WGU D487 Secure Software Design Official
Practice Exam Actual Exam 2026/2027 with
Detailed Rationales | Complete Exam-Style
Questions | Pass Guaranteed – A+ Graded
══════════════════════════════════════
SECTION 1: SECURE SOFTWARE DEVELOPMENT LIFECYCLE Q1 – Q10
══════════════════════════════════════
Question 1 of 50
A fintech startup is designing a new mobile banking application and wants to identify
potential security threats before writing any code. The security architect recommends a
structured approach to enumerate threats based on data flow diagrams and component
interactions during the requirements phase.
A. Integrate threat modeling sessions using STRIDE during the design phase to
systematically identify spoofing, tampering, and elevation of privilege threats against each
data flow. ✓ CORRECT
B. Deploy a static application security testing tool to scan the codebase for vulnerabilities
once development begins.
C. Conduct penetration testing against the production environment after deployment to
discover runtime weaknesses.
D. Implement automated dynamic scanning during the quality assurance phase to catch
injection flaws in the API endpoints.
Correct Answer: A
Rationale: Threat modeling with STRIDE is designed to be performed during the design and
requirements phases to identify threats before code is written, making it the most
appropriate early-phase activity. Static and dynamic testing tools require code or running
applications to analyze, so they cannot be used during the initial design phase. Starting threat
modeling early reduces the cost of remediation by orders of magnitude compared to
discovering issues in production.
Question 2 of 50
A healthcare software vendor must comply with HIPAA regulations while modernizing its
patient records system. The project manager needs to translate regulatory mandates into
actionable development tasks that can be traced through each sprint.
,A. Document security requirements in a standalone spreadsheet reviewed only during the
initial project kickoff meeting.
B. Embed security requirements as user stories with acceptance criteria in the product
backlog and trace them through each sprint review. ✓ CORRECT
C. Rely on the security operations team to audit the production environment quarterly for
compliance gaps.
D. Perform a one-time risk assessment at project completion before submitting the
application for regulatory approval.
Correct Answer: B
Rationale: Embedding security requirements as traceable user stories ensures they are
reviewed, implemented, and verified during every sprint rather than being treated as a one-time
checklist. A standalone spreadsheet or quarterly audit creates dangerous visibility gaps
where requirements are forgotten during implementation. Traceability through the backlog
aligns with Agile security practices and maintains continuous compliance accountability.
Question 3 of 50
An e-commerce company experienced a breach last year due to a third-party payment
module. The CTO wants to prevent similar supply-chain risks in the upcoming platform
redesign.
A. During the deployment phase when the third-party module is first integrated into the
staging environment.
B. In the maintenance phase after the module has been running in production for at least one
quarter.
C. In the requirements and design phase before selecting vendors and finalizing architectural
dependencies. ✓ CORRECT
D. During the testing phase when integration tests reveal authentication failures in the
payment gateway.
Correct Answer: C
Rationale: Evaluating vendor security posture during the requirements and design phase
allows the organization to reject risky suppliers before architectural commitments are made
and contracts are signed. Waiting until integration or production deployment leaves the team
with limited leverage to enforce security controls and may force costly redesigns. Proactive
vendor assessment is a cornerstone of secure supply chain management in software
development.
Question 4 of 50
A cloud-native startup is building a containerized workload platform where different
microservices handle sensitive customer data. The principal architect insists that no single
, service should have more access than necessary to perform its function, even if
compromised.
A. Defense in depth by layering multiple firewalls around each microservice container.
B. Security through obscurity by hiding API endpoints from public documentation.
C. Fail secure by ensuring services shut down completely when an anomaly is detected.
D. Least privilege by restricting each microservice's access rights to only the resources
required for its specific function. ✓ CORRECT
Correct Answer: D
Rationale: The principle of least privilege mandates that every component operates with the
minimum necessary permissions, limiting blast radius if a service is compromised. Defense
in depth complements this but does not specifically address access restriction per
component, while security through obscurity is widely rejected as a primary control.
Implementing least privilege at the service level is essential for zero-trust microservice
architectures.
Question 5 of 50
A government contractor is transitioning from waterfall to DevSecOps for a classified
document management system. The security team is concerned that rapid iterations might
bypass mandatory security controls.
A. Automate security gates within the CI/CD pipeline so that builds fail when static analysis
or dependency scans exceed risk thresholds. ✓ CORRECT
B. Require manual security sign-off from a CISO before every code commit to the repository.
C. Postpone all security testing until a hardening sprint scheduled two weeks before
production release.
D. Eliminate security documentation to reduce friction and trust developers to self-certify
compliance.
Correct Answer: A
Rationale: Automated security gates embedded in CI/CD enforce policy compliance without
creating manual bottlenecks that undermine DevSecOps velocity. Manual CISO sign-offs per
commit or postponed hardening sprints reintroduce waterfall delays and allow vulnerabilities
to accumulate unchecked. Shifting security left through pipeline automation maintains both
speed and assurance in regulated environments.
Question 6 of 50
A SaaS provider is defining security requirements for a new multi-tenant collaboration
platform. The product owner asks the security architect to prioritize requirements based on
the business impact of potential failures.
Practice Exam Actual Exam 2026/2027 with
Detailed Rationales | Complete Exam-Style
Questions | Pass Guaranteed – A+ Graded
══════════════════════════════════════
SECTION 1: SECURE SOFTWARE DEVELOPMENT LIFECYCLE Q1 – Q10
══════════════════════════════════════
Question 1 of 50
A fintech startup is designing a new mobile banking application and wants to identify
potential security threats before writing any code. The security architect recommends a
structured approach to enumerate threats based on data flow diagrams and component
interactions during the requirements phase.
A. Integrate threat modeling sessions using STRIDE during the design phase to
systematically identify spoofing, tampering, and elevation of privilege threats against each
data flow. ✓ CORRECT
B. Deploy a static application security testing tool to scan the codebase for vulnerabilities
once development begins.
C. Conduct penetration testing against the production environment after deployment to
discover runtime weaknesses.
D. Implement automated dynamic scanning during the quality assurance phase to catch
injection flaws in the API endpoints.
Correct Answer: A
Rationale: Threat modeling with STRIDE is designed to be performed during the design and
requirements phases to identify threats before code is written, making it the most
appropriate early-phase activity. Static and dynamic testing tools require code or running
applications to analyze, so they cannot be used during the initial design phase. Starting threat
modeling early reduces the cost of remediation by orders of magnitude compared to
discovering issues in production.
Question 2 of 50
A healthcare software vendor must comply with HIPAA regulations while modernizing its
patient records system. The project manager needs to translate regulatory mandates into
actionable development tasks that can be traced through each sprint.
,A. Document security requirements in a standalone spreadsheet reviewed only during the
initial project kickoff meeting.
B. Embed security requirements as user stories with acceptance criteria in the product
backlog and trace them through each sprint review. ✓ CORRECT
C. Rely on the security operations team to audit the production environment quarterly for
compliance gaps.
D. Perform a one-time risk assessment at project completion before submitting the
application for regulatory approval.
Correct Answer: B
Rationale: Embedding security requirements as traceable user stories ensures they are
reviewed, implemented, and verified during every sprint rather than being treated as a one-time
checklist. A standalone spreadsheet or quarterly audit creates dangerous visibility gaps
where requirements are forgotten during implementation. Traceability through the backlog
aligns with Agile security practices and maintains continuous compliance accountability.
Question 3 of 50
An e-commerce company experienced a breach last year due to a third-party payment
module. The CTO wants to prevent similar supply-chain risks in the upcoming platform
redesign.
A. During the deployment phase when the third-party module is first integrated into the
staging environment.
B. In the maintenance phase after the module has been running in production for at least one
quarter.
C. In the requirements and design phase before selecting vendors and finalizing architectural
dependencies. ✓ CORRECT
D. During the testing phase when integration tests reveal authentication failures in the
payment gateway.
Correct Answer: C
Rationale: Evaluating vendor security posture during the requirements and design phase
allows the organization to reject risky suppliers before architectural commitments are made
and contracts are signed. Waiting until integration or production deployment leaves the team
with limited leverage to enforce security controls and may force costly redesigns. Proactive
vendor assessment is a cornerstone of secure supply chain management in software
development.
Question 4 of 50
A cloud-native startup is building a containerized workload platform where different
microservices handle sensitive customer data. The principal architect insists that no single
, service should have more access than necessary to perform its function, even if
compromised.
A. Defense in depth by layering multiple firewalls around each microservice container.
B. Security through obscurity by hiding API endpoints from public documentation.
C. Fail secure by ensuring services shut down completely when an anomaly is detected.
D. Least privilege by restricting each microservice's access rights to only the resources
required for its specific function. ✓ CORRECT
Correct Answer: D
Rationale: The principle of least privilege mandates that every component operates with the
minimum necessary permissions, limiting blast radius if a service is compromised. Defense
in depth complements this but does not specifically address access restriction per
component, while security through obscurity is widely rejected as a primary control.
Implementing least privilege at the service level is essential for zero-trust microservice
architectures.
Question 5 of 50
A government contractor is transitioning from waterfall to DevSecOps for a classified
document management system. The security team is concerned that rapid iterations might
bypass mandatory security controls.
A. Automate security gates within the CI/CD pipeline so that builds fail when static analysis
or dependency scans exceed risk thresholds. ✓ CORRECT
B. Require manual security sign-off from a CISO before every code commit to the repository.
C. Postpone all security testing until a hardening sprint scheduled two weeks before
production release.
D. Eliminate security documentation to reduce friction and trust developers to self-certify
compliance.
Correct Answer: A
Rationale: Automated security gates embedded in CI/CD enforce policy compliance without
creating manual bottlenecks that undermine DevSecOps velocity. Manual CISO sign-offs per
commit or postponed hardening sprints reintroduce waterfall delays and allow vulnerabilities
to accumulate unchecked. Shifting security left through pipeline automation maintains both
speed and assurance in regulated environments.
Question 6 of 50
A SaaS provider is defining security requirements for a new multi-tenant collaboration
platform. The product owner asks the security architect to prioritize requirements based on
the business impact of potential failures.
