WGU D486 GOVERNANCE, RISK, AND
COMPLIANCE 70DF CERTIFICATION SCRIPT
2026 QUESTIONS WITH SOLUTIONS
GRADED A+
◍ What are the Governance practices in OpenSAMM?.
Answer: Strategy & Metrics – Security planning & monitoring.Policy &
Compliance – Security regulations and risk management.Education &
Guidance – Developer security training.
◍ What does the STRIDE threat model stand for, and what security properties
does it impact?.
Answer: STRIDE is a threat classification model used to analyze and
mitigate security risks. It consists of:Spoofing – Impersonating a user to
gain access (Authentication)Tampering – Modifying or altering data
(Integrity)Repudiation – Performing actions without traceability
(Non-repudiation)Information Disclosure – Gaining unauthorized access to
data (Confidentiality)Denial of Service (DoS) – Preventing legitimate use of
a system (Availability)Elevation of Privilege – Gaining higher access levels
without authorization (Authorization)
◍ What happens in Step 4 of the PSIRT process?.
Answer: The timeframe for remediation is determined.The format for public
reporting (e.g., security bulletin, knowledge base article) is finalized.
◍ Confidentiality.
Answer: The property that data or information is not made available or
disclosed to unauthorized persons or processes.
◍ Shadow IT.
, Answer: The unauthorized deployment and use of IT systems within an
organization without the IT department's approval or knowledge. Source:
Morphisec's Ultimate List of Cybersecurity Terms
◍ When does a PSIRT typically make a public disclosure about a security
vulnerability?.
Answer: When an external post-release discovery event occurs and
includes:Relevant CVSS base and temporal scoresA CVE (Common
Vulnerabilities and Exposures) ID report
◍ What are the Governance practices in BSIMM?.
Answer: Strategy & MetricsCompliance & PolicyTraining
◍ What is ISO/IEC 30111:2019 focused on?.
Answer: It provides requirements and recommendations for processing and
remediating reported potential vulnerabilities in a product or service.
◍ How should an organization store passwords securely to prevent credential
recovery attacks?.
Answer: Enforce the use of strong, salted hashing functions when storing
passwords (e.g., bcrypt, Argon2, PBKDF2).
◍ What are the three possible outcomes of a Final Security Review before
software release?.
Answer: 1. Security Review Passed – All security issues are fixed, and the
software meets SDL requirements for release. 2. Security Review Passed
with Exceptions – Some security issues remain unresolved, but acceptable
compromises were made, and fixes will be addressed in future patches. 3.
Security Review Not Passed (Escalation Required) – Unresolved security
vulnerabilities prevent release, requiring escalation to management for risk
assessment and decision-making.Final security reviews ensure that security
risks are managed appropriately before shipping the software.
◍ Regulations.
Answer: Rules enforced by a regulatory body or authority.
◍ The organization's testing team has created a catalog of test cases using the
, source code and design documentation of the new product. Each test case
will be executed for each user role in the new product. Which type of
security testing technique is being performed?.
Answer: white-box
◍ Due Care.
Answer: The care an ordinarily reasonable and prudent person would use
under the same or similar circumstances.
◍ Acceptable Risk.
Answer: A suitable level of risk commensurate with the potential benefits of
an organization's operations as determined by senior management.
◍ What is the recommended way to mitigate a threat identified during threat
modeling?.
Answer: Apply a standard accepted countermeasure
◍ Security team members have been instructed to document which developers
and analysts will perform product testing and which tools they will use.
Which step of the security test plan is being performed?.
Answer: Identify internal resources
◍ Integrity.
Answer: A property whereby data has not been altered in an unauthorized
manner since it was created, transmitted, or stored.
◍ What are the key elements of a Data Flow Diagram (DFD) and their
symbols?.
Answer: External Element (Rectangle) – Represents an external system/user
interacting with the application.Process (Circle) – Handles data operations
or transforms input into output.Multiple Processes (Double Circle) –
Represents a collection of sub-processes functioning together.Data Store
(Two Parallel Lines) – Stores data without modification.Data Flow (Arrow)
– Represents movement and direction of data between elements.Trust
Boundary (Dashed Curve) – Marks security boundaries where privilege
levels change between components.
COMPLIANCE 70DF CERTIFICATION SCRIPT
2026 QUESTIONS WITH SOLUTIONS
GRADED A+
◍ What are the Governance practices in OpenSAMM?.
Answer: Strategy & Metrics – Security planning & monitoring.Policy &
Compliance – Security regulations and risk management.Education &
Guidance – Developer security training.
◍ What does the STRIDE threat model stand for, and what security properties
does it impact?.
Answer: STRIDE is a threat classification model used to analyze and
mitigate security risks. It consists of:Spoofing – Impersonating a user to
gain access (Authentication)Tampering – Modifying or altering data
(Integrity)Repudiation – Performing actions without traceability
(Non-repudiation)Information Disclosure – Gaining unauthorized access to
data (Confidentiality)Denial of Service (DoS) – Preventing legitimate use of
a system (Availability)Elevation of Privilege – Gaining higher access levels
without authorization (Authorization)
◍ What happens in Step 4 of the PSIRT process?.
Answer: The timeframe for remediation is determined.The format for public
reporting (e.g., security bulletin, knowledge base article) is finalized.
◍ Confidentiality.
Answer: The property that data or information is not made available or
disclosed to unauthorized persons or processes.
◍ Shadow IT.
, Answer: The unauthorized deployment and use of IT systems within an
organization without the IT department's approval or knowledge. Source:
Morphisec's Ultimate List of Cybersecurity Terms
◍ When does a PSIRT typically make a public disclosure about a security
vulnerability?.
Answer: When an external post-release discovery event occurs and
includes:Relevant CVSS base and temporal scoresA CVE (Common
Vulnerabilities and Exposures) ID report
◍ What are the Governance practices in BSIMM?.
Answer: Strategy & MetricsCompliance & PolicyTraining
◍ What is ISO/IEC 30111:2019 focused on?.
Answer: It provides requirements and recommendations for processing and
remediating reported potential vulnerabilities in a product or service.
◍ How should an organization store passwords securely to prevent credential
recovery attacks?.
Answer: Enforce the use of strong, salted hashing functions when storing
passwords (e.g., bcrypt, Argon2, PBKDF2).
◍ What are the three possible outcomes of a Final Security Review before
software release?.
Answer: 1. Security Review Passed – All security issues are fixed, and the
software meets SDL requirements for release. 2. Security Review Passed
with Exceptions – Some security issues remain unresolved, but acceptable
compromises were made, and fixes will be addressed in future patches. 3.
Security Review Not Passed (Escalation Required) – Unresolved security
vulnerabilities prevent release, requiring escalation to management for risk
assessment and decision-making.Final security reviews ensure that security
risks are managed appropriately before shipping the software.
◍ Regulations.
Answer: Rules enforced by a regulatory body or authority.
◍ The organization's testing team has created a catalog of test cases using the
, source code and design documentation of the new product. Each test case
will be executed for each user role in the new product. Which type of
security testing technique is being performed?.
Answer: white-box
◍ Due Care.
Answer: The care an ordinarily reasonable and prudent person would use
under the same or similar circumstances.
◍ Acceptable Risk.
Answer: A suitable level of risk commensurate with the potential benefits of
an organization's operations as determined by senior management.
◍ What is the recommended way to mitigate a threat identified during threat
modeling?.
Answer: Apply a standard accepted countermeasure
◍ Security team members have been instructed to document which developers
and analysts will perform product testing and which tools they will use.
Which step of the security test plan is being performed?.
Answer: Identify internal resources
◍ Integrity.
Answer: A property whereby data has not been altered in an unauthorized
manner since it was created, transmitted, or stored.
◍ What are the key elements of a Data Flow Diagram (DFD) and their
symbols?.
Answer: External Element (Rectangle) – Represents an external system/user
interacting with the application.Process (Circle) – Handles data operations
or transforms input into output.Multiple Processes (Double Circle) –
Represents a collection of sub-processes functioning together.Data Store
(Two Parallel Lines) – Stores data without modification.Data Flow (Arrow)
– Represents movement and direction of data between elements.Trust
Boundary (Dashed Curve) – Marks security boundaries where privilege
levels change between components.
