CYB ER S ECUR IT Y · O B JECT IVE AS S ES S MEN T A+ VERIFIED
WGU D487 Secure Software Design Exam
2026/2027 — Questions and Answers | 100%
Verified | Detailed Rationales — Pass Guaranteed
— A+ Graded — Complete
Official Exam
A+ Verified Questions Full Rationales Verified Answers
A+ 5 100%
QUE STI ONS SE CTI ONS RATI ONALE S
Complete coverage Core exam domains Every answer explained
WHAT THIS COVERS
01 Secure SDLC & Security Gates
02 Threat Modeling & Risk Assessment
03 Secure Coding & Common Vulnerabilities
04 Security Testing (SAST, DAST, Fuzzing, Reviews)
05 Privacy, Standards, Deployment & Post-Release
ABOUT THIS ASSESSMENT
Build mastery in secure software design — from secure SDLC and security gates to threat modeling, secure coding,
vulnerability analysis, security testing, privacy, standards, and post-release deployment. This original study bank targets
application and analysis skills for WGU D487, with full rationales for every answer. For review use only; not an institutional
proctored assessment.
Original items — written from publicly known course competencies Application / Analysis cognitive level per Bloom’s taxonomy
Per-question rationale explaining why the answer is correct Plausible distractors engineered to expose common misconceptions
Answer key with full distribution and passing threshold
PAS S ING S CO R E L EVEL F O R M AT
75% Advanced (WGU OA) Application / Analysis
STUVIA ACTUAL EXAM Page 1
, SECTION 1: Secure SDLC & Security Gates
Q1. A development team is preparing to start a new healthcare application project. Security requirements have not
yet been gathered, and the project manager asks when security activities should first be introduced. The team must
justify the timing to the project sponsor. Which approach best reflects secure SDLC principles?
A. Security requirements should be defined during the requirements phase alongside functional requirements,
before any design or coding begins.
B. Security requirements should be deferred until after the first penetration test reveals gaps in the application.
C. Security activities should begin only when the application is deployed to production environments.
D. Security requirements are optional if the application uses HTTPS encryption for transport.
Correct Answer: A
Rationale: Secure SDLC emphasizes integrating security from the earliest phase (requirements) so protections are
designed in, not bolted on. Deferring security until testing or production increases remediation cost by orders of
magnitude. HTTPS alone does not address authentication, authorization, or data protection requirements.
Q2. A software organization wants to adopt a formal secure development framework and is comparing Microsoft
SDL against OWASP SAMM. The security lead must explain the difference to engineering leadership. Which
statement accurately describes Microsoft SDL?
A. SDL is a maturity model measured across four business functions with three maturity levels each.
B. SDL is a prescriptive set of security practices, including mandatory threat modeling, fuzzing, and attack
surface reduction, originally developed for Microsoft products.
C. SDL focuses exclusively on post-release incident response and patch management.
D. SDL eliminates the need for code reviews by relying solely on automated static analysis.
Correct Answer: B
Rationale: Microsoft SDL is a prescriptive, practice-based framework mandating specific security activities (threat
modeling, fuzzing, attack surface reduction) at each SDLC phase. OWASP SAMM is a maturity model. SDL does not replace
code review and includes pre-release activities, not just post-release.
Q3. An engineering team uses CI/CD pipelines with multiple stage gates. They want to implement security gates
that block deployment when critical issues are found, without paralyzing delivery. The DevSecOps lead must
propose a risk-based approach. Which implementation best balances security with delivery speed?
A. Block deployment only on failed manual code reviews; skip automated security checks to maintain velocity.
B. Block all deployments if any security finding of any severity is present, including informational.
C. Block deployment on critical and high findings, route medium findings to tracked remediation, and surface
informational findings on dashboards only.
D. Disable security gates in production pipelines to prevent false positives from blocking releases.
Correct Answer: C
Rationale: Risk-based security gates block only on critical/high findings to avoid pipeline paralysis, while lower-severity
findings are tracked separately. Blocking on informational findings creates alert fatigue. Disabling gates in production is
the opposite of defense-in-depth.
Q4. A startup is benchmarking its secure development program against an industry framework. The team wants a
model that measures maturity across business functions such as Governance, Design, Implementation, Verification,
and Operations. The CISO has asked for the most precise recommendation. Which framework best fits this
requirement?
STUVIA ACTUAL EXAM · Page 2
, A. PCI-DSS
B. NIST SP 800-53
C. ISO/IEC 27001 ISMS
D. OWASP SAMM
Correct Answer: D
Rationale: OWASP SAMM is the maturity model structured around Governance, Design, Implementation, Verification,
and Operations business functions, each with three maturity levels. PCI-DSS and ISO 27001 cover broader compliance.
NIST 800-53 is a controls catalog for federal systems, not a dev-maturity model.
Q5. A CISO argues that the team should move security testing earlier in the development lifecycle. Engineering
leadership is skeptical about the cost of changes. The CISO must justify the shift-left principle with the strongest
business rationale. Which argument best supports shift-left?
A. Defects found during requirements or design cost orders of magnitude less to remediate than the same
defects found in production.
B. Moving security earlier eliminates the need for penetration testing prior to release.
C. Shift-left primarily benefits compliance audits by ensuring documentation is generated earlier.
D. Shift-left reduces the need for security training because developers self-correct during coding.
Correct Answer: A
Rationale: Empirical studies (IBM Systems Sciences Institute) show that defects discovered in requirements cost roughly
100x less to fix than the same defects found in production. Shift-left reduces cost and risk but does not eliminate later
testing. It does not replace training or penetration testing.
Q6. A team must demonstrate to an external auditor that each security requirement has been implemented and
tested. The audit window is short, and the team needs the strongest possible evidence. Which artifact provides the
most defensible evidence of end-to-end security implementation?
A. A signed security policy document stored in the corporate wiki.
B. A traceability matrix mapping each security requirement to design artifacts, code modules, and test cases.
C. A list of approved security tools used during the build.
D. An executive summary of the latest penetration test.
Correct Answer: B
Rationale: A traceability matrix links each requirement to design, implementation, and verification artifacts, providing
end-to-end evidence. Policy documents and tool inventories do not demonstrate implementation. Penetration test
summaries are point-in-time snapshots, not continuous evidence.
Q7. An agile team is revising its Definition of Done to incorporate security without becoming a bottleneck. The team
has a fortnightly sprint cadence and ships multiple stories per sprint. The scrum master wants additions that are
scalable. Which addition most directly enforces secure coding at scale?
A. Require all stories to be reviewed by the CISO before closure.
B. Mandate that no security findings of any severity exist before story closure.
C. Require threat model update, peer security review, and a clean SAST scan on changed code before closure.
D. Remove all third-party dependencies from each story.
Correct Answer: C
Rationale: Requiring threat model updates, peer review, and clean SAST on changed code scales security across the team
without bottlenecks. CISO review of every story is a bottleneck. Zero findings of any severity is unrealistic. Removing
dependencies is impractical.
STUVIA ACTUAL EXAM · Page 3
, Q8. A developer proposes installing secret-scanning hooks locally in every developer's pre-commit hook. Another
engineer argues the same scan should run only in CI to keep developer machines fast. The team must choose the
most defensible approach. Which option is correct?
A. Run secret scanning only in pre-commit because developers will fix issues immediately.
B. Run secret scanning only in CI because pre-commit hooks slow down development.
C. Skip secret scanning entirely; rely on code review to catch secrets.
D. Run secret scanning in both pre-commit (fast feedback) and CI (enforcement gate) because each catches
different scenarios.
Correct Answer: D
Rationale: Pre-commit hooks provide fast developer feedback but can be bypassed (--no-verify). CI provides enforcement
as a gate. Defense-in-depth requires both layers. Skipping scanning relies on human review, which is unreliable for
secrets.
Q9. A team has completed an architectural design document for a new payment module. Coding has not yet
started, and leadership wants the most actionable security review at this stage. The architect is considering multiple
options. Which activity provides the most actionable security review at this stage?
A. Conduct a threat-model-based design review using STRIDE against each component and data flow.
B. Wait until coding is complete, then run a SAST scan on the implemented code.
C. Hire an external auditor to review the corporate security policy document.
D. Run a DAST scan against a mock-up of the user interface.
Correct Answer: A
Rationale: A threat-model-based design review identifies architectural flaws before code is written, when fixes are
cheapest. SAST and DAST require code. Policy review does not assess the specific design.
Q10. An organization cannot afford a dedicated security team member embedded in every product squad. The CISO
wants to extend security expertise across teams without inflating headcount. The team is evaluating several
models. Which approach best extends security expertise across teams?
A. Mandate that every developer attend annual security awareness training.
B. Establish a security champions program where each squad has a trained developer who liaises with the
central security team.
C. Outsource all code reviews to a third-party security vendor.
D. Consolidate all development into a single team to centralize security oversight.
Correct Answer: B
Rationale: A security champions program embeds trained liaisons in each squad, scaling security expertise without
dedicated headcount. Annual training alone lacks continuity. Outsourcing reviews creates bottlenecks. Consolidation
harms delivery throughput.
Q11. A vendor delivers a third-party library to be embedded in a medical device. The procurement team asks what
artifact most supports ongoing vulnerability management throughout the device's lifecycle. The vendor has offered
several artifacts. What should procurement request?
A. The library's user documentation.
B. The library's unit test reports.
C. A Software Bill of Materials (SBOM) in CycloneDX or SPDX format listing all transitive dependencies and
versions.
D. A signed Non-Disclosure Agreement.
Correct Answer: C
STUVIA ACTUAL EXAM · Page 4
WGU D487 Secure Software Design Exam
2026/2027 — Questions and Answers | 100%
Verified | Detailed Rationales — Pass Guaranteed
— A+ Graded — Complete
Official Exam
A+ Verified Questions Full Rationales Verified Answers
A+ 5 100%
QUE STI ONS SE CTI ONS RATI ONALE S
Complete coverage Core exam domains Every answer explained
WHAT THIS COVERS
01 Secure SDLC & Security Gates
02 Threat Modeling & Risk Assessment
03 Secure Coding & Common Vulnerabilities
04 Security Testing (SAST, DAST, Fuzzing, Reviews)
05 Privacy, Standards, Deployment & Post-Release
ABOUT THIS ASSESSMENT
Build mastery in secure software design — from secure SDLC and security gates to threat modeling, secure coding,
vulnerability analysis, security testing, privacy, standards, and post-release deployment. This original study bank targets
application and analysis skills for WGU D487, with full rationales for every answer. For review use only; not an institutional
proctored assessment.
Original items — written from publicly known course competencies Application / Analysis cognitive level per Bloom’s taxonomy
Per-question rationale explaining why the answer is correct Plausible distractors engineered to expose common misconceptions
Answer key with full distribution and passing threshold
PAS S ING S CO R E L EVEL F O R M AT
75% Advanced (WGU OA) Application / Analysis
STUVIA ACTUAL EXAM Page 1
, SECTION 1: Secure SDLC & Security Gates
Q1. A development team is preparing to start a new healthcare application project. Security requirements have not
yet been gathered, and the project manager asks when security activities should first be introduced. The team must
justify the timing to the project sponsor. Which approach best reflects secure SDLC principles?
A. Security requirements should be defined during the requirements phase alongside functional requirements,
before any design or coding begins.
B. Security requirements should be deferred until after the first penetration test reveals gaps in the application.
C. Security activities should begin only when the application is deployed to production environments.
D. Security requirements are optional if the application uses HTTPS encryption for transport.
Correct Answer: A
Rationale: Secure SDLC emphasizes integrating security from the earliest phase (requirements) so protections are
designed in, not bolted on. Deferring security until testing or production increases remediation cost by orders of
magnitude. HTTPS alone does not address authentication, authorization, or data protection requirements.
Q2. A software organization wants to adopt a formal secure development framework and is comparing Microsoft
SDL against OWASP SAMM. The security lead must explain the difference to engineering leadership. Which
statement accurately describes Microsoft SDL?
A. SDL is a maturity model measured across four business functions with three maturity levels each.
B. SDL is a prescriptive set of security practices, including mandatory threat modeling, fuzzing, and attack
surface reduction, originally developed for Microsoft products.
C. SDL focuses exclusively on post-release incident response and patch management.
D. SDL eliminates the need for code reviews by relying solely on automated static analysis.
Correct Answer: B
Rationale: Microsoft SDL is a prescriptive, practice-based framework mandating specific security activities (threat
modeling, fuzzing, attack surface reduction) at each SDLC phase. OWASP SAMM is a maturity model. SDL does not replace
code review and includes pre-release activities, not just post-release.
Q3. An engineering team uses CI/CD pipelines with multiple stage gates. They want to implement security gates
that block deployment when critical issues are found, without paralyzing delivery. The DevSecOps lead must
propose a risk-based approach. Which implementation best balances security with delivery speed?
A. Block deployment only on failed manual code reviews; skip automated security checks to maintain velocity.
B. Block all deployments if any security finding of any severity is present, including informational.
C. Block deployment on critical and high findings, route medium findings to tracked remediation, and surface
informational findings on dashboards only.
D. Disable security gates in production pipelines to prevent false positives from blocking releases.
Correct Answer: C
Rationale: Risk-based security gates block only on critical/high findings to avoid pipeline paralysis, while lower-severity
findings are tracked separately. Blocking on informational findings creates alert fatigue. Disabling gates in production is
the opposite of defense-in-depth.
Q4. A startup is benchmarking its secure development program against an industry framework. The team wants a
model that measures maturity across business functions such as Governance, Design, Implementation, Verification,
and Operations. The CISO has asked for the most precise recommendation. Which framework best fits this
requirement?
STUVIA ACTUAL EXAM · Page 2
, A. PCI-DSS
B. NIST SP 800-53
C. ISO/IEC 27001 ISMS
D. OWASP SAMM
Correct Answer: D
Rationale: OWASP SAMM is the maturity model structured around Governance, Design, Implementation, Verification,
and Operations business functions, each with three maturity levels. PCI-DSS and ISO 27001 cover broader compliance.
NIST 800-53 is a controls catalog for federal systems, not a dev-maturity model.
Q5. A CISO argues that the team should move security testing earlier in the development lifecycle. Engineering
leadership is skeptical about the cost of changes. The CISO must justify the shift-left principle with the strongest
business rationale. Which argument best supports shift-left?
A. Defects found during requirements or design cost orders of magnitude less to remediate than the same
defects found in production.
B. Moving security earlier eliminates the need for penetration testing prior to release.
C. Shift-left primarily benefits compliance audits by ensuring documentation is generated earlier.
D. Shift-left reduces the need for security training because developers self-correct during coding.
Correct Answer: A
Rationale: Empirical studies (IBM Systems Sciences Institute) show that defects discovered in requirements cost roughly
100x less to fix than the same defects found in production. Shift-left reduces cost and risk but does not eliminate later
testing. It does not replace training or penetration testing.
Q6. A team must demonstrate to an external auditor that each security requirement has been implemented and
tested. The audit window is short, and the team needs the strongest possible evidence. Which artifact provides the
most defensible evidence of end-to-end security implementation?
A. A signed security policy document stored in the corporate wiki.
B. A traceability matrix mapping each security requirement to design artifacts, code modules, and test cases.
C. A list of approved security tools used during the build.
D. An executive summary of the latest penetration test.
Correct Answer: B
Rationale: A traceability matrix links each requirement to design, implementation, and verification artifacts, providing
end-to-end evidence. Policy documents and tool inventories do not demonstrate implementation. Penetration test
summaries are point-in-time snapshots, not continuous evidence.
Q7. An agile team is revising its Definition of Done to incorporate security without becoming a bottleneck. The team
has a fortnightly sprint cadence and ships multiple stories per sprint. The scrum master wants additions that are
scalable. Which addition most directly enforces secure coding at scale?
A. Require all stories to be reviewed by the CISO before closure.
B. Mandate that no security findings of any severity exist before story closure.
C. Require threat model update, peer security review, and a clean SAST scan on changed code before closure.
D. Remove all third-party dependencies from each story.
Correct Answer: C
Rationale: Requiring threat model updates, peer review, and clean SAST on changed code scales security across the team
without bottlenecks. CISO review of every story is a bottleneck. Zero findings of any severity is unrealistic. Removing
dependencies is impractical.
STUVIA ACTUAL EXAM · Page 3
, Q8. A developer proposes installing secret-scanning hooks locally in every developer's pre-commit hook. Another
engineer argues the same scan should run only in CI to keep developer machines fast. The team must choose the
most defensible approach. Which option is correct?
A. Run secret scanning only in pre-commit because developers will fix issues immediately.
B. Run secret scanning only in CI because pre-commit hooks slow down development.
C. Skip secret scanning entirely; rely on code review to catch secrets.
D. Run secret scanning in both pre-commit (fast feedback) and CI (enforcement gate) because each catches
different scenarios.
Correct Answer: D
Rationale: Pre-commit hooks provide fast developer feedback but can be bypassed (--no-verify). CI provides enforcement
as a gate. Defense-in-depth requires both layers. Skipping scanning relies on human review, which is unreliable for
secrets.
Q9. A team has completed an architectural design document for a new payment module. Coding has not yet
started, and leadership wants the most actionable security review at this stage. The architect is considering multiple
options. Which activity provides the most actionable security review at this stage?
A. Conduct a threat-model-based design review using STRIDE against each component and data flow.
B. Wait until coding is complete, then run a SAST scan on the implemented code.
C. Hire an external auditor to review the corporate security policy document.
D. Run a DAST scan against a mock-up of the user interface.
Correct Answer: A
Rationale: A threat-model-based design review identifies architectural flaws before code is written, when fixes are
cheapest. SAST and DAST require code. Policy review does not assess the specific design.
Q10. An organization cannot afford a dedicated security team member embedded in every product squad. The CISO
wants to extend security expertise across teams without inflating headcount. The team is evaluating several
models. Which approach best extends security expertise across teams?
A. Mandate that every developer attend annual security awareness training.
B. Establish a security champions program where each squad has a trained developer who liaises with the
central security team.
C. Outsource all code reviews to a third-party security vendor.
D. Consolidate all development into a single team to centralize security oversight.
Correct Answer: B
Rationale: A security champions program embeds trained liaisons in each squad, scaling security expertise without
dedicated headcount. Annual training alone lacks continuity. Outsourcing reviews creates bottlenecks. Consolidation
harms delivery throughput.
Q11. A vendor delivers a third-party library to be embedded in a medical device. The procurement team asks what
artifact most supports ongoing vulnerability management throughout the device's lifecycle. The vendor has offered
several artifacts. What should procurement request?
A. The library's user documentation.
B. The library's unit test reports.
C. A Software Bill of Materials (SBOM) in CycloneDX or SPDX format listing all transitive dependencies and
versions.
D. A signed Non-Disclosure Agreement.
Correct Answer: C
STUVIA ACTUAL EXAM · Page 4
