WGU D487 Secure Software Design Exam
Questions and Correct Answers (Verified
Answers) Plus Rationales 2026 Q&A | Instant
Download Pdf
Question 1
Which principle of secure software design ensures that a system should
provide only the minimum permissions necessary for users and
processes to perform their tasks?
A. Separation of duties
B. Defense in depth
C. Principle of least privilege
D. Fail-safe defaults
The principle of least privilege reduces security risks by ensuring that
accounts, applications, and processes have only the access rights
required to complete their intended functions. Limiting privileges
minimizes potential damage if an account or component is
compromised.
,Question 2
A software developer validates user input before storing it in a database
primarily to prevent which type of attack?
A. Cross-site request forgery
B. SQL injection
C. Distributed denial-of-service
D. Session hijacking
SQL injection occurs when attackers insert malicious SQL commands
through application inputs. Input validation and parameterized
queries help prevent unauthorized database commands from being
executed.
Question 3
Which software development practice integrates security activities
throughout every phase of the software development lifecycle?
A. Security testing after deployment only
B. Secure Software Development Lifecycle (SSDLC)
C. Emergency patching
D. Code refactoring
,The Secure Software Development Lifecycle incorporates security
planning, design reviews, secure coding, testing, and maintenance
activities throughout development rather than treating security as an
afterthought.
Question 4
Which vulnerability occurs when an application executes commands or
code supplied by an attacker?
A. Buffer overflow
B. Race condition
C. Code injection
D. Broken authentication
Code injection happens when an application accepts and executes
untrusted input as part of a command or program instruction. Proper
validation and safe APIs reduce this risk.
Question 5
What is the primary purpose of threat modeling during software
design?
, A. Increase application performance
B. Replace security testing
C. Identify potential threats and design appropriate mitigations
D. Eliminate the need for documentation
Threat modeling helps developers identify possible attack paths,
evaluate risks, and incorporate security controls into the architecture
before implementation begins.
Question 6
Which security concept requires systems to continue operating securely
even when failures occur?
A. Open design
B. Fail-safe defaults
C. Complete mediation
D. Economy of mechanism
Fail-safe defaults ensure that when a system encounters errors or
unexpected conditions, access is denied by default rather than
accidentally allowing unauthorized actions.
Question 7
Questions and Correct Answers (Verified
Answers) Plus Rationales 2026 Q&A | Instant
Download Pdf
Question 1
Which principle of secure software design ensures that a system should
provide only the minimum permissions necessary for users and
processes to perform their tasks?
A. Separation of duties
B. Defense in depth
C. Principle of least privilege
D. Fail-safe defaults
The principle of least privilege reduces security risks by ensuring that
accounts, applications, and processes have only the access rights
required to complete their intended functions. Limiting privileges
minimizes potential damage if an account or component is
compromised.
,Question 2
A software developer validates user input before storing it in a database
primarily to prevent which type of attack?
A. Cross-site request forgery
B. SQL injection
C. Distributed denial-of-service
D. Session hijacking
SQL injection occurs when attackers insert malicious SQL commands
through application inputs. Input validation and parameterized
queries help prevent unauthorized database commands from being
executed.
Question 3
Which software development practice integrates security activities
throughout every phase of the software development lifecycle?
A. Security testing after deployment only
B. Secure Software Development Lifecycle (SSDLC)
C. Emergency patching
D. Code refactoring
,The Secure Software Development Lifecycle incorporates security
planning, design reviews, secure coding, testing, and maintenance
activities throughout development rather than treating security as an
afterthought.
Question 4
Which vulnerability occurs when an application executes commands or
code supplied by an attacker?
A. Buffer overflow
B. Race condition
C. Code injection
D. Broken authentication
Code injection happens when an application accepts and executes
untrusted input as part of a command or program instruction. Proper
validation and safe APIs reduce this risk.
Question 5
What is the primary purpose of threat modeling during software
design?
, A. Increase application performance
B. Replace security testing
C. Identify potential threats and design appropriate mitigations
D. Eliminate the need for documentation
Threat modeling helps developers identify possible attack paths,
evaluate risks, and incorporate security controls into the architecture
before implementation begins.
Question 6
Which security concept requires systems to continue operating securely
even when failures occur?
A. Open design
B. Fail-safe defaults
C. Complete mediation
D. Economy of mechanism
Fail-safe defaults ensure that when a system encounters errors or
unexpected conditions, access is denied by default rather than
accidentally allowing unauthorized actions.
Question 7
