WGU - D487 LATEST ACTUAL EXAM WITH VERIFIED QUESTIONS &
CORRECT ANSWERS
Question 1.
The _________ re-
port should pro-
vide progress
against priva-
cy requirements
provided in ear-
lier phases.
Any outstand-
ing requirement
should be imple-
mented as soon
as possible. It
is also pru-
dent to as-
sess any changes
in laws/regula-
tions to iden-
tify (and put
on a roadmap)
any new require-
ments. A4 D&D
Correct Answer: Privacy Compliance Report
Question 2.
A findings sum-
mary should be
prepared for
each type of
security testing:
manual code
review, static
analysis, dynam-
ic analysis, pen-
etration testing,
and fuzzing. The
reports should
provide the type
and number of
issues identified
and any consis-
tent theme that
can be derived
,from the find-
ings. A4 D&D
Correct Answer: Security Testing Reports
Question 3.
A ____
report/dash-
board should be
prepared and
updated
regularly from
this stage. The
purpose of this
report is to
showcase the
security posture
and risk of the
product at a
technical level.
A4 D&D
Correct Answer: Remediation Report
Question 4.
Security Assessment What are the key activities in the Security Assessment phase of SDL?
Correct Answer: SDL Phase 1 (A1) = SDLC 1 Concept
Software security team is looped in early Security team hosts a discovery
meeting Software security team discusses project plan States what further work
will be done Privacy Impact Assessment (PIA) plan is created
Question 5.
Architecture What are the key activities in the Architecture phase of SDL?
Correct Answer: SDL Phase 2 (A2) = SDLC 2 Planning
A2 Policy compliance analysis SDL policy assessment and scoping Threat
modeling & architecture security analysis Open-source selection Privacy
information gathering and analysis
Question 6.
Design & Development What are the key activities in the Design & Development phase of
SDL?
Correct Answer: SDL Phase 3 (A3) = SDLC 3 Design & Development
A3 Policy compliance analysis Security test plan composition Static analysis
, updating Threat modeling analysis & re-view Privacy implementation
assessment
Question 7.
Design & Development Cont. What are the key activities in the Design & Development
Cont. phase of SDL?
Correct Answer: SDL Phase 4 (A4) = SDLC 4 Readiness
A4 Policy compliance analysis Security test case execution Static analysis Fuzz
testing Privacy code re-view Privacy validation and remediation
Question 8.
Ship What are the key activities in the Ship phase of SDL?
Correct Answer: SDL Phase 5 (A5) = SDLC 5 Release & Launch
A5 Policy compliance analysis Vulnerability scan Penetration test-ing
Open-source licensing review Final privacy re-view
Question 9.
What is the purpose of the Product risk profile deliverable in Security Assessment (A1)?
Correct Answer: To estimate the actual cost of the product.
Question 10.
What is the goal of the SDL project outline in Security Assessment (A1)?
Correct Answer: To map SDL activities to the development schedule.
Question 11.
Why are Applicable laws and regulations important in Security Assessment (A1)?
Correct Answer: To obtain formal sign-off from stakeholders on applicable laws.
Question 12.
What is the purpose of the Threat profile in Security Assessment (A1)?
Correct Answer: To guide SDL activities to mitigate threats.
Question 13.
What is the goal of the Certification requirements deliverable in Security Assessment (A1)?
Correct Answer: To list requirements for product and operations certifications.
CORRECT ANSWERS
Question 1.
The _________ re-
port should pro-
vide progress
against priva-
cy requirements
provided in ear-
lier phases.
Any outstand-
ing requirement
should be imple-
mented as soon
as possible. It
is also pru-
dent to as-
sess any changes
in laws/regula-
tions to iden-
tify (and put
on a roadmap)
any new require-
ments. A4 D&D
Correct Answer: Privacy Compliance Report
Question 2.
A findings sum-
mary should be
prepared for
each type of
security testing:
manual code
review, static
analysis, dynam-
ic analysis, pen-
etration testing,
and fuzzing. The
reports should
provide the type
and number of
issues identified
and any consis-
tent theme that
can be derived
,from the find-
ings. A4 D&D
Correct Answer: Security Testing Reports
Question 3.
A ____
report/dash-
board should be
prepared and
updated
regularly from
this stage. The
purpose of this
report is to
showcase the
security posture
and risk of the
product at a
technical level.
A4 D&D
Correct Answer: Remediation Report
Question 4.
Security Assessment What are the key activities in the Security Assessment phase of SDL?
Correct Answer: SDL Phase 1 (A1) = SDLC 1 Concept
Software security team is looped in early Security team hosts a discovery
meeting Software security team discusses project plan States what further work
will be done Privacy Impact Assessment (PIA) plan is created
Question 5.
Architecture What are the key activities in the Architecture phase of SDL?
Correct Answer: SDL Phase 2 (A2) = SDLC 2 Planning
A2 Policy compliance analysis SDL policy assessment and scoping Threat
modeling & architecture security analysis Open-source selection Privacy
information gathering and analysis
Question 6.
Design & Development What are the key activities in the Design & Development phase of
SDL?
Correct Answer: SDL Phase 3 (A3) = SDLC 3 Design & Development
A3 Policy compliance analysis Security test plan composition Static analysis
, updating Threat modeling analysis & re-view Privacy implementation
assessment
Question 7.
Design & Development Cont. What are the key activities in the Design & Development
Cont. phase of SDL?
Correct Answer: SDL Phase 4 (A4) = SDLC 4 Readiness
A4 Policy compliance analysis Security test case execution Static analysis Fuzz
testing Privacy code re-view Privacy validation and remediation
Question 8.
Ship What are the key activities in the Ship phase of SDL?
Correct Answer: SDL Phase 5 (A5) = SDLC 5 Release & Launch
A5 Policy compliance analysis Vulnerability scan Penetration test-ing
Open-source licensing review Final privacy re-view
Question 9.
What is the purpose of the Product risk profile deliverable in Security Assessment (A1)?
Correct Answer: To estimate the actual cost of the product.
Question 10.
What is the goal of the SDL project outline in Security Assessment (A1)?
Correct Answer: To map SDL activities to the development schedule.
Question 11.
Why are Applicable laws and regulations important in Security Assessment (A1)?
Correct Answer: To obtain formal sign-off from stakeholders on applicable laws.
Question 12.
What is the purpose of the Threat profile in Security Assessment (A1)?
Correct Answer: To guide SDL activities to mitigate threats.
Question 13.
What is the goal of the Certification requirements deliverable in Security Assessment (A1)?
Correct Answer: To list requirements for product and operations certifications.
