WGU D487 SECURE SW DESIGN
OBJECTIVE ASSESSMENT ACTUAL EXAM
2026/2027 COMPLETE QUESTIONS WITH
VERIFIED CORRECT ANSWERS || 100%
GUARANTEED PASS NEWEST VERSION
A software security team member has created data flow diagrams, chosen the
STRIDE methodology to perform threat reviews, and created the security
assessment for the new product. Which category of secure software best practices
did the team member perform? - ANSWER Architecture analysis
Team members are being introduced during sprint zero in the project kickoff
meeting. The person being introduced will be a facilitator, will try to remove
roadblocks and ensure the team is communicating freely, and will be responsible
for facilitating all Scrum ceremonies. Which role is the team member playing? -
ANSWER Scrum master
The new product standards state that all traffic must be secure and encrypted.
What is the name for this secure coding practice? - ANSWER Communication
security
Which DREAD category is based on how easily a threat exploit can be repeated? -
ANSWER Reproducibility
,Which mitigation technique can be used to fight against a data tampering threat? -
ANSWER Digital signatures
What is a countermeasure to the web application security frame (ASF)
configuration management threat category? - ANSWER Compliance
requirement
Which type of requirement specifies that file formats the application sends to
financial institutions must be certified every four years? -
ANSWER Compliance requirement
Which type of requirement specifies that credit card numbers displayed in the
application will be masked so they only show the last four digits? -
ANSWER Privacy requirement
Which type of requirement specifies that user passwords will require a minimum
of 8 characters and must include at least one uppercase character, one number, and
one special character? - ANSWER Security requirement
Which type of requirement specifies that credit card numbers are designated as
highly sensitive confidential personal information? - ANSWER Data
classification requirement
Which privacy impact statement requirement type defines how personal
information is protected on devices used by more than a single associate? -
ANSWER Privacy control requirements
, In which step of the PASTA threat modeling methodology does design flaw
analysis take place? - ANSWER Vulnerability and weakness analysis
Which privacy impact statement requirement type defines who has access to
personal information within the product? - ANSWER Access requirements
Which security assessment deliverable defines milestones that will be met during
each phase of the project, merged into the product development schedule? -
ANSWER SDL project outline
Which architecture deliverable identifies whether the product adheres to the
organization's security rules? - ANSWER Policy compliance analysis
Which threat modeling process identifies threats to each individual object in a data
flow diagram? - ANSWER STRIDE-per-element
The DREAD methodology has been used to classify an identified exploit where:
The attacker could log in as an administrator (damage potential)
The attacker could log in at any time (reproducibility)
almost anybody could perform the attack (exploitability)
All system users could be affected (affected users)
Any person who knows how to open dev tools in a browser could find the
vulnerability (discoverability)
Which rating should be assigned to the exploit after performing an analysis using a
ternary ranking scale where high risk = 3 points, medium risk = 2 points, and low
risk = 1 point? - ANSWER High risk
, What is the recommended way to mitigate a threat identified during threat
modeling? - ANSWER Apply a standard accepted countermeasure
The organization's testing team has created a catalog of test cases using the source
code and design documentation of the new product. Each test case will be executed
for each user role in the new product. Which type of security testing technique is
being performed? - ANSWER White-box
Security team members have been instructed to document which developers and
analysts will perform product testing and which tools they will use. Which step of
the security test plan is being performed? - ANSWER Identify internal resources
Security team members have been instructed to document how many users will
access the new product and what roles those users will play. Which step of the
security test plan is being performed? - ANSWER Define the user community
The project team received a SonarQube report of their most recent stage
deployment that contains 15 vulnerabilities that must be fixed before the product
may be released to production. Which security testing technique is being used? -
ANSWER Source-code analysis
What is the application of multiple layers of protection so that, if one layer is
breached, the next layer provides protection? - ANSWER Defense in depth
Which design and development deliverable details the progress of personal
information requirements created in earlier phases of the security development
lifecycle? - ANSWER Privacy compliance report
OBJECTIVE ASSESSMENT ACTUAL EXAM
2026/2027 COMPLETE QUESTIONS WITH
VERIFIED CORRECT ANSWERS || 100%
GUARANTEED PASS NEWEST VERSION
A software security team member has created data flow diagrams, chosen the
STRIDE methodology to perform threat reviews, and created the security
assessment for the new product. Which category of secure software best practices
did the team member perform? - ANSWER Architecture analysis
Team members are being introduced during sprint zero in the project kickoff
meeting. The person being introduced will be a facilitator, will try to remove
roadblocks and ensure the team is communicating freely, and will be responsible
for facilitating all Scrum ceremonies. Which role is the team member playing? -
ANSWER Scrum master
The new product standards state that all traffic must be secure and encrypted.
What is the name for this secure coding practice? - ANSWER Communication
security
Which DREAD category is based on how easily a threat exploit can be repeated? -
ANSWER Reproducibility
,Which mitigation technique can be used to fight against a data tampering threat? -
ANSWER Digital signatures
What is a countermeasure to the web application security frame (ASF)
configuration management threat category? - ANSWER Compliance
requirement
Which type of requirement specifies that file formats the application sends to
financial institutions must be certified every four years? -
ANSWER Compliance requirement
Which type of requirement specifies that credit card numbers displayed in the
application will be masked so they only show the last four digits? -
ANSWER Privacy requirement
Which type of requirement specifies that user passwords will require a minimum
of 8 characters and must include at least one uppercase character, one number, and
one special character? - ANSWER Security requirement
Which type of requirement specifies that credit card numbers are designated as
highly sensitive confidential personal information? - ANSWER Data
classification requirement
Which privacy impact statement requirement type defines how personal
information is protected on devices used by more than a single associate? -
ANSWER Privacy control requirements
, In which step of the PASTA threat modeling methodology does design flaw
analysis take place? - ANSWER Vulnerability and weakness analysis
Which privacy impact statement requirement type defines who has access to
personal information within the product? - ANSWER Access requirements
Which security assessment deliverable defines milestones that will be met during
each phase of the project, merged into the product development schedule? -
ANSWER SDL project outline
Which architecture deliverable identifies whether the product adheres to the
organization's security rules? - ANSWER Policy compliance analysis
Which threat modeling process identifies threats to each individual object in a data
flow diagram? - ANSWER STRIDE-per-element
The DREAD methodology has been used to classify an identified exploit where:
The attacker could log in as an administrator (damage potential)
The attacker could log in at any time (reproducibility)
almost anybody could perform the attack (exploitability)
All system users could be affected (affected users)
Any person who knows how to open dev tools in a browser could find the
vulnerability (discoverability)
Which rating should be assigned to the exploit after performing an analysis using a
ternary ranking scale where high risk = 3 points, medium risk = 2 points, and low
risk = 1 point? - ANSWER High risk
, What is the recommended way to mitigate a threat identified during threat
modeling? - ANSWER Apply a standard accepted countermeasure
The organization's testing team has created a catalog of test cases using the source
code and design documentation of the new product. Each test case will be executed
for each user role in the new product. Which type of security testing technique is
being performed? - ANSWER White-box
Security team members have been instructed to document which developers and
analysts will perform product testing and which tools they will use. Which step of
the security test plan is being performed? - ANSWER Identify internal resources
Security team members have been instructed to document how many users will
access the new product and what roles those users will play. Which step of the
security test plan is being performed? - ANSWER Define the user community
The project team received a SonarQube report of their most recent stage
deployment that contains 15 vulnerabilities that must be fixed before the product
may be released to production. Which security testing technique is being used? -
ANSWER Source-code analysis
What is the application of multiple layers of protection so that, if one layer is
breached, the next layer provides protection? - ANSWER Defense in depth
Which design and development deliverable details the progress of personal
information requirements created in earlier phases of the security development
lifecycle? - ANSWER Privacy compliance report
