WGU D487 SECURE SW DESIGN EXAM
STUDY GUIDE 2026/2027 COMPLETE
QUESTIONS WITH VERIFIED CORRECT
ANSWERS ||
100% GUARANTEED PASS
<NEWEST VERSION>
What is a study of real-world software security initiatives organized so companies
can measure their initiatives and understand how to evolve them over time?, -
ANSWER✔Building Security In Maturity Model (BSIMM)
What is the analysis of computer software that is performed without executing
programs? - ANSWER✔Static analysis
Which International Organization for Standardization (ISO) standard is the
benchmark for information security today? - ANSWER✔ISO/IEC 27001.
What is the analysis of computer software that is performed by executing
programs on a real or virtual processor in real time?, - ANSWER✔Dynamic
analysis
Which person is responsible for designing, planning, and implementing secure
coding practices and security testing methodologies? - ANSWER✔Software
security architect
, A company is preparing to add a new feature to its flagship software product. The
new feature is similar to features that have been added in previous years, and the
requirements are well-documented. The project is expected to last three to four
months, at which time the new feature will be released to customers. Project team
members will focus solely on the new feature until the project ends. Which
software development methodology is being used? - ANSWER✔Waterfall
A new product will require an administration section for a small number of users.
Normal users will be able to view limited customer information and should not see
admin functionality within the application. Which concept is being used? -
ANSWER✔Principle of least privilege
The scrum team is attending their morning meeting, which is scheduled at the
beginning of the work day. Each team member reports what they accomplished
yesterday, what they plan to accomplish today, and if they have any impediments
that may cause them to miss their delivery deadline. Which scrum ceremony is the
team participating in? - ANSWER✔Daily Scrum
What is a list of information security vulnerabilities that aims to provide names for
publicly known problems? - ANSWER✔Common computer vulnerabilities and
exposures (CVE)
What are the two common best principles of software applications in the
development process? - ANSWER✔Quality Code & Secure Code
What ensures that the user has the appropriate role and privilege to view data? -
ANSWER✔Authorization
, Which security goal is defined by "guarding against improper information
modification or destruction and ensuring information non-repudiation and
authenticity"? - ANSWER✔Integrity
Which phase in an SDLC helps to define the problem and scope of any existing
systems and determine the objectives of new systems? - ANSWER✔Planning
What happens during a dynamic code review? - ANSWER✔Programmers monitor
system memory, functional behavior, response times, and overall performance.
How should you store your application user credentials in your application
database? - ANSWER✔Store credentials using salted hashes
Which software methodology resembles an assembly-line approach? -
ANSWER✔Waterfall model
Which software methodology approach provides faster time to market and higher
business value? - ANSWER✔Agile model
In Scrum methodology, who is responsible for making decisions on the
requirements? - ANSWER✔Product Owner
What is the product risk profile? - ANSWER✔A security assessment deliverable
that estimates the actual cost of the product
A software security team member has been tasked with creating a deliverable that
provides details on where and to what degree sensitive customer information is
collected, stored, or created within a new product offering.
, What does the team member need to deliver in order to meet the objective? -
ANSWER✔Privacy impact assessment
A software security team member has been tasked with creating a threat model for
the login process of a new product.What is the first step the team member should
take? - ANSWER✔Identify security objectives
What are three parts of the STRIDE methodology? - ANSWER✔Spoofing,
Elevation, Tampering
What is the reason software security teams host discovery meetings with
stakeholders early in the development life cycle? - ANSWER✔To ensure that
security is built into the product from the start
Why should a security team provide documented certification requirements during
the software assessment phase? - ANSWER✔Depending on the environment in
which the product resides, certifications may be required by corporate or
government entities before the software can be released to customers.
What are two items that should be included in the privacy impact assessment plan
regardless of which methodology is used? - ANSWER✔Required process steps &
Technologies and techniques
What are the goals of each SDL deliverable? - Product Risk Profile -
ANSWER✔Estimate the actual cost of the product
What are the goals of each SDL deliverable? -SDL project outline -
ANSWER✔Map security activities to the development schedule
STUDY GUIDE 2026/2027 COMPLETE
QUESTIONS WITH VERIFIED CORRECT
ANSWERS ||
100% GUARANTEED PASS
<NEWEST VERSION>
What is a study of real-world software security initiatives organized so companies
can measure their initiatives and understand how to evolve them over time?, -
ANSWER✔Building Security In Maturity Model (BSIMM)
What is the analysis of computer software that is performed without executing
programs? - ANSWER✔Static analysis
Which International Organization for Standardization (ISO) standard is the
benchmark for information security today? - ANSWER✔ISO/IEC 27001.
What is the analysis of computer software that is performed by executing
programs on a real or virtual processor in real time?, - ANSWER✔Dynamic
analysis
Which person is responsible for designing, planning, and implementing secure
coding practices and security testing methodologies? - ANSWER✔Software
security architect
, A company is preparing to add a new feature to its flagship software product. The
new feature is similar to features that have been added in previous years, and the
requirements are well-documented. The project is expected to last three to four
months, at which time the new feature will be released to customers. Project team
members will focus solely on the new feature until the project ends. Which
software development methodology is being used? - ANSWER✔Waterfall
A new product will require an administration section for a small number of users.
Normal users will be able to view limited customer information and should not see
admin functionality within the application. Which concept is being used? -
ANSWER✔Principle of least privilege
The scrum team is attending their morning meeting, which is scheduled at the
beginning of the work day. Each team member reports what they accomplished
yesterday, what they plan to accomplish today, and if they have any impediments
that may cause them to miss their delivery deadline. Which scrum ceremony is the
team participating in? - ANSWER✔Daily Scrum
What is a list of information security vulnerabilities that aims to provide names for
publicly known problems? - ANSWER✔Common computer vulnerabilities and
exposures (CVE)
What are the two common best principles of software applications in the
development process? - ANSWER✔Quality Code & Secure Code
What ensures that the user has the appropriate role and privilege to view data? -
ANSWER✔Authorization
, Which security goal is defined by "guarding against improper information
modification or destruction and ensuring information non-repudiation and
authenticity"? - ANSWER✔Integrity
Which phase in an SDLC helps to define the problem and scope of any existing
systems and determine the objectives of new systems? - ANSWER✔Planning
What happens during a dynamic code review? - ANSWER✔Programmers monitor
system memory, functional behavior, response times, and overall performance.
How should you store your application user credentials in your application
database? - ANSWER✔Store credentials using salted hashes
Which software methodology resembles an assembly-line approach? -
ANSWER✔Waterfall model
Which software methodology approach provides faster time to market and higher
business value? - ANSWER✔Agile model
In Scrum methodology, who is responsible for making decisions on the
requirements? - ANSWER✔Product Owner
What is the product risk profile? - ANSWER✔A security assessment deliverable
that estimates the actual cost of the product
A software security team member has been tasked with creating a deliverable that
provides details on where and to what degree sensitive customer information is
collected, stored, or created within a new product offering.
, What does the team member need to deliver in order to meet the objective? -
ANSWER✔Privacy impact assessment
A software security team member has been tasked with creating a threat model for
the login process of a new product.What is the first step the team member should
take? - ANSWER✔Identify security objectives
What are three parts of the STRIDE methodology? - ANSWER✔Spoofing,
Elevation, Tampering
What is the reason software security teams host discovery meetings with
stakeholders early in the development life cycle? - ANSWER✔To ensure that
security is built into the product from the start
Why should a security team provide documented certification requirements during
the software assessment phase? - ANSWER✔Depending on the environment in
which the product resides, certifications may be required by corporate or
government entities before the software can be released to customers.
What are two items that should be included in the privacy impact assessment plan
regardless of which methodology is used? - ANSWER✔Required process steps &
Technologies and techniques
What are the goals of each SDL deliverable? - Product Risk Profile -
ANSWER✔Estimate the actual cost of the product
What are the goals of each SDL deliverable? -SDL project outline -
ANSWER✔Map security activities to the development schedule
