[STUDY GUIDE] • HIGH-YIELD PRACTICE & REVIEW EDITION
WGU D487 Secure Software Design Exam
Questions & Verified Answers Updated
2026/2027 Edition
Comprehensive Examination Question Bank • Concept Mapping
TOTAL QUESTIONS EXAM TOPICS ANSWERS
1279 Questions 12 Modules 100% Verified
DOCUMENT OVERVIEW
This document contains 1279 verified questions with correct answers focused on secure software design and development. It
provides comprehensive coverage of security best practices and methodologies in the software development life cycle, making
it suitable for exam preparation, course review, and professional certification. Students can utilize this resource to enhance their
understanding of secure coding practices and application security principles.
EXAM BLUEPRINT & TOPIC DISTRIBUTION
Systematic breakdown of subject domains and exam coverage.
Topic Module Scope & Core Focus
Secure Software Development Life Cycle An overview of the stages in the software development life cycle with a focus on integrating security
(SDLC) measures.
A study of various threat modeling frameworks and their applications in identifying and mitigating
Threat Modeling Methodologies security risks.
Security Testing Techniques An exploration of different testing methods used to identify vulnerabilities in software applications.
Best Practices for Secure Coding Guidelines and techniques for writing code that minimizes security risks and vulnerabilities.
An examination of how Agile practices can incorporate security considerations throughout the
Agile Methodologies and Security development process.
Risk Management in Software Security An analysis of frameworks and strategies for managing security risks in software projects.
Compliance and Regulatory Requirements Understanding the legal and regulatory obligations that impact software security practices.
The role of organizational policies in establishing security standards and practices in software
Security Policies and Governance development.
Confidential • Student Study Edition • Practice & Review Guide Page 1 of 431
,STUDENT STUDY & MASTERY EDITION PRACTICE & REVIEW GUIDE
Incident Response and Vulnerability
Management Best practices for managing security incidents and vulnerabilities in software systems.
Static and Dynamic Analysis A comparison of static and dynamic analysis techniques for identifying security flaws in software.
An introduction to key performance indicators and metrics used to assess software security
Security Metrics and Measurement effectiveness.
Third-Party Software Security Strategies for evaluating and managing security risks associated with third-party software components.
Total Exam Coverage 12 Integrated Topic Modules • 1279 Examination Questions
HIGH-YIELD: QUESTIONS & VERIFIED ANSWERS
Complete Examination Questions • 1279 Questions • Sequential Exam Layout
QUESTION 1
What is the study of real-world software security initiatives organized so companies can measure
their initiatives and understand how to evolve them over time?
A) Building Security in Maturity Model (BSIMM)
B) Security features and design
C) OWASP Software Assurance Maturity Model (SAMM)
D) ISO 27001
Answer: A) Building Security in Maturity Model (BSIMM)
QUESTION 2
What is the analysis of computer software that is performed without executing programs?
A) Static analysis
B) Fuzzing
C) Dynamic analysis
D) OWASP ZAP
Answer: A) Static analysis.
Confidential • Student Study Edition • Practice & Review Guide Page 2 of 431
,STUDENT STUDY & MASTERY EDITION PRACTICE & REVIEW GUIDE
QUESTION 3
What iso standard is the benchmark for information security today?
A) iso/iec 27001
B) iso/iec 7799
C) iso/iec 27034
D) iso 8601
Answer: A) iso 27001.
QUESTION 4
What is the analysis of computer software that is performed by executing programs on a real or
virtual processor in real time?
A) dynamic analysis
B) static analysis
C) fuzzing
D) security testing
Answer: A) dynamic analysis.
QUESTION 5
Which person is responsible for designing, planning, and implementing secure coding practices
and security testing methodologies?
A) software security architect
B) product security developer
C) software security champion
D) software tester
Answer: A) software security architect.
Confidential • Student Study Edition • Practice & Review Guide Page 3 of 431
, STUDENT STUDY & MASTERY EDITION PRACTICE & REVIEW GUIDE
QUESTION 6
A company is preparing to add a new feature to its flagship software product. The new feature is
similar to features that have been added in previous years, and the requirements are
well-documented. The project is expected to last three to four months, at which time the new
feature will be released to customers. Project team members will focus solely on the new feature
until the project ends.
Which software development methodology is being used?
A) Waterfall
B) Agile
C) Scrum
D) Extreme programming
Answer: A) Waterfall.
QUESTION 7
A new product will require an administration section for a small number of users. Normal users
will be able to view limited customer information and should not see admin functionality within
the application.
Which concept is being used?
A) Principle of least privilege
B) Privacy
C) Software security champion
D) Elevation of privilege
Answer: A) Principle of least privilege.
Confidential • Student Study Edition • Practice & Review Guide Page 4 of 431
WGU D487 Secure Software Design Exam
Questions & Verified Answers Updated
2026/2027 Edition
Comprehensive Examination Question Bank • Concept Mapping
TOTAL QUESTIONS EXAM TOPICS ANSWERS
1279 Questions 12 Modules 100% Verified
DOCUMENT OVERVIEW
This document contains 1279 verified questions with correct answers focused on secure software design and development. It
provides comprehensive coverage of security best practices and methodologies in the software development life cycle, making
it suitable for exam preparation, course review, and professional certification. Students can utilize this resource to enhance their
understanding of secure coding practices and application security principles.
EXAM BLUEPRINT & TOPIC DISTRIBUTION
Systematic breakdown of subject domains and exam coverage.
Topic Module Scope & Core Focus
Secure Software Development Life Cycle An overview of the stages in the software development life cycle with a focus on integrating security
(SDLC) measures.
A study of various threat modeling frameworks and their applications in identifying and mitigating
Threat Modeling Methodologies security risks.
Security Testing Techniques An exploration of different testing methods used to identify vulnerabilities in software applications.
Best Practices for Secure Coding Guidelines and techniques for writing code that minimizes security risks and vulnerabilities.
An examination of how Agile practices can incorporate security considerations throughout the
Agile Methodologies and Security development process.
Risk Management in Software Security An analysis of frameworks and strategies for managing security risks in software projects.
Compliance and Regulatory Requirements Understanding the legal and regulatory obligations that impact software security practices.
The role of organizational policies in establishing security standards and practices in software
Security Policies and Governance development.
Confidential • Student Study Edition • Practice & Review Guide Page 1 of 431
,STUDENT STUDY & MASTERY EDITION PRACTICE & REVIEW GUIDE
Incident Response and Vulnerability
Management Best practices for managing security incidents and vulnerabilities in software systems.
Static and Dynamic Analysis A comparison of static and dynamic analysis techniques for identifying security flaws in software.
An introduction to key performance indicators and metrics used to assess software security
Security Metrics and Measurement effectiveness.
Third-Party Software Security Strategies for evaluating and managing security risks associated with third-party software components.
Total Exam Coverage 12 Integrated Topic Modules • 1279 Examination Questions
HIGH-YIELD: QUESTIONS & VERIFIED ANSWERS
Complete Examination Questions • 1279 Questions • Sequential Exam Layout
QUESTION 1
What is the study of real-world software security initiatives organized so companies can measure
their initiatives and understand how to evolve them over time?
A) Building Security in Maturity Model (BSIMM)
B) Security features and design
C) OWASP Software Assurance Maturity Model (SAMM)
D) ISO 27001
Answer: A) Building Security in Maturity Model (BSIMM)
QUESTION 2
What is the analysis of computer software that is performed without executing programs?
A) Static analysis
B) Fuzzing
C) Dynamic analysis
D) OWASP ZAP
Answer: A) Static analysis.
Confidential • Student Study Edition • Practice & Review Guide Page 2 of 431
,STUDENT STUDY & MASTERY EDITION PRACTICE & REVIEW GUIDE
QUESTION 3
What iso standard is the benchmark for information security today?
A) iso/iec 27001
B) iso/iec 7799
C) iso/iec 27034
D) iso 8601
Answer: A) iso 27001.
QUESTION 4
What is the analysis of computer software that is performed by executing programs on a real or
virtual processor in real time?
A) dynamic analysis
B) static analysis
C) fuzzing
D) security testing
Answer: A) dynamic analysis.
QUESTION 5
Which person is responsible for designing, planning, and implementing secure coding practices
and security testing methodologies?
A) software security architect
B) product security developer
C) software security champion
D) software tester
Answer: A) software security architect.
Confidential • Student Study Edition • Practice & Review Guide Page 3 of 431
, STUDENT STUDY & MASTERY EDITION PRACTICE & REVIEW GUIDE
QUESTION 6
A company is preparing to add a new feature to its flagship software product. The new feature is
similar to features that have been added in previous years, and the requirements are
well-documented. The project is expected to last three to four months, at which time the new
feature will be released to customers. Project team members will focus solely on the new feature
until the project ends.
Which software development methodology is being used?
A) Waterfall
B) Agile
C) Scrum
D) Extreme programming
Answer: A) Waterfall.
QUESTION 7
A new product will require an administration section for a small number of users. Normal users
will be able to view limited customer information and should not see admin functionality within
the application.
Which concept is being used?
A) Principle of least privilege
B) Privacy
C) Software security champion
D) Elevation of privilege
Answer: A) Principle of least privilege.
Confidential • Student Study Edition • Practice & Review Guide Page 4 of 431
