Page 1 of 18
01 June 2026
WGU D487 Oa 2026 Test EXAM With 80 Questions
And Correct Answers (100% Correct Verified
Answers) WITH RATIONALES /D487 Secure Software
Design Objective Assessment 2026
1. Which practice in the Ship (A5) phase verifies whether the product meets security mandates?
A. Vulnerability scan
B. A5 policy compliance analysis
C. Threat modeling
D. Code review
Correct Answer: B
Rationale: A5 policy compliance analysis ensures the product meets required security policies and
standards before release.
2. Which post-release support activity defines how to communicate and respond to
vulnerabilities?
A. Security architectural reviews
B. External vulnerability disclosure response (PRSA1)
C. Threat modeling
D. Penetration testing
Correct Answer: B
Rationale: PRSA1 defines communication and handling of externally discovered vulnerabilities.
3. What are two core practice areas of OpenSAMM?
A. Testing and Deployment
B. Governance and Construction
C. Coding and Debugging
D. Analysis and Reporting
Correct Answer: B
Rationale: OpenSAMM core areas include Governance, Construction, Verification, and Deployment.
4. Which Ship (A5) practice identifies weaknesses using tools?
A. Policy compliance analysis
B. Vulnerability scan
C. Architecture review
D. Threat modeling
, Page 2 of 18
01 June 2026
Correct Answer: B
Rationale: Vulnerability scanning uses automated tools to detect security weaknesses.
5. Which post-release activity is important during company mergers?
A. Penetration testing
B. Security architectural reviews
C. Code review
D. Threat modeling
Correct Answer: B
Rationale: Mergers require reviewing combined system architectures for security risks.
6. What is delivered during A5 policy compliance analysis?
A. Source code
B. Analyze activities and standards
C. Deployment scripts
D. User documentation
Correct Answer: B
Rationale: This phase validates activities against defined security standards.
7. What is produced in code-assisted penetration testing?
A. Threat model
B. White-box security testing results
C. Risk register
D. Policy document
Correct Answer: B
Rationale: Code-assisted penetration testing is white-box testing using internal knowledge.
8. What is produced in open-source licensing review?
A. Threat report
B. License compliance
C. Risk score
D. Bug report
Correct Answer: B
Rationale: Ensures legal compliance with third-party software licenses.
9. What is produced in the final security review?
, Page 3 of 18
01 June 2026
A. Release and ship decision
B. Code documentation
C. Architecture diagram
D. Vulnerability scan
Correct Answer: A
Rationale: Final review determines readiness for release.
10. How is SDL established in Agile?
A. Waterfall process
B. Iterative development
C. Manual review only
D. Ad-hoc testing
Correct Answer: B
Rationale: Agile SDL integrates security into iterative cycles.
11. How is SDL established in DevOps?
A. Manual deployment
B. Continuous integration and deployment
C. Quarterly testing
D. Static documentation
Correct Answer: B
Rationale: DevOps relies on CI/CD pipelines for continuous security integration.
12. SDL in cloud environments is based on:
A. Local servers
B. API invocation processes
C. Manual coding
D. Paper-based audits
Correct Answer: B
Rationale: Cloud systems rely heavily on APIs for operations and security controls.
13. SDL in digital enterprise focuses on:
A. Hardware repair
B. Business activity enhancement
C. Gaming systems
D. Manual scripting
Correct Answer: B
Rationale: Digital enterprise SDL improves business processes and systems.
01 June 2026
WGU D487 Oa 2026 Test EXAM With 80 Questions
And Correct Answers (100% Correct Verified
Answers) WITH RATIONALES /D487 Secure Software
Design Objective Assessment 2026
1. Which practice in the Ship (A5) phase verifies whether the product meets security mandates?
A. Vulnerability scan
B. A5 policy compliance analysis
C. Threat modeling
D. Code review
Correct Answer: B
Rationale: A5 policy compliance analysis ensures the product meets required security policies and
standards before release.
2. Which post-release support activity defines how to communicate and respond to
vulnerabilities?
A. Security architectural reviews
B. External vulnerability disclosure response (PRSA1)
C. Threat modeling
D. Penetration testing
Correct Answer: B
Rationale: PRSA1 defines communication and handling of externally discovered vulnerabilities.
3. What are two core practice areas of OpenSAMM?
A. Testing and Deployment
B. Governance and Construction
C. Coding and Debugging
D. Analysis and Reporting
Correct Answer: B
Rationale: OpenSAMM core areas include Governance, Construction, Verification, and Deployment.
4. Which Ship (A5) practice identifies weaknesses using tools?
A. Policy compliance analysis
B. Vulnerability scan
C. Architecture review
D. Threat modeling
, Page 2 of 18
01 June 2026
Correct Answer: B
Rationale: Vulnerability scanning uses automated tools to detect security weaknesses.
5. Which post-release activity is important during company mergers?
A. Penetration testing
B. Security architectural reviews
C. Code review
D. Threat modeling
Correct Answer: B
Rationale: Mergers require reviewing combined system architectures for security risks.
6. What is delivered during A5 policy compliance analysis?
A. Source code
B. Analyze activities and standards
C. Deployment scripts
D. User documentation
Correct Answer: B
Rationale: This phase validates activities against defined security standards.
7. What is produced in code-assisted penetration testing?
A. Threat model
B. White-box security testing results
C. Risk register
D. Policy document
Correct Answer: B
Rationale: Code-assisted penetration testing is white-box testing using internal knowledge.
8. What is produced in open-source licensing review?
A. Threat report
B. License compliance
C. Risk score
D. Bug report
Correct Answer: B
Rationale: Ensures legal compliance with third-party software licenses.
9. What is produced in the final security review?
, Page 3 of 18
01 June 2026
A. Release and ship decision
B. Code documentation
C. Architecture diagram
D. Vulnerability scan
Correct Answer: A
Rationale: Final review determines readiness for release.
10. How is SDL established in Agile?
A. Waterfall process
B. Iterative development
C. Manual review only
D. Ad-hoc testing
Correct Answer: B
Rationale: Agile SDL integrates security into iterative cycles.
11. How is SDL established in DevOps?
A. Manual deployment
B. Continuous integration and deployment
C. Quarterly testing
D. Static documentation
Correct Answer: B
Rationale: DevOps relies on CI/CD pipelines for continuous security integration.
12. SDL in cloud environments is based on:
A. Local servers
B. API invocation processes
C. Manual coding
D. Paper-based audits
Correct Answer: B
Rationale: Cloud systems rely heavily on APIs for operations and security controls.
13. SDL in digital enterprise focuses on:
A. Hardware repair
B. Business activity enhancement
C. Gaming systems
D. Manual scripting
Correct Answer: B
Rationale: Digital enterprise SDL improves business processes and systems.
