1
WGU D487 Secure Software Design
Exam 2025 – Versions A & B | Complete
Accurate Questions and 100% Verified
Answers | A+ Certified
Version A
1. What is the primary purpose of the Security Assessment (A1) phase in the Secure
Software Development Lifecycle (SDL)?
A) To deploy the application in a production environment
B) To identify product risks and create a security project outline
C) To perform penetration testing on the software
D) To write secure code for the application
Correct Answer: B
Rationale: The Security Assessment (A1) phase focuses on identifying risks and
establishing a security roadmap, ensuring that security is integrated early in the SDL.
2. Which security goal ensures that information is not disclosed to unauthorized
individuals?
A) Integrity
B) Availability
C) Confidentiality
D) Authentication
Correct Answer: C
Rationale: Confidentiality protects sensitive information from unauthorized access,
ensuring only authorized users can view it.
3. In which phase of the SDLC is threat modeling typically conducted?
A) Implementation
B) Design
C) Testing
D) Deployment
Correct Answer: B
Rationale: Threat modeling is performed during the Design phase to identify potential
vulnerabilities and attack scenarios early.
4. What is the purpose of static analysis in secure software development?
A) To execute the program and monitor its behavior
B) To review source code without executing it
C) To simulate attacks on the deployed application
D) To test the application in a production environment
, 2
Correct Answer: B
Rationale: Static analysis involves reviewing source code manually or with tools to
identify vulnerabilities without running the program.
5. Which methodology follows a sequential approach to software development?
A) Agile
B) Waterfall
C) DevOps
D) Spiral
Correct Answer: B
Rationale: The Waterfall methodology is a linear, sequential process where each phase is
completed before moving to the next.
6. What does the Building Security In Maturity Model (BSIMM) primarily focus on?
A) Automating vulnerability scanning
B) Studying real-world software security initiatives
C) Defining compliance standards
D) Developing cloud-native applications
Correct Answer: B
Rationale: BSIMM analyzes security practices across organizations to help improve
software security initiatives.
7. Which secure coding practice helps prevent SQL injection attacks?
A) Using encrypted connection strings
B) Implementing parameterized queries
C) Storing credentials in plain text
D) Disabling input validation
Correct Answer: B
Rationale: Parameterized queries separate SQL code from user input, preventing
malicious SQL injection.
8. What is the role of a software security champion in the SDL?
A) To write all secure code for the project
B) To promote security practices within the development team
C) To perform external penetration testing
D) To manage the production environment
Correct Answer: B
Rationale: A security champion advocates for security best practices and amplifies
security awareness within the team.
9. Which phase of the SDL involves ensuring the secure disposal of an application?
A) Design
B) Testing
C) End of Life
D) Implementation
Correct Answer: C
Rationale: The End of Life phase focuses on securely removing the application and its
data from systems.
10. What is the purpose of a privacy impact assessment in software development?
A) To test the application’s performance
B) To identify risks to user privacy
WGU D487 Secure Software Design
Exam 2025 – Versions A & B | Complete
Accurate Questions and 100% Verified
Answers | A+ Certified
Version A
1. What is the primary purpose of the Security Assessment (A1) phase in the Secure
Software Development Lifecycle (SDL)?
A) To deploy the application in a production environment
B) To identify product risks and create a security project outline
C) To perform penetration testing on the software
D) To write secure code for the application
Correct Answer: B
Rationale: The Security Assessment (A1) phase focuses on identifying risks and
establishing a security roadmap, ensuring that security is integrated early in the SDL.
2. Which security goal ensures that information is not disclosed to unauthorized
individuals?
A) Integrity
B) Availability
C) Confidentiality
D) Authentication
Correct Answer: C
Rationale: Confidentiality protects sensitive information from unauthorized access,
ensuring only authorized users can view it.
3. In which phase of the SDLC is threat modeling typically conducted?
A) Implementation
B) Design
C) Testing
D) Deployment
Correct Answer: B
Rationale: Threat modeling is performed during the Design phase to identify potential
vulnerabilities and attack scenarios early.
4. What is the purpose of static analysis in secure software development?
A) To execute the program and monitor its behavior
B) To review source code without executing it
C) To simulate attacks on the deployed application
D) To test the application in a production environment
, 2
Correct Answer: B
Rationale: Static analysis involves reviewing source code manually or with tools to
identify vulnerabilities without running the program.
5. Which methodology follows a sequential approach to software development?
A) Agile
B) Waterfall
C) DevOps
D) Spiral
Correct Answer: B
Rationale: The Waterfall methodology is a linear, sequential process where each phase is
completed before moving to the next.
6. What does the Building Security In Maturity Model (BSIMM) primarily focus on?
A) Automating vulnerability scanning
B) Studying real-world software security initiatives
C) Defining compliance standards
D) Developing cloud-native applications
Correct Answer: B
Rationale: BSIMM analyzes security practices across organizations to help improve
software security initiatives.
7. Which secure coding practice helps prevent SQL injection attacks?
A) Using encrypted connection strings
B) Implementing parameterized queries
C) Storing credentials in plain text
D) Disabling input validation
Correct Answer: B
Rationale: Parameterized queries separate SQL code from user input, preventing
malicious SQL injection.
8. What is the role of a software security champion in the SDL?
A) To write all secure code for the project
B) To promote security practices within the development team
C) To perform external penetration testing
D) To manage the production environment
Correct Answer: B
Rationale: A security champion advocates for security best practices and amplifies
security awareness within the team.
9. Which phase of the SDL involves ensuring the secure disposal of an application?
A) Design
B) Testing
C) End of Life
D) Implementation
Correct Answer: C
Rationale: The End of Life phase focuses on securely removing the application and its
data from systems.
10. What is the purpose of a privacy impact assessment in software development?
A) To test the application’s performance
B) To identify risks to user privacy
