WGU D487 SECURE SOFTWARE DESIGN QUESTIONS
AND ANSWERS SET A+
✔✔What is a countermeasure to the web application security frame (ASF) configuration
management threat category? -✔✔Compliance requirement
✔✔Which type of requirement specifies that file formats the application sends to
financial institutions must be certified every four years? -✔✔Compliance requirement
✔✔Which type of requirement specifies that credit card numbers displayed in the
application will be masked so they only show the last four digits? -✔✔Privacy
requirement
✔✔Which type of requirement specifies that user passwords will require a minimum of 8
characters and must include at least one uppercase character, one number, and one
special character? -✔✔Security requirement
✔✔Which type of requirement specifies that credit card numbers are designated as
highly sensitive confidential personal information? -✔✔Data classification requirement
✔✔Which privacy impact statement requirement type defines how personal information
is protected on devices used by more than a single associate? -✔✔Privacy control
requirements
✔✔In which step of the PASTA threat modeling methodology does design flaw analysis
take place? -✔✔Vulnerability and weakness analysis
✔✔Which privacy impact statement requirement type defines who has access to
personal information within the product? -✔✔Access requirements
, ✔✔Which security assessment deliverable defines milestones that will be met during
each phase of the project, merged into the product development schedule? -✔✔SDL
project outline
✔✔Which architecture deliverable identifies whether the product adheres to
organization security rules? -✔✔Policy compliance analysis
✔✔Which threat modeling process identifies threats to each individual object in a data
flow diagram? -✔✔STRIDE-per-element
✔✔The DREAD methodology has been used to classify an identified exploit where:
the attacker could log in as an administrator (damage potential)
the attacker could log in at any time (reproducibility)
almost anybody could perform the attack (exploitability)
all system users could be affected (affected users)
any person who knows how to open dev tools in a browser could find the vulnerability
(discoverability)
Which rating should be assigned to the exploit after performing an analysis using a
ternary ranking scale where high risk = 3 points, medium risk = 2 points, and low risk =
1 point? -✔✔High risk
✔✔What is the recommended way to mitigate a threat identified during threat modeling?
-✔✔Apply a standard accepted countermeasure
✔✔The organization's testing team has created a catalog of test cases using the source
code and design documentation of the new product. Each test case will be executed for
each user role in the new product. Which type of security testing technique is being
performed? -✔✔White-box
✔✔Security team members have been instructed to document which developers and
analysts will perform product testing and which tools they will use. Which step of the
security test plan is being performed? -✔✔Identify internal resources
✔✔Security team members have been instructed to document how many users will
access the new product and what roles those users will play. Which step of the security
test plan is being performed? -✔✔Define the user community
✔✔The project team received a SonarQube report of their most recent stage
deployment that contains 15 vulnerabilities that must be fixed before the product may be
released to production. Which security testing technique is being used? -✔✔Source-
code analysis
AND ANSWERS SET A+
✔✔What is a countermeasure to the web application security frame (ASF) configuration
management threat category? -✔✔Compliance requirement
✔✔Which type of requirement specifies that file formats the application sends to
financial institutions must be certified every four years? -✔✔Compliance requirement
✔✔Which type of requirement specifies that credit card numbers displayed in the
application will be masked so they only show the last four digits? -✔✔Privacy
requirement
✔✔Which type of requirement specifies that user passwords will require a minimum of 8
characters and must include at least one uppercase character, one number, and one
special character? -✔✔Security requirement
✔✔Which type of requirement specifies that credit card numbers are designated as
highly sensitive confidential personal information? -✔✔Data classification requirement
✔✔Which privacy impact statement requirement type defines how personal information
is protected on devices used by more than a single associate? -✔✔Privacy control
requirements
✔✔In which step of the PASTA threat modeling methodology does design flaw analysis
take place? -✔✔Vulnerability and weakness analysis
✔✔Which privacy impact statement requirement type defines who has access to
personal information within the product? -✔✔Access requirements
, ✔✔Which security assessment deliverable defines milestones that will be met during
each phase of the project, merged into the product development schedule? -✔✔SDL
project outline
✔✔Which architecture deliverable identifies whether the product adheres to
organization security rules? -✔✔Policy compliance analysis
✔✔Which threat modeling process identifies threats to each individual object in a data
flow diagram? -✔✔STRIDE-per-element
✔✔The DREAD methodology has been used to classify an identified exploit where:
the attacker could log in as an administrator (damage potential)
the attacker could log in at any time (reproducibility)
almost anybody could perform the attack (exploitability)
all system users could be affected (affected users)
any person who knows how to open dev tools in a browser could find the vulnerability
(discoverability)
Which rating should be assigned to the exploit after performing an analysis using a
ternary ranking scale where high risk = 3 points, medium risk = 2 points, and low risk =
1 point? -✔✔High risk
✔✔What is the recommended way to mitigate a threat identified during threat modeling?
-✔✔Apply a standard accepted countermeasure
✔✔The organization's testing team has created a catalog of test cases using the source
code and design documentation of the new product. Each test case will be executed for
each user role in the new product. Which type of security testing technique is being
performed? -✔✔White-box
✔✔Security team members have been instructed to document which developers and
analysts will perform product testing and which tools they will use. Which step of the
security test plan is being performed? -✔✔Identify internal resources
✔✔Security team members have been instructed to document how many users will
access the new product and what roles those users will play. Which step of the security
test plan is being performed? -✔✔Define the user community
✔✔The project team received a SonarQube report of their most recent stage
deployment that contains 15 vulnerabilities that must be fixed before the product may be
released to production. Which security testing technique is being used? -✔✔Source-
code analysis
