WGU D487 Secure Software Design
Exam 2025/2026 – Versions A & B |
Verified Questions & Answers |
Graded A+
Introduction
This document includes 100% verified and up-to-date questions with correct answers for the
WGU D487 Secure Software Design Exam (Versions A & B), aligned with the 2025/2026
assessment. The content covers key topics in secure software design, ensuring comprehensive
preparation for the exam.
Topics Covered:
• Secure coding practices
• Threat modeling and risk assessment
• Software Development Life Cycle (SDLC) security
• Authentication and authorization mechanisms
• OWASP principles and secure design guidelines
Exam Questions and Answers
Version A
Question 1
What is the primary purpose of threat modeling in secure software design?
A) To optimize application performance
B) To identify and mitigate potential security risks
C) To reduce development costs
D) To improve user interface design
Correct Answer: To identify and mitigate potential security risks
Rationale: Threat modeling identifies potential security risks early in the SDLC, allowing
developers to implement mitigations proactively.
Question 2
Which OWASP Top 10 vulnerability involves executing malicious scripts in a user’s
browser?
A) SQL Injection
B) Cross-Site Scripting (XSS)
C) Broken Authentication
D) Insecure Deserialization
,Correct Answer: Cross-Site Scripting (XSS)
Rationale: Cross-Site Scripting (XSS) allows attackers to inject malicious scripts into web
pages viewed by users.
Question 3
What is a key practice in the SDLC to ensure secure software?
A) Skipping code reviews to meet deadlines
B) Implementing input validation and sanitization
C) Using unencrypted data transmission
D) Ignoring dependency updates
Correct Answer: Implementing input validation and sanitization
Rationale: Input validation and sanitization prevent common vulnerabilities like SQL
injection and XSS by ensuring data integrity.
Question 4
Which authentication mechanism is considered most secure for web applications?
A) Password-based authentication
B) Multi-factor authentication (MFA)
C) Single sign-on (SSO)
D) Session-based authentication
Correct Answer: Multi-factor authentication (MFA)
Rationale: Multi-factor authentication (MFA) enhances security by requiring multiple
verification methods, reducing the risk of unauthorized access.
Question 5
What is the purpose of a secure coding standard like OWASP Secure Coding Practices?
A) To increase application load times
B) To provide guidelines for writing secure code
C) To replace automated testing tools
D) To simplify debugging processes
Correct Answer: To provide guidelines for writing secure code
Rationale: OWASP Secure Coding Practices provide guidelines to help developers write
code that minimizes security vulnerabilities.
Question 6
What is the primary goal of input sanitization in secure coding?
A) To improve code readability
B) To prevent injection attacks
C) To reduce server load
D) To enhance user experience
Correct Answer: To prevent injection attacks
Rationale: Input sanitization removes or escapes malicious content from user inputs,
preventing injection attacks like XSS or SQL injection.
Question 7
Which of the following is a secure way to handle sensitive data in memory?
,A) Storing data in plain text
B) Using immutable strings for sensitive data
C) Clearing sensitive data from memory after use
D) Storing data in global variables
Correct Answer: Clearing sensitive data from memory after use
Rationale: Clearing sensitive data from memory after use reduces the risk of it being
accessed by unauthorized processes or memory dumps.
Question 8
What does the STRIDE model stand for in threat modeling?
A) Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation
of Privilege
B) Security, Testing, Reliability, Integration, Deployment, Encryption
C) Scalability, Trust, Redundancy, Isolation, Debugging, Efficiency
D) Standards, Threats, Risks, Incidents, Defenses, Exploitation
Correct Answer: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of
Service, Elevation of Privilege
Rationale: STRIDE is a threat modeling framework that categorizes threats into six types to
identify security risks.
Question 9
Which cryptographic algorithm is recommended for secure password hashing?
A) MD5
B) SHA-1
C) bcrypt
D) DES
Correct Answer: bcrypt
Rationale: bcrypt is a secure, adaptive hashing algorithm designed for password hashing,
resistant to brute-force attacks.
Question 10
What is a key benefit of using HTTPS over HTTP for web applications?
A) Faster data transmission
B) Encrypted data transmission
C) Simplified session management
D) Reduced server costs
Correct Answer: Encrypted data transmission
Rationale: HTTPS encrypts data transmitted between the client and server, protecting it from
interception.
Question 11
What is a common cause of broken authentication vulnerabilities?
A) Using strong passwords
B) Implementing session timeouts
C) Storing session IDs in URLs
D) Enforcing HTTPS
, Correct Answer: Storing session IDs in URLs
Rationale: Storing session IDs in URLs exposes them to interception or logging, leading to
session hijacking.
Question 12
Which of the following is a secure practice for API authentication?
A) Hardcoding API keys in source code
B) Using OAuth 2.0 for token-based authentication
C) Disabling token expiration
D) Sharing API keys publicly
Correct Answer: Using OAuth 2.0 for token-based authentication
Rationale: OAuth 2.0 provides secure, token-based authentication, allowing controlled
access without exposing credentials.
Question 13
What is the purpose of a Content Security Policy (CSP)?
A) To optimize website performance
B) To restrict sources of content execution
C) To enable cross-site scripting
D) To disable client-side validation
Correct Answer: To restrict sources of content execution
Rationale: CSP restricts the sources from which scripts, styles, and other resources can be
loaded, mitigating XSS risks.
Question 14
Which phase of the SDLC is most critical for identifying security requirements?
A) Deployment
B) Requirements Analysis
C) Testing
D) Maintenance
Correct Answer: Requirements Analysis
Rationale: Security requirements identified during the requirements analysis phase ensure
security is built into the software from the start.
Question 15
What is a common mitigation for Cross-Site Request Forgery (CSRF)?
A) Disabling cookies
B) Using anti-CSRF tokens
C) Allowing cross-origin requests
D) Storing session data in local storage
Correct Answer: Using anti-CSRF tokens
Rationale: Anti-CSRF tokens validate the authenticity of requests, preventing unauthorized
actions from forged requests.
Question 16
What is the purpose of a secure software design principle like "defense in depth"?
Exam 2025/2026 – Versions A & B |
Verified Questions & Answers |
Graded A+
Introduction
This document includes 100% verified and up-to-date questions with correct answers for the
WGU D487 Secure Software Design Exam (Versions A & B), aligned with the 2025/2026
assessment. The content covers key topics in secure software design, ensuring comprehensive
preparation for the exam.
Topics Covered:
• Secure coding practices
• Threat modeling and risk assessment
• Software Development Life Cycle (SDLC) security
• Authentication and authorization mechanisms
• OWASP principles and secure design guidelines
Exam Questions and Answers
Version A
Question 1
What is the primary purpose of threat modeling in secure software design?
A) To optimize application performance
B) To identify and mitigate potential security risks
C) To reduce development costs
D) To improve user interface design
Correct Answer: To identify and mitigate potential security risks
Rationale: Threat modeling identifies potential security risks early in the SDLC, allowing
developers to implement mitigations proactively.
Question 2
Which OWASP Top 10 vulnerability involves executing malicious scripts in a user’s
browser?
A) SQL Injection
B) Cross-Site Scripting (XSS)
C) Broken Authentication
D) Insecure Deserialization
,Correct Answer: Cross-Site Scripting (XSS)
Rationale: Cross-Site Scripting (XSS) allows attackers to inject malicious scripts into web
pages viewed by users.
Question 3
What is a key practice in the SDLC to ensure secure software?
A) Skipping code reviews to meet deadlines
B) Implementing input validation and sanitization
C) Using unencrypted data transmission
D) Ignoring dependency updates
Correct Answer: Implementing input validation and sanitization
Rationale: Input validation and sanitization prevent common vulnerabilities like SQL
injection and XSS by ensuring data integrity.
Question 4
Which authentication mechanism is considered most secure for web applications?
A) Password-based authentication
B) Multi-factor authentication (MFA)
C) Single sign-on (SSO)
D) Session-based authentication
Correct Answer: Multi-factor authentication (MFA)
Rationale: Multi-factor authentication (MFA) enhances security by requiring multiple
verification methods, reducing the risk of unauthorized access.
Question 5
What is the purpose of a secure coding standard like OWASP Secure Coding Practices?
A) To increase application load times
B) To provide guidelines for writing secure code
C) To replace automated testing tools
D) To simplify debugging processes
Correct Answer: To provide guidelines for writing secure code
Rationale: OWASP Secure Coding Practices provide guidelines to help developers write
code that minimizes security vulnerabilities.
Question 6
What is the primary goal of input sanitization in secure coding?
A) To improve code readability
B) To prevent injection attacks
C) To reduce server load
D) To enhance user experience
Correct Answer: To prevent injection attacks
Rationale: Input sanitization removes or escapes malicious content from user inputs,
preventing injection attacks like XSS or SQL injection.
Question 7
Which of the following is a secure way to handle sensitive data in memory?
,A) Storing data in plain text
B) Using immutable strings for sensitive data
C) Clearing sensitive data from memory after use
D) Storing data in global variables
Correct Answer: Clearing sensitive data from memory after use
Rationale: Clearing sensitive data from memory after use reduces the risk of it being
accessed by unauthorized processes or memory dumps.
Question 8
What does the STRIDE model stand for in threat modeling?
A) Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation
of Privilege
B) Security, Testing, Reliability, Integration, Deployment, Encryption
C) Scalability, Trust, Redundancy, Isolation, Debugging, Efficiency
D) Standards, Threats, Risks, Incidents, Defenses, Exploitation
Correct Answer: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of
Service, Elevation of Privilege
Rationale: STRIDE is a threat modeling framework that categorizes threats into six types to
identify security risks.
Question 9
Which cryptographic algorithm is recommended for secure password hashing?
A) MD5
B) SHA-1
C) bcrypt
D) DES
Correct Answer: bcrypt
Rationale: bcrypt is a secure, adaptive hashing algorithm designed for password hashing,
resistant to brute-force attacks.
Question 10
What is a key benefit of using HTTPS over HTTP for web applications?
A) Faster data transmission
B) Encrypted data transmission
C) Simplified session management
D) Reduced server costs
Correct Answer: Encrypted data transmission
Rationale: HTTPS encrypts data transmitted between the client and server, protecting it from
interception.
Question 11
What is a common cause of broken authentication vulnerabilities?
A) Using strong passwords
B) Implementing session timeouts
C) Storing session IDs in URLs
D) Enforcing HTTPS
, Correct Answer: Storing session IDs in URLs
Rationale: Storing session IDs in URLs exposes them to interception or logging, leading to
session hijacking.
Question 12
Which of the following is a secure practice for API authentication?
A) Hardcoding API keys in source code
B) Using OAuth 2.0 for token-based authentication
C) Disabling token expiration
D) Sharing API keys publicly
Correct Answer: Using OAuth 2.0 for token-based authentication
Rationale: OAuth 2.0 provides secure, token-based authentication, allowing controlled
access without exposing credentials.
Question 13
What is the purpose of a Content Security Policy (CSP)?
A) To optimize website performance
B) To restrict sources of content execution
C) To enable cross-site scripting
D) To disable client-side validation
Correct Answer: To restrict sources of content execution
Rationale: CSP restricts the sources from which scripts, styles, and other resources can be
loaded, mitigating XSS risks.
Question 14
Which phase of the SDLC is most critical for identifying security requirements?
A) Deployment
B) Requirements Analysis
C) Testing
D) Maintenance
Correct Answer: Requirements Analysis
Rationale: Security requirements identified during the requirements analysis phase ensure
security is built into the software from the start.
Question 15
What is a common mitigation for Cross-Site Request Forgery (CSRF)?
A) Disabling cookies
B) Using anti-CSRF tokens
C) Allowing cross-origin requests
D) Storing session data in local storage
Correct Answer: Using anti-CSRF tokens
Rationale: Anti-CSRF tokens validate the authenticity of requests, preventing unauthorized
actions from forged requests.
Question 16
What is the purpose of a secure software design principle like "defense in depth"?
