WGU D487 Objective Assessment — Secure
Software Engineering (2026 Version)
Comprehensive Practice Exam.
SECTION 1: SOFTWARE SECURITY FUNDAMENTALS (Questions 1–10)
Q1: Which security principle requires that a user or process be granted only the
minimum level of access necessary to perform a specific function?
A. Defense in depth
B. Separation of duties
C. Least privilege [CORRECT]
D. Fail secure
Correct Answer: C
Rationale: Least privilege is a core access control principle defined in NIST SP
800-53 (AC-6) that restricts user and process permissions to the minimum
necessary, reducing the attack surface and limiting damage from compromised
accounts or processes.
Q2: In the STRIDE threat modeling methodology, which threat category
corresponds to an attacker impersonating a legitimate user or system
component?
A. Tampering
B. Spoofing [CORRECT]
C. Repudiation
D. Information disclosure
Correct Answer: B
Rationale: Spoofing in STRIDE (Microsoft's threat classification framework) refers
to identity deception where an attacker falsifies identity to gain unauthorized
access, distinct from tampering (data modification) or repudiation (denial of
actions).
Q3: Which of the following represents a primary goal of the Confidentiality
component of the CIA triad?
,A. Ensuring data is accessible when needed by authorized users
B. Preventing unauthorized disclosure of information [CORRECT]
C. Maintaining data accuracy and consistency
D. Providing non-repudiation of transactions
Correct Answer: B
Rationale: Confidentiality, as defined in ISO/IEC 27001 and NIST SP 800-53,
ensures that information is accessible only to those authorized to have access,
protecting against unauthorized disclosure through encryption, access controls,
and classification.
Q4: Select all that apply: Which of the following are included in the OWASP Top
10 for 2021?
A. Broken Access Control [CORRECT]
B. Cryptographic Failures [CORRECT]
C. Security Misconfiguration [CORRECT]
D. Insecure Design [CORRECT]
E. Buffer Overflow
Correct Answers: A, B, C, D [CORRECT]
Rationale: The OWASP Top 10:2021 lists Broken Access Control (A01),
Cryptographic Failures (A02), Injection (A03), Insecure Design (A04), Security
Misconfiguration (A05), Vulnerable and Outdated Components (A06),
Identification and Authentication Failures (A07), Software and Data Integrity
Failures (A08), Security Logging and Monitoring Failures (A09), and Server-Side
Request Forgery (A10). Buffer overflow is a CWE Top 25 category but not a
standalone OWASP Top 10 entry.
Q5: An attacker exploits a vulnerability in a web application's input validation to
execute arbitrary commands on the underlying operating system. Which attack
vector best describes this scenario?
A. Cross-site scripting (XSS)
B. SQL injection
C. Command injection [CORRECT]
D. Cross-site request forgery (CSRF)
,Correct Answer: C
Rationale: Command injection (CWE-78) occurs when an application passes
unsafe user-supplied data to a system shell or command interpreter, allowing
arbitrary OS command execution, distinct from SQL injection (database
commands) or XSS (client-side script injection) per OWASP guidelines.
Q6: Which threat modeling approach focuses on identifying threats from the
perspective of an attacker's goals and capabilities rather than system
architecture?
A. Data flow diagram (DFD) analysis
B. Attack trees
C. Misuse/abuse case modeling [CORRECT]
D. STRIDE-per-element
Correct Answer: C
Rationale: Misuse and abuse case modeling, as described in NIST SP 800-30 and
secure requirements engineering practices, identifies malicious actor goals and
system misuse scenarios from an adversarial perspective, complementing
architecture-centric approaches like STRIDE.
Q7: The Defense in Depth security strategy is best characterized by which of the
following descriptions?
A. Implementing a single strong perimeter firewall
B. Layering multiple independent security controls throughout a system
[CORRECT]
C. Concentrating all security resources on the network boundary
D. Relying exclusively on encryption for data protection
Correct Answer: B
Rationale: Defense in depth, a principle endorsed by NIST SP 800-53 and the NSA,
employs multiple overlapping security controls at different layers (network, host,
application, data) so that if one control fails, others remain to protect the system.
Q8: Which CWE Top 25 category describes a vulnerability where software uses
externally supplied input to construct a database query without neutralizing
special elements?
A. CWE-79: Cross-site Scripting
, B. CWE-89: SQL Injection [CORRECT]
C. CWE-287: Improper Authentication
D. CWE-434: Unrestricted Upload of File with Dangerous Type
Correct Answer: B
Rationale: CWE-89 (SQL Injection) specifically describes the improper
neutralization of special elements used in SQL commands, ranking consistently
in the MITRE CWE Top 25 Most Dangerous Software Weaknesses due to its
prevalence and exploitability.
Q9: In the context of secure software engineering, what is the primary distinction
between "security by design" and "security as an afterthought"?
A. Security by design uses commercial tools; afterthought uses open-source
tools
B. Security by design integrates security throughout the SDLC; afterthought adds
security post-development [CORRECT]
C. Security by design focuses only on network security; afterthought focuses on
application security
D. Security by design is required only for government systems
Correct Answer: B
Rationale: Security by design, as advocated by NIST SSDF (SP 800-218) and
Microsoft SDL, embeds security activities into each SDLC phase from inception,
whereas bolt-on security attempts to retrofit controls after development, resulting
in higher cost and residual risk.
Q10: Which of the following best describes the attack surface of a software
system?
A. The physical location where servers are housed
B. The sum of all points where an unauthorized user can attempt to enter or
extract data [CORRECT]
C. The total number of lines of code in the application
D. The network bandwidth available to the application
Correct Answer: B
Software Engineering (2026 Version)
Comprehensive Practice Exam.
SECTION 1: SOFTWARE SECURITY FUNDAMENTALS (Questions 1–10)
Q1: Which security principle requires that a user or process be granted only the
minimum level of access necessary to perform a specific function?
A. Defense in depth
B. Separation of duties
C. Least privilege [CORRECT]
D. Fail secure
Correct Answer: C
Rationale: Least privilege is a core access control principle defined in NIST SP
800-53 (AC-6) that restricts user and process permissions to the minimum
necessary, reducing the attack surface and limiting damage from compromised
accounts or processes.
Q2: In the STRIDE threat modeling methodology, which threat category
corresponds to an attacker impersonating a legitimate user or system
component?
A. Tampering
B. Spoofing [CORRECT]
C. Repudiation
D. Information disclosure
Correct Answer: B
Rationale: Spoofing in STRIDE (Microsoft's threat classification framework) refers
to identity deception where an attacker falsifies identity to gain unauthorized
access, distinct from tampering (data modification) or repudiation (denial of
actions).
Q3: Which of the following represents a primary goal of the Confidentiality
component of the CIA triad?
,A. Ensuring data is accessible when needed by authorized users
B. Preventing unauthorized disclosure of information [CORRECT]
C. Maintaining data accuracy and consistency
D. Providing non-repudiation of transactions
Correct Answer: B
Rationale: Confidentiality, as defined in ISO/IEC 27001 and NIST SP 800-53,
ensures that information is accessible only to those authorized to have access,
protecting against unauthorized disclosure through encryption, access controls,
and classification.
Q4: Select all that apply: Which of the following are included in the OWASP Top
10 for 2021?
A. Broken Access Control [CORRECT]
B. Cryptographic Failures [CORRECT]
C. Security Misconfiguration [CORRECT]
D. Insecure Design [CORRECT]
E. Buffer Overflow
Correct Answers: A, B, C, D [CORRECT]
Rationale: The OWASP Top 10:2021 lists Broken Access Control (A01),
Cryptographic Failures (A02), Injection (A03), Insecure Design (A04), Security
Misconfiguration (A05), Vulnerable and Outdated Components (A06),
Identification and Authentication Failures (A07), Software and Data Integrity
Failures (A08), Security Logging and Monitoring Failures (A09), and Server-Side
Request Forgery (A10). Buffer overflow is a CWE Top 25 category but not a
standalone OWASP Top 10 entry.
Q5: An attacker exploits a vulnerability in a web application's input validation to
execute arbitrary commands on the underlying operating system. Which attack
vector best describes this scenario?
A. Cross-site scripting (XSS)
B. SQL injection
C. Command injection [CORRECT]
D. Cross-site request forgery (CSRF)
,Correct Answer: C
Rationale: Command injection (CWE-78) occurs when an application passes
unsafe user-supplied data to a system shell or command interpreter, allowing
arbitrary OS command execution, distinct from SQL injection (database
commands) or XSS (client-side script injection) per OWASP guidelines.
Q6: Which threat modeling approach focuses on identifying threats from the
perspective of an attacker's goals and capabilities rather than system
architecture?
A. Data flow diagram (DFD) analysis
B. Attack trees
C. Misuse/abuse case modeling [CORRECT]
D. STRIDE-per-element
Correct Answer: C
Rationale: Misuse and abuse case modeling, as described in NIST SP 800-30 and
secure requirements engineering practices, identifies malicious actor goals and
system misuse scenarios from an adversarial perspective, complementing
architecture-centric approaches like STRIDE.
Q7: The Defense in Depth security strategy is best characterized by which of the
following descriptions?
A. Implementing a single strong perimeter firewall
B. Layering multiple independent security controls throughout a system
[CORRECT]
C. Concentrating all security resources on the network boundary
D. Relying exclusively on encryption for data protection
Correct Answer: B
Rationale: Defense in depth, a principle endorsed by NIST SP 800-53 and the NSA,
employs multiple overlapping security controls at different layers (network, host,
application, data) so that if one control fails, others remain to protect the system.
Q8: Which CWE Top 25 category describes a vulnerability where software uses
externally supplied input to construct a database query without neutralizing
special elements?
A. CWE-79: Cross-site Scripting
, B. CWE-89: SQL Injection [CORRECT]
C. CWE-287: Improper Authentication
D. CWE-434: Unrestricted Upload of File with Dangerous Type
Correct Answer: B
Rationale: CWE-89 (SQL Injection) specifically describes the improper
neutralization of special elements used in SQL commands, ranking consistently
in the MITRE CWE Top 25 Most Dangerous Software Weaknesses due to its
prevalence and exploitability.
Q9: In the context of secure software engineering, what is the primary distinction
between "security by design" and "security as an afterthought"?
A. Security by design uses commercial tools; afterthought uses open-source
tools
B. Security by design integrates security throughout the SDLC; afterthought adds
security post-development [CORRECT]
C. Security by design focuses only on network security; afterthought focuses on
application security
D. Security by design is required only for government systems
Correct Answer: B
Rationale: Security by design, as advocated by NIST SSDF (SP 800-218) and
Microsoft SDL, embeds security activities into each SDLC phase from inception,
whereas bolt-on security attempts to retrofit controls after development, resulting
in higher cost and residual risk.
Q10: Which of the following best describes the attack surface of a software
system?
A. The physical location where servers are housed
B. The sum of all points where an unauthorized user can attempt to enter or
extract data [CORRECT]
C. The total number of lines of code in the application
D. The network bandwidth available to the application
Correct Answer: B
