D487 Secure SW Design EXAM 2025/2026 MOST RECENT
COMPREHENSIVE REAL EXAM QUESTIONS AND CORRECT
ANSWERS |COMPLETE VERIFIED SOLUTIONS |A+ GRADED
|100% CORRECT!!
What are threat models that start with visualizing the
application you are
building? - ANSWER-application-centric
threat modeling
During what phase of the SDL is any policy that exists outside
of the SDL policy
is reviewed? - ANSWER-A3 Design and
Development
What is the phase of the SDLC in which organizations prepare
for vulnerabilities after the product has been released? -
ANSWER-Post-Release Support phase
Who responds to software product security incidents that
involve the external discovery of post-release software
vulnerabilities? - ANSWER-Post-Release
,PSIRT
Response
Who is an expert on promoting security awareness, best
practices, and
simplifying software security? - ANSWER-Software Security
Champion (SSC)
Who is an expert to promote awareness of products to the
wider software
community? - ANSWER-Software Security
Evangelist (SSE)
Which post-release support activity (PRSA) details the process
for investigating, mitigating, and communicating findings when
security vulnerabilities are discovered in a software product? -
ANSWER-External vulnerability disclosure response
Which post-release support key success factor says that any
change or component reuse should trigger security
development life cycle activities? - ANSWER-SDL cycle for any
architectural changes or code reuses
What are the four categories in BSIMM? - ANSWER-
governance, intelligence,
,software security development life cycle touchpoints,
and deployment.
In which OpenSAMM core practice area would one find
environment
hardening? - ANSWER-
Deployment
Which step will you find in the SANS Institute Cyber Defense
seven-step recipe
for conducting threat modeling and application risk
analysis? - ANSWER-
Brainstorm threats from
adversaries
Which practice in the Ship (A5) phase of the security
development cycle verifies
whether the product meets security mandates? -
ANSWER-A5 policy
compliance
analysis
Which post-release support activity defines the process to
communicate,
, identify, and alleviate security threats? - ANSWER-l
PRSA1: Externa
vulnerability disclosure
response
Within OpenSAMM, what focuses on the processes and
activities related to organizational software development
activities within OpenSAMM practice areas? - ANSWER-
Governance
Within OpenSAMM, what focuses on the processes and
activities related to creating software within development
projects within OpenSAMM practice areas? - ANSWER-
Construction
Which practice in the Ship (A5) phase of the security
development cycle uses
tools to identify weaknesses in the product? - ANSWER-
Vulnerability scan
Which post-release support activity should be completed when
companies are
joining together? - ANSWER-Security
architectural reviews
COMPREHENSIVE REAL EXAM QUESTIONS AND CORRECT
ANSWERS |COMPLETE VERIFIED SOLUTIONS |A+ GRADED
|100% CORRECT!!
What are threat models that start with visualizing the
application you are
building? - ANSWER-application-centric
threat modeling
During what phase of the SDL is any policy that exists outside
of the SDL policy
is reviewed? - ANSWER-A3 Design and
Development
What is the phase of the SDLC in which organizations prepare
for vulnerabilities after the product has been released? -
ANSWER-Post-Release Support phase
Who responds to software product security incidents that
involve the external discovery of post-release software
vulnerabilities? - ANSWER-Post-Release
,PSIRT
Response
Who is an expert on promoting security awareness, best
practices, and
simplifying software security? - ANSWER-Software Security
Champion (SSC)
Who is an expert to promote awareness of products to the
wider software
community? - ANSWER-Software Security
Evangelist (SSE)
Which post-release support activity (PRSA) details the process
for investigating, mitigating, and communicating findings when
security vulnerabilities are discovered in a software product? -
ANSWER-External vulnerability disclosure response
Which post-release support key success factor says that any
change or component reuse should trigger security
development life cycle activities? - ANSWER-SDL cycle for any
architectural changes or code reuses
What are the four categories in BSIMM? - ANSWER-
governance, intelligence,
,software security development life cycle touchpoints,
and deployment.
In which OpenSAMM core practice area would one find
environment
hardening? - ANSWER-
Deployment
Which step will you find in the SANS Institute Cyber Defense
seven-step recipe
for conducting threat modeling and application risk
analysis? - ANSWER-
Brainstorm threats from
adversaries
Which practice in the Ship (A5) phase of the security
development cycle verifies
whether the product meets security mandates? -
ANSWER-A5 policy
compliance
analysis
Which post-release support activity defines the process to
communicate,
, identify, and alleviate security threats? - ANSWER-l
PRSA1: Externa
vulnerability disclosure
response
Within OpenSAMM, what focuses on the processes and
activities related to organizational software development
activities within OpenSAMM practice areas? - ANSWER-
Governance
Within OpenSAMM, what focuses on the processes and
activities related to creating software within development
projects within OpenSAMM practice areas? - ANSWER-
Construction
Which practice in the Ship (A5) phase of the security
development cycle uses
tools to identify weaknesses in the product? - ANSWER-
Vulnerability scan
Which post-release support activity should be completed when
companies are
joining together? - ANSWER-Security
architectural reviews
