WGU D487 TERMS EXAM QUESTIONS WITH CORRECT ANSWERS LATEST UPDATE 2026

WGU D487 TERMS EXAM QUESTIONS WITH CORRECT ANSWERS LATEST UPDATE 2026 Accepted risk - Answers Known security or privacy risk that stakeholders formally approve to remain unresolved for release or operation Accepted risk register - Answers Documented list of accepted risk, approvals, owners' rationale, expiration dates, and follow up actions. Access control - Answers Restricting access to systems, functions, and data based on roles, permissions, policies, or authorization rules AST - Answers Abstract syntax tree (AST): A tree-like representation of a program's source code structure, used by tools to analyze code for errors, vulnerabilities, or quality issues Active scanner - Answers Security scanner that sends requests or probes to a target system to identify vulnerabilities or misconfigurations Affected Users (DREAD) - Answers Dread factor that estimates how many users, systems, or customers would be affected if the threat were exploited Agile - Answers An iterative approach that values flexibility, customer feedback, and responding to change Agile Manifesto - Answers Set of Agile values emphasizing individuals and interactions, working software,, customer collaboration, and responding to change Alpha level testing - Answers An early-stage testing phase conducted internally by the development team to identify major bugs before broader release Application decomposition - Answers The process of breaking down an application into its individual components to better understand its structure and identify potential security weaknesses Application security - Answers The practice of building, testing, and maintaining software in a way that protects it from vulnerabilities and threats throughout its lifecycle Application-centric threat modeling - Answers A threat modeling approach that focuses on analyzing the application's architecture and design to identify potential threats and attack vectors Architecture analysis - Answers Security review of architecture and design using models such as DFDs, STRIDE, and risk assessments Asset-centric threat modeling - Answers A threat modeling approach that begins by identifying valuable assets within a system and then determines how those assets could be attacked Attack surface review - Answers Architecture review activity that identifies exposed entry points, interfaces, services, data flows, and trust boundaries that attackers could target Authenticated scan - Answers Vulnerability scan performed with valid credentials so the scanner can inspect internal configuration, patch levels, and authenticated functionality Authentication - Answers Verifying the identity of a user, service, or system before grating access Authentication and password management - Answers Secure coding control that verifies user identity and stores passwords using strong salted one-way hashes Authorization - Answers Determining what an authenticated user, service, or system is allowed to access or perform Authorization testing - Answers Testing whether users can access only the functions, data, and actions they are permitted to use Benchmark - Answers Reference point used to compare security practices, maturity, performance, or compliance against a known standard or peer group Beta level testing - Answers A pre-release testing phase where a nearly complete product is released to a limited external audience to gather feedback and identify issues Black-box testing - Answers Testing performed without knowledge of internal code, architecture, or design detail BSIMM - Answers Building Security In Maturing Model (BSIMM): An observational model used to benchmark real-world software security initiatives Bucket requirement - Answers Agile SDL security task tracked and completed when capacity allows, such as security training, library upgrades, or periodic improvements Buffer overflow - Answers Vulnerability where data exceeds memory boundaries, potentially causing crashes or unauthorized execution Bugtraq - Answers Historically important vulnerability disclosure and discussion mailing list CERT - Answers Computer Emergency response team (CERT): Organization or function that publishes advisories, coordinates incident response, and shares vulnerability guidance Change management - Answers A structured process for proposing, reviewing, approving, and implementing changes to a system in a controlled manner to minimize risk Code review - Answers Manual review of source code, ideally with a checklist and separate reviewer, to find defects, insecure logic, weak access control, hard coded secrets, and coding-standard violations Communication security - Answers Protecting data in transit using secure protocols and encryption, such as TLS Compliance requirement - Answers Requirement that mandates adherence to laws, regulations, standards, audits, certifications, or external obligations Construction - Answers The SDLC phase in which actual coding and development of the software takes place based on the design specifications Control flow analysis - Answers Analysis of the order in which program statements, branches, loops, and paths execute to identify logic, security, or reliability issues Cryptographic practices - Answers Use of proven, industry standard cryptographic algorithms and secure key handling rather than custom cryptography CVE - Answers Common Vulnerabilities and Exposures (CVE): A standardized identifier for publicly known cybersecurity vulnerabilities CVSS - Answers Common Vulnerability Scoring System (CVSS): Framework for rating vulnerability severity using standardized metrics Daily scrum - Answers Scrum event where the team briefly coordinates progress, plans, and blocker during the sprint Data classification requirement - Answers Requirement that labels data based on sensitivity, such as public, confidential, or highly sensitive Data flow - Answers DFD element usually shown as an arrow that represents data moving between entities, processes, and stores Data flow analysis - Answers A technique used to trace how data moves through a system, helping identify points where sensitive information could be exposed or mishandled DFD - Answers Data Flow Diagram (DFD): Diagram that shows processes, data stores, external entities, data flows, and trust boundaries in a system Data integrity requirement - Answers Requirement ensuring data remains accurate, consistent, complete, and protected from unauthorized alteration Data protection - Answers Protecting data at rest, in transit, and in use through encryption, masking, tokenization, and access controls Data store - Answers DFD element usually shown as an open-ended rectangle or parallel lines that represent stored data DAST - Answers Dynamic application security testing (DAST): A security testing method that analyzes a running application from the outside to identify vulnerabilities, simulating how an attacker would interact with it Damage Potential - Answers A risk assessment factor that measures the extent of harm that could result if a particular vulnerability were successfully exploited Default credentials - Answers Vendor, test, or default accounts and passwords that must be removed, disabled, or rotated before release Defense in depth - Answers Uses multiple layers of protection so that if on control fails, another control still protects the system Denial of Service - Answers STRIDE threat where service becomes unavailable or degraded Deployment phase - Answers SDLC phase where tested software is released into production or a target environment with configuration, rollout, and rollback planning Design security review - Answers A formal evaluation of a systems design to ensure it meets functional, technical, and security requirements before implementation Design phase - Answers The SDLC stage in which the architecture, components, and technical specifications of a system are planned and documented DFD external entity - Answers DFD element usually shown as a rectangle or square that represents a user, organization, system, or service outside the system boundary DFD process - Answers DFD element usually shown as a circle or rounded rectangle that transforms input data into output data Digital enterprise - Answers An organization that has broadly integrated digital technologies into its business operations, products, and services Discoverability - Answers DREAD factor that estimates how easy it is for an attacker or tester to discover the vulnerability or attack path DREAD - Answers Threat rating model based on Damage potential, Reproducibility, Exploitability, Affected Users, and Discoverability Dynamic analysis - Answers Testing performed while the application is running to observe behavior and identify runtime vulnerabilities Elevation of privilege - Answers A threat where a user or attacker gains permissions beyond what they are authorized to have End of life phase - Answers The stage in a software products lifecycle when it is retired from active support, updates, or maintenance Environment hardening - Answers The process of configuring a system or environment to reduce its attack surface by disabling unnecessary servicers, closing unused ports, and applying secure settings Every-sprint requirement - Answers Agile SDL security task repeated during every sprint, such as validation, encoding, or authentication checks Exception handling weakness - Answers Weakness where poor error handling exposes information, causes insecure states, or fails open Exploitability - Answers Dread factor that estimates how easy it is to exploit a threat or vulnerability Exploratory tests - Answers An informal, unscripted testing approach where testers actively explore an application to discover defects and vulnerabilities based on experience and intuition External resources - Answers Personnel, tools, or services sources from outside the organization to support security activities, such as third party consultants or vendors External scans - Answers Security scans performed from outside an organizations network perimeter to identify vulnerabilities visible to an external attacker External vulnerability disclosure response process - Answers Post-release process for receiving, triaging, assigning, resolving, communicating externally reported vulnerabilities XP - Answers Extreme Programming (XP): An Agile method focused on technical excellence through practices such as pair programming, test-driven development, continuous integration, and small releases Fail-safe / fail-closed - Answers If a system fails, it should default to a secure state rather than granting access Final security review - Answers Release-phase gate that evaluates required SDL work, vulnerabilities, risks, and readiness before release Final security review requirement - Answers Agile requirement type for deep release-gate activities completed before production, such as penetration testing, policy compliance analysis, intensive fuzzing, and final review evidence