WGU D487 Secure
Software Design OA
Exam Questions And
Correct Answers
(Verified Answers)
Plus Rationales
2025/2026 Q&A |
Instant Download Pdf
1. Which principle ensures users only receive the minimum
access necessary to perform their job duties?
A. Defense in depth
B. Least privilege
C. Fail-safe defaults
D. Security through obscurity
Answer: B. Least privilege
,Rationale: The principle of least privilege limits user
permissions to only what is required, reducing the risk of
misuse or compromise.
2. What is the primary purpose of threat modeling in secure
software design?
A. To improve UI design
B. To estimate project costs
C. To identify and mitigate security risks early
D. To replace penetration testing
Answer: C. To identify and mitigate security risks early
Rationale: Threat modeling helps developers identify
potential attack vectors during design so countermeasures
can be implemented before deployment.
3. Which STRIDE category involves modifying data without
authorization?
A. Spoofing
B. Tampering
C. Repudiation
D. Information disclosure
Answer: B. Tampering
Rationale: Tampering refers to the unauthorized alteration of
data or code.
,4. Which type of attack attempts to trick users into
revealing sensitive information?
A. SQL injection
B. Buffer overflow
C. Phishing
D. Race condition
Answer: C. Phishing
Rationale: Phishing attacks use deceptive communication to
obtain credentials or personal information.
5. What is the most secure way to store passwords?
A. Plain text
B. Base64 encoding
C. Encryption with reversible keys
D. Salted hashing
Answer: D. Salted hashing
Rationale: Salted hashing prevents attackers from easily
reversing or matching password hashes using rainbow tables.
6. Which security control is considered preventive?
A. Audit logs
B. Intrusion detection system
C. Firewall
D. Security reports
Answer: C. Firewall
, Rationale: Firewalls prevent unauthorized access before it
occurs, making them preventive controls.
7. What is the purpose of input validation?
A. Increase bandwidth
B. Prevent malicious or malformed data
C. Improve software licensing
D. Reduce CPU usage
Answer: B. Prevent malicious or malformed data
Rationale: Input validation helps prevent attacks such as SQL
injection and cross-site scripting.
8. Which CIA triad principle ensures data is accurate and
trustworthy?
A. Confidentiality
B. Availability
C. Integrity
D. Authentication
Answer: C. Integrity
Rationale: Integrity protects data from unauthorized
modification or destruction.
9. What does authentication verify?
A. What actions a user can perform
B. The identity of a user
Software Design OA
Exam Questions And
Correct Answers
(Verified Answers)
Plus Rationales
2025/2026 Q&A |
Instant Download Pdf
1. Which principle ensures users only receive the minimum
access necessary to perform their job duties?
A. Defense in depth
B. Least privilege
C. Fail-safe defaults
D. Security through obscurity
Answer: B. Least privilege
,Rationale: The principle of least privilege limits user
permissions to only what is required, reducing the risk of
misuse or compromise.
2. What is the primary purpose of threat modeling in secure
software design?
A. To improve UI design
B. To estimate project costs
C. To identify and mitigate security risks early
D. To replace penetration testing
Answer: C. To identify and mitigate security risks early
Rationale: Threat modeling helps developers identify
potential attack vectors during design so countermeasures
can be implemented before deployment.
3. Which STRIDE category involves modifying data without
authorization?
A. Spoofing
B. Tampering
C. Repudiation
D. Information disclosure
Answer: B. Tampering
Rationale: Tampering refers to the unauthorized alteration of
data or code.
,4. Which type of attack attempts to trick users into
revealing sensitive information?
A. SQL injection
B. Buffer overflow
C. Phishing
D. Race condition
Answer: C. Phishing
Rationale: Phishing attacks use deceptive communication to
obtain credentials or personal information.
5. What is the most secure way to store passwords?
A. Plain text
B. Base64 encoding
C. Encryption with reversible keys
D. Salted hashing
Answer: D. Salted hashing
Rationale: Salted hashing prevents attackers from easily
reversing or matching password hashes using rainbow tables.
6. Which security control is considered preventive?
A. Audit logs
B. Intrusion detection system
C. Firewall
D. Security reports
Answer: C. Firewall
, Rationale: Firewalls prevent unauthorized access before it
occurs, making them preventive controls.
7. What is the purpose of input validation?
A. Increase bandwidth
B. Prevent malicious or malformed data
C. Improve software licensing
D. Reduce CPU usage
Answer: B. Prevent malicious or malformed data
Rationale: Input validation helps prevent attacks such as SQL
injection and cross-site scripting.
8. Which CIA triad principle ensures data is accurate and
trustworthy?
A. Confidentiality
B. Availability
C. Integrity
D. Authentication
Answer: C. Integrity
Rationale: Integrity protects data from unauthorized
modification or destruction.
9. What does authentication verify?
A. What actions a user can perform
B. The identity of a user
