements for quality gates that must be met before release.
Answer: A5 policy compliance analysis
◍ What is the purpose of Updated threat modeling artifacts in A3 Design &
Development?.
Answer: To maintain data flow diagrams, elements, and threat listings for
security analysis.
◍ scripts:.
Answer: detailed, logical steps of instructions to tell a person or tool what to
do during the testing
◍ What are the four focus areas of OpenSAMM?.
Answer: Governance, Construction, Verification, and Deployment.
◍ What happens in Step 4 of the PSIRT process?.
Answer: The timeframe for remediation is determined.The format for public
reporting (e.g., security bulletin, knowledge base article) is finalized.
◍ The enterprise security team discovered a vulnerability in a third-party
, logging tool that could allow unauthorized access to application logs. The
vulnerability is fixed in a new release of the third-party product. How should
existing security controls be adjusted to prevent this in the future?.
Answer: Ensure third party libraries are kept up to date and reviewed
consistently.
◍ Which part of the CIA keeps unauthorized users from accessing confidential
information.
Answer: Confidentiality
◍ What are Threat modeling artifacts used for in A2 Architecture?.
Answer: They include data flow diagrams, elements, and threat listings to
assess security risks.
◍ data flow diagrams.
Answer: a visual representation of the threat flow
◍ What does the STRIDE threat model stand for, and what security properties
does it impact?.
Answer: STRIDE is a threat classification model used to analyze and
mitigate security risks. It consists of:Spoofing – Impersonating a user to
gain access (Authentication)Tampering – Modifying or altering data
(Integrity)Repudiation – Performing actions without traceability
(Non-repudiation)Information Disclosure – Gaining unauthorized access to
data (Confidentiality)Denial of Service (DoS) – Preventing legitimate use of
a system (Availability)Elevation of Privilege – Gaining higher access levels
without authorization (Authorization)
◍ What are the three categories used to classify threats based on their
mitigation status?.
Answer: Fully Mitigated Threats – Countermeasures are in place,
preventing exploitation and impact. Partially Mitigated Threats – Some
countermeasures exist, reducing but not eliminating exploitation risk. Non
mitigated Threats – No countermeasures exist, allowing full exploitation and
impact.
2026 FULL QUESTIONS AND SOLUTIONS
GRADED A+
◍ Why are Third-party security reviews important in PRSA?.
Answer: They involve security assessments performed by independent
groups to ensure objectivity and compliance.
◍ What is a non-system-related component in software security testing attack
surface validation.
Answer: Users
◍ How can you establish your own SDL to build security into a process
appropriate for your organization's needs based on the given
environments?-Continuous integration and continuous deployment -API
invocation processes -Iterative development -Enables and improves business
activitiesQuestion 7a:AgileQuestion 7b:DevOpsQuestion 7c:CloudQuestion
7d:Digital enterprise.
Answer: Iterative developmentThis method uses requirements and solutions
evolving through collaboration.Continuous integration and continuous
deployment This method involves teams working together as partners as
they learn how their product operates in the real world.API invocation
processes This method uses new ways of data to rethink how applications
are built, deployed, and used.Enables and improves business activitiesThis
method involves digitizing systems rapidly and dramatically.
◍ Deployment Phase (SDLC).
Answer: Security is pushed out
◍ Organizational leadership is considering buying a competitor and has asked
the software security team to develop a plan to ensure the competitor's
, point-of-sale system complies with organizational policies. Which
post-release deliverable is being described?.
Answer: Security strategy for M&A products
◍ What is the analysis of computer software that is performed by executing
programs on a real or virtual processor in real time?,.
Answer: Dynamic analysis
◍ What is the order that code reviews should follow in order to be
effective?-Perform preliminary scan -Review code for security issues
-Identify security code review objectives -Review for security issues unique
to the architectureQuestion 2a:Step 1Question 2b:Step 2Question 2c:Step 3
Question 2d:Step 4.
Answer: Identify security code review objectivesEstablish goals and
constraints for the review as the foundation for the overall plan.Perform
preliminary scan Complete a static analysis to find any initial security
issues.Review code for security issues Review any vulnerabilities that were
detected.Review for security issues unique to the architectureExperts apply
their knowledge of the business to identify vulnerabilities and reduce the
likelihood of false or negative positives.
◍ A new application is released, and users perform initial testing on the
application.Which type of testing are the users performing?Alpha
testingUnit testingBeta testingIntegration testing.
Answer: Beta testingBeta testing samples the intended audience to try the
product out and analyze its functionality.
◍ The organization is moving from a waterfall to an agile software
development methodology, so the software security group must adapt the
security development life cycle as well. They have decided to break out
security requirements and deliverables to fit better in the iterative life cycle
by defining every-sprint requirements, one-time requirements, bucket
requirements, and final security review requirements. Which type of
requirement states that the team must perform remote procedure call (RPC)
fuzz testing?.
, Answer: Bucket requirement
◍ How is OpenSAMM primarily used?.
Answer: OpenSAMM is designed for organizations to actively improve their
security practices through a structured roadmap. It facilitates ongoing
measurement and improvement by defining security-related activities,
capturing scores at intervals, and using scorecards to assess changes over
time
◍ pull request.
Answer: a request to merge your code into another branch
◍ Design and Development (A3) phase.
Answer: the third phase of the security development life cycle, in which you
analyze and test software to determine security and privacy issues as you
make informed decisions moving forward with your software
◍ Which activity in the Ship (A5) phase of the security development cycle sets
requirements for quality gates that must be met before release.
Answer: A5 policy compliance analysis
◍ What is the purpose of Updated threat modeling artifacts in A3 Design &
Development?.
Answer: To maintain data flow diagrams, elements, and threat listings for
security analysis.
◍ scripts:.
Answer: detailed, logical steps of instructions to tell a person or tool what to
do during the testing
◍ What are the four focus areas of OpenSAMM?.
Answer: Governance, Construction, Verification, and Deployment.
◍ What happens in Step 4 of the PSIRT process?.
Answer: The timeframe for remediation is determined.The format for public
reporting (e.g., security bulletin, knowledge base article) is finalized.
◍ The enterprise security team discovered a vulnerability in a third-party
, logging tool that could allow unauthorized access to application logs. The
vulnerability is fixed in a new release of the third-party product. How should
existing security controls be adjusted to prevent this in the future?.
Answer: Ensure third party libraries are kept up to date and reviewed
consistently.
◍ Which part of the CIA keeps unauthorized users from accessing confidential
information.
Answer: Confidentiality
◍ What are Threat modeling artifacts used for in A2 Architecture?.
Answer: They include data flow diagrams, elements, and threat listings to
assess security risks.
◍ data flow diagrams.
Answer: a visual representation of the threat flow
◍ What does the STRIDE threat model stand for, and what security properties
does it impact?.
Answer: STRIDE is a threat classification model used to analyze and
mitigate security risks. It consists of:Spoofing – Impersonating a user to
gain access (Authentication)Tampering – Modifying or altering data
(Integrity)Repudiation – Performing actions without traceability
(Non-repudiation)Information Disclosure – Gaining unauthorized access to
data (Confidentiality)Denial of Service (DoS) – Preventing legitimate use of
a system (Availability)Elevation of Privilege – Gaining higher access levels
without authorization (Authorization)
◍ What are the three categories used to classify threats based on their
mitigation status?.
Answer: Fully Mitigated Threats – Countermeasures are in place,
preventing exploitation and impact. Partially Mitigated Threats – Some
countermeasures exist, reducing but not eliminating exploitation risk. Non
mitigated Threats – No countermeasures exist, allowing full exploitation and
impact.
