WGU D487 Secure Software Design Exam-
Objective Assessment Study Guide and Practice
Questions 2027
Pass your Western Governors University objective assessment confidently
with this targeted secure software engineering prep guide. This resource
breaks down critical concepts including secure development lifecycles,
threat modeling, vulnerability mitigation, and software authentication
protocols. Designed for self-paced students, these verified practice
questions and answers ensure you master the exact competencies
required to pass the final exam.
1. An organization wants to measure the maturity of its software
security initiative over time and compare it against industry peers.
Which framework should it use?
A) STRIDE
B) BSIMM
C) CVSS
D) DREAD
Answer: B) BSIMM
Rationale: The Building Security In Maturity Model (BSIMM) is a study of real-
world software security initiatives organized so companies can measure their
initiatives and understand how to evolve them over time .
2. A security team needs to analyze a software application for
vulnerabilities without executing the program. Which technique
should they use?
,A) Dynamic analysis
B) Fuzz testing
C) Static analysis
D) Penetration testing
Answer: C) Static analysis
Rationale: Static analysis is the analysis of computer software that is
performed without executing programs, examining the source code or
binaries for potential flaws .
3. Which International Organization for Standardization (ISO) standard
is considered the benchmark for information security management
today?
A) ISO 9001
B) ISO/IEC 27001
C) ISO 14001
D) ISO/IEC 20000
Answer: B) ISO/IEC 27001
Rationale: ISO/IEC 27001 is the internationally recognized standard for
establishing, implementing, maintaining, and continually improving an
information security management system .
4. A security engineer is executing a program on a virtual processor in
real time to observe its behavior and identify runtime vulnerabilities.
Which type of analysis is being performed?
A) Static analysis
B) Dynamic analysis
,C) Code review
D) Threat modeling
Answer: B) Dynamic analysis
Rationale: Dynamic analysis is the analysis of computer software performed
by executing programs on a real or virtual processor in real time .
5. Which role is specifically responsible for designing, planning, and
implementing secure coding practices and security testing
methodologies within a development team?
A) Software developer
B) Software security architect
C) Scrum master
D) Product owner
Answer: B) Software security architect
Rationale: The software security architect is the person responsible for
designing, planning, and implementing secure coding practices and security
testing methodologies .
6. A company is developing a new feature with well-documented
requirements, a fixed three-to-four-month timeline, and a team
dedicated solely to this feature until release. Which software
development methodology is being used?
A) Agile
B) Scrum
C) Waterfall
D) DevOps
, Answer: C) Waterfall
Rationale: The Waterfall methodology is characterized by sequential phases,
well-documented requirements, and a fixed timeline where team members
focus on one phase until completion .
7. A new application has an administration section for a small number
of users, while normal users should only view limited customer
information and never see admin functionality. Which concept is being
applied?
A) Defense in depth
B) Principle of least privilege
C) Fail-safe defaults
D) Separation of duties
Answer: B) Principle of least privilege
Rationale: The principle of least privilege ensures that users are only granted
the minimum access necessary for their role, preventing normal users from
seeing administrative functions .
8. A Scrum team holds a daily meeting where each member reports
what they accomplished yesterday, what they plan to do today, and
any impediments. Which Scrum ceremony is this?
A) Sprint planning
B) Sprint review
C) Daily Scrum
D) Sprint retrospective
Answer: C) Daily Scrum
Objective Assessment Study Guide and Practice
Questions 2027
Pass your Western Governors University objective assessment confidently
with this targeted secure software engineering prep guide. This resource
breaks down critical concepts including secure development lifecycles,
threat modeling, vulnerability mitigation, and software authentication
protocols. Designed for self-paced students, these verified practice
questions and answers ensure you master the exact competencies
required to pass the final exam.
1. An organization wants to measure the maturity of its software
security initiative over time and compare it against industry peers.
Which framework should it use?
A) STRIDE
B) BSIMM
C) CVSS
D) DREAD
Answer: B) BSIMM
Rationale: The Building Security In Maturity Model (BSIMM) is a study of real-
world software security initiatives organized so companies can measure their
initiatives and understand how to evolve them over time .
2. A security team needs to analyze a software application for
vulnerabilities without executing the program. Which technique
should they use?
,A) Dynamic analysis
B) Fuzz testing
C) Static analysis
D) Penetration testing
Answer: C) Static analysis
Rationale: Static analysis is the analysis of computer software that is
performed without executing programs, examining the source code or
binaries for potential flaws .
3. Which International Organization for Standardization (ISO) standard
is considered the benchmark for information security management
today?
A) ISO 9001
B) ISO/IEC 27001
C) ISO 14001
D) ISO/IEC 20000
Answer: B) ISO/IEC 27001
Rationale: ISO/IEC 27001 is the internationally recognized standard for
establishing, implementing, maintaining, and continually improving an
information security management system .
4. A security engineer is executing a program on a virtual processor in
real time to observe its behavior and identify runtime vulnerabilities.
Which type of analysis is being performed?
A) Static analysis
B) Dynamic analysis
,C) Code review
D) Threat modeling
Answer: B) Dynamic analysis
Rationale: Dynamic analysis is the analysis of computer software performed
by executing programs on a real or virtual processor in real time .
5. Which role is specifically responsible for designing, planning, and
implementing secure coding practices and security testing
methodologies within a development team?
A) Software developer
B) Software security architect
C) Scrum master
D) Product owner
Answer: B) Software security architect
Rationale: The software security architect is the person responsible for
designing, planning, and implementing secure coding practices and security
testing methodologies .
6. A company is developing a new feature with well-documented
requirements, a fixed three-to-four-month timeline, and a team
dedicated solely to this feature until release. Which software
development methodology is being used?
A) Agile
B) Scrum
C) Waterfall
D) DevOps
, Answer: C) Waterfall
Rationale: The Waterfall methodology is characterized by sequential phases,
well-documented requirements, and a fixed timeline where team members
focus on one phase until completion .
7. A new application has an administration section for a small number
of users, while normal users should only view limited customer
information and never see admin functionality. Which concept is being
applied?
A) Defense in depth
B) Principle of least privilege
C) Fail-safe defaults
D) Separation of duties
Answer: B) Principle of least privilege
Rationale: The principle of least privilege ensures that users are only granted
the minimum access necessary for their role, preventing normal users from
seeing administrative functions .
8. A Scrum team holds a daily meeting where each member reports
what they accomplished yesterday, what they plan to do today, and
any impediments. Which Scrum ceremony is this?
A) Sprint planning
B) Sprint review
C) Daily Scrum
D) Sprint retrospective
Answer: C) Daily Scrum
