WGU D487 Secure Software Design (KEO1) Pre-Assessment
2026 Complete Questions and Answers with Expert Solutions
- 150 Questions with Answers
Page 1
,Q1. In a microservices architecture, a development team is implementing a new
payment service. They need to ensure that a compromised service cannot escalate
privileges laterally. Which design pattern is most effective for this requirement?
A. Service mesh with mutual TLS and fine-grained authorization policies
B. Shared database with a single high-privilege account for all services
C. Client-side encryption with a common key stored in environment variables
D. Monolithic design with centralized authentication and authorization
Correct Answer: A. Service mesh with mutual TLS and fine-grained authorization
policies
Rationale: A service mesh with mutual TLS and fine-grained authorization policies
provides strong service-to-service authentication and least-privilege access, limiting
lateral movement. Shared databases with high-privilege accounts and common keys
increase blast radius. Monolithic design does not reduce lateral movement within the
monolith.
Why Wrong:
B - Creates a single point of failure and high-privilege access, increasing lateral
movement risk.
C - Common key in environment variables is a weak secret management practice and
does not restrict service-level access.
D - A monolith still has internal trust boundaries; compromise of one module can
affect all.
Reference: OWASP Application Security Verification Standard, V1 Architecture, Design
and Threat Modeling
Q2. A developer is implementing a secure password reset flow. Which approach best
prevents user enumeration while maintaining usability?
A. Always return a generic message and require email verification before resetting.
B. Return different errors for unknown email vs. locked account to inform the user.
C. Use a timing attack to reveal valid accounts by measuring response time.
D. Immediately reset the password and send the new password in plaintext to the email.
Correct Answer: A. Always return a generic message and require email verification
before resetting.
Rationale: Returning a generic message for both valid and invalid emails prevents user
enumeration. Requiring email verification ensures the reset link is only sent to the verified
owner. Different errors leak account existence. Timing side channels are exploitable.
Sending plaintext passwords is insecure.
Why Wrong:
B - Different errors reveal whether an account exists, enabling enumeration.
C - Timing differences can be used to enumerate accounts, not prevent it.
Page 2
, D - Plaintext password transmission is a security risk and does not address
enumeration.
Reference: OWASP Forgot Password Cheat Sheet
Q3. A security architect is evaluating a system that uses a relational database with
sensitive personal data. Which control is most effective for mitigating the risk of SQL
injection in a legacy application that cannot be rewritten?
A. Parameterized queries for all database access
B. Input validation using a blocklist of SQL keywords
C. Web application firewall (WAF) with SQL injection rules
D. Stored procedures with dynamic SQL built via string concatenation
Correct Answer: A. Parameterized queries for all database access
Rationale: Parameterized queries (prepared statements) are the definitive defense against
SQL injection because they separate SQL code from data. Blocklists are easily bypassed.
WAFs can be evaded and are not a complete solution. Dynamic SQL in stored procedures
still vulnerable if concatenation is used.
Why Wrong:
B - Blocklists are incomplete and can be bypassed with encoding or alternate syntax.
C - WAFs provide detection but not absolute prevention; they can be evaded.
D - String concatenation in stored procedures still allows injection.
Reference: OWASP SQL Injection Prevention Cheat Sheet
Q4. A software development team is adopting a DevSecOps pipeline. Which practice
best ensures that security is integrated continuously without slowing down
development?
A. Running a full static application security testing (SAST) scan only at the end of each
release cycle.
B. Automating security checks (SAST, DAST, dependency scanning) in the CI/CD
pipeline with fail-fast on critical issues.
C. Performing manual penetration testing after every code commit.
D. Deploying to production first and then performing security review.
Correct Answer: B. Automating security checks (SAST, DAST, dependency scanning)
in the CI/CD pipeline with fail-fast on critical issues.
Rationale: Automating security checks in CI/CD with fail-fast on critical issues enables
early detection without manual delays. Running only at release end misses issues earlier
and creates bottlenecks. Manual pen testing after each commit is impractical. Security
after deployment is too late.
Why Wrong:
A - Late detection increases cost and delays releases.
Page 3
, C - Manual pen testing is not scalable for every commit.
D - Post-deployment review exposes production to vulnerabilities.
Reference: NIST SP 800-218 Secure Software Development Framework (SSDF)
Q5. A software architect is designing a system that handles sensitive user data. The
system must ensure data integrity and non-repudiation of user actions. Which
combination of cryptographic controls is most appropriate?
A. Symmetric encryption with a shared key and HMAC for integrity
B. Digital signatures using asymmetric cryptography and a public key infrastructure
(PKI)
C. Hashing with a salt and no encryption
D. SSL/TLS for all communications without application-level signing
Correct Answer: B. Digital signatures using asymmetric cryptography and a public
key infrastructure (PKI)
Rationale: Digital signatures provide both integrity and non-repudiation because they
bind the signer's identity to the data. HMAC with a shared key provides integrity but not
non-repudiation (both parties can produce the same MAC). Hashing alone does not
provide non-repudiation. TLS protects in transit but does not provide non-repudiation of
application actions.
Why Wrong:
A - HMAC does not provide non-repudiation because the secret is shared.
C - Hashing ensures integrity but not authenticity or non-repudiation.
D - TLS does not provide end-to-end non-repudiation for application data.
Reference: NIST SP 800-57 Part 1, Recommendation for Key Management
Q6. A security engineer is performing a threat model for a web application. Which
threat modeling methodology is best suited for identifying threats based on the
system's data flow and trust boundaries?
A. STRIDE per element
B. PASTA (Process for Attack Simulation and Threat Analysis)
C. Attack trees
D. Liability analysis
Correct Answer: A. STRIDE per element
Rationale: STRIDE is a mnemonic for threat categories and is often used alongside data
flow diagrams, making it ideal for identifying threats across trust boundaries. PASTA is a
more comprehensive risk-based approach. Attack trees focus on specific attack scenarios.
Liability analysis is not a threat modeling methodology.
Why Wrong:
B - PASTA is a broader risk assessment framework, not specifically tied to data flow
Page 4
2026 Complete Questions and Answers with Expert Solutions
- 150 Questions with Answers
Page 1
,Q1. In a microservices architecture, a development team is implementing a new
payment service. They need to ensure that a compromised service cannot escalate
privileges laterally. Which design pattern is most effective for this requirement?
A. Service mesh with mutual TLS and fine-grained authorization policies
B. Shared database with a single high-privilege account for all services
C. Client-side encryption with a common key stored in environment variables
D. Monolithic design with centralized authentication and authorization
Correct Answer: A. Service mesh with mutual TLS and fine-grained authorization
policies
Rationale: A service mesh with mutual TLS and fine-grained authorization policies
provides strong service-to-service authentication and least-privilege access, limiting
lateral movement. Shared databases with high-privilege accounts and common keys
increase blast radius. Monolithic design does not reduce lateral movement within the
monolith.
Why Wrong:
B - Creates a single point of failure and high-privilege access, increasing lateral
movement risk.
C - Common key in environment variables is a weak secret management practice and
does not restrict service-level access.
D - A monolith still has internal trust boundaries; compromise of one module can
affect all.
Reference: OWASP Application Security Verification Standard, V1 Architecture, Design
and Threat Modeling
Q2. A developer is implementing a secure password reset flow. Which approach best
prevents user enumeration while maintaining usability?
A. Always return a generic message and require email verification before resetting.
B. Return different errors for unknown email vs. locked account to inform the user.
C. Use a timing attack to reveal valid accounts by measuring response time.
D. Immediately reset the password and send the new password in plaintext to the email.
Correct Answer: A. Always return a generic message and require email verification
before resetting.
Rationale: Returning a generic message for both valid and invalid emails prevents user
enumeration. Requiring email verification ensures the reset link is only sent to the verified
owner. Different errors leak account existence. Timing side channels are exploitable.
Sending plaintext passwords is insecure.
Why Wrong:
B - Different errors reveal whether an account exists, enabling enumeration.
C - Timing differences can be used to enumerate accounts, not prevent it.
Page 2
, D - Plaintext password transmission is a security risk and does not address
enumeration.
Reference: OWASP Forgot Password Cheat Sheet
Q3. A security architect is evaluating a system that uses a relational database with
sensitive personal data. Which control is most effective for mitigating the risk of SQL
injection in a legacy application that cannot be rewritten?
A. Parameterized queries for all database access
B. Input validation using a blocklist of SQL keywords
C. Web application firewall (WAF) with SQL injection rules
D. Stored procedures with dynamic SQL built via string concatenation
Correct Answer: A. Parameterized queries for all database access
Rationale: Parameterized queries (prepared statements) are the definitive defense against
SQL injection because they separate SQL code from data. Blocklists are easily bypassed.
WAFs can be evaded and are not a complete solution. Dynamic SQL in stored procedures
still vulnerable if concatenation is used.
Why Wrong:
B - Blocklists are incomplete and can be bypassed with encoding or alternate syntax.
C - WAFs provide detection but not absolute prevention; they can be evaded.
D - String concatenation in stored procedures still allows injection.
Reference: OWASP SQL Injection Prevention Cheat Sheet
Q4. A software development team is adopting a DevSecOps pipeline. Which practice
best ensures that security is integrated continuously without slowing down
development?
A. Running a full static application security testing (SAST) scan only at the end of each
release cycle.
B. Automating security checks (SAST, DAST, dependency scanning) in the CI/CD
pipeline with fail-fast on critical issues.
C. Performing manual penetration testing after every code commit.
D. Deploying to production first and then performing security review.
Correct Answer: B. Automating security checks (SAST, DAST, dependency scanning)
in the CI/CD pipeline with fail-fast on critical issues.
Rationale: Automating security checks in CI/CD with fail-fast on critical issues enables
early detection without manual delays. Running only at release end misses issues earlier
and creates bottlenecks. Manual pen testing after each commit is impractical. Security
after deployment is too late.
Why Wrong:
A - Late detection increases cost and delays releases.
Page 3
, C - Manual pen testing is not scalable for every commit.
D - Post-deployment review exposes production to vulnerabilities.
Reference: NIST SP 800-218 Secure Software Development Framework (SSDF)
Q5. A software architect is designing a system that handles sensitive user data. The
system must ensure data integrity and non-repudiation of user actions. Which
combination of cryptographic controls is most appropriate?
A. Symmetric encryption with a shared key and HMAC for integrity
B. Digital signatures using asymmetric cryptography and a public key infrastructure
(PKI)
C. Hashing with a salt and no encryption
D. SSL/TLS for all communications without application-level signing
Correct Answer: B. Digital signatures using asymmetric cryptography and a public
key infrastructure (PKI)
Rationale: Digital signatures provide both integrity and non-repudiation because they
bind the signer's identity to the data. HMAC with a shared key provides integrity but not
non-repudiation (both parties can produce the same MAC). Hashing alone does not
provide non-repudiation. TLS protects in transit but does not provide non-repudiation of
application actions.
Why Wrong:
A - HMAC does not provide non-repudiation because the secret is shared.
C - Hashing ensures integrity but not authenticity or non-repudiation.
D - TLS does not provide end-to-end non-repudiation for application data.
Reference: NIST SP 800-57 Part 1, Recommendation for Key Management
Q6. A security engineer is performing a threat model for a web application. Which
threat modeling methodology is best suited for identifying threats based on the
system's data flow and trust boundaries?
A. STRIDE per element
B. PASTA (Process for Attack Simulation and Threat Analysis)
C. Attack trees
D. Liability analysis
Correct Answer: A. STRIDE per element
Rationale: STRIDE is a mnemonic for threat categories and is often used alongside data
flow diagrams, making it ideal for identifying threats across trust boundaries. PASTA is a
more comprehensive risk-based approach. Attack trees focus on specific attack scenarios.
Liability analysis is not a threat modeling methodology.
Why Wrong:
B - PASTA is a broader risk assessment framework, not specifically tied to data flow
Page 4
