WGU MASTER'S COURSE C706 - SECURE SOFTWARE
DESIGN EXAM LATEST 2024 ACTUAL EXAM 400
QUESTIONS
AND CORRECT DETAILED ANSWERS WITH RATIONALES
(VERIFIED ANSWERS) |ALREADY GRADED A+
What is the National Vulnerability Database?
The NVD takes CVEs as input and builds upon the information included in the CVE entries to provide
enhanced information for each CVE Identifier, such as fix information, severity scores, and impact
ratings. NVD also provides advanced searching features such as by individual CVE-ID; by OS; by vendor
name, product name, and/or version number; and by vulnerability type, severity, related exploit
range, and impact.
What are the key factors in security Assessment regarding secure software?
a. Accuracy of planned Security Development Life Cycle (SDL) activities
i. All SDL activities are accurately identified
b. Product risk profile
i. Management understands the true cost of developing the product
c. Accuracy of threat profile
i. Mitigating steps and countermeasures are in place for the product to be successful in its
environment.
d. Coverage of relevant regulations, certifications, and compliance frameworks
i. All applicable legal and compliance aspects are covered.
, WGU MASTER'S COURSE C706 - SECURE SOFTWARE
DESIGN EXAM LATEST 2024 ACTUAL EXAM 400
QUESTIONS
AND CORRECT DETAILED ANSWERS WITH RATIONALES
(VERIFIED ANSWERS) |ALREADY GRADED A+
e. Coverage of security objectives needed for software
“Must have” security objectives are met.
Why are data flow documents (DFD) an important analytical tool?
DFDs allow you to visualize the data flow through software, decompose the software architecture,
and focus on specific processes involved in processing specific data.
Explain the Generic Risk Model.
The General Risk Model is a more subjective model that uses the formula "Risk = Likelihood x Impact"
to represent a threat mathematically.
i. With the General Risk Model, likelihood is defined by the ease of exploitation and the
possibility of realizing a threat.
ii. Impact is defined by the damage potential and the extent of the impact
Explain the TRIKE Model.
TRIKE is a unique, open-source threat modeling process focused on satisfying the security auditing
process from a cyber risk management perspective. The foundation of the Trike threat modeling
methodology is a "requirements model." The requirements model ensures the assigned level of risk
for each asset is "acceptable" to the various stakeholders.
, WGU MASTER'S COURSE C706 - SECURE SOFTWARE
DESIGN EXAM LATEST 2024 ACTUAL EXAM 400
QUESTIONS
AND CORRECT DETAILED ANSWERS WITH RATIONALES
(VERIFIED ANSWERS) |ALREADY GRADED A+
How do you mitigate STRIDE spoofing and what security principle does it affect?
Authentication. Implement secure user authentication methods, including both secure password
requirements and multi-factor authentication (MFA).
How do you mitigate STRIDE Tampering and what security principle does it affect?
Integrity. The application should be designed to validate user inputs, and encode outputs. Static code
analysis should be used to identify vulnerabilities to tampering in the application both during the
development stage and once the application is in production.
How do you mitigate STRIDE Repudiation and what security principle does it affect?
Non-Repudiation. incorporating digital signatures in the application that provide proof of actions, or
ensuring that full, tamper-proof logs are in place.
How do you mitigate STRIDE Info Disclosure and what security principle does it affect?
Confidentiality. Error messages, response headers, and background information should be as generic
as possible to avoid revealing clues about the application's behavior.
Proper access controls and authorizations should be in place to prevent unauthorized access to
information. The application itself should be checked over from a user perspective to validate that
developer comments and other information are not revealed in the production environment.
How do you mitigate STRIDE Denial of Service and what security principle does it affect?
Availability. Configuring firewalls to block traffic from certain sources such as reserved, loopback, or
private IP addresses, or unassigned DCHPDHCP clients, or introducing rate limiting to manage traffic
, WGU MASTER'S COURSE C706 - SECURE SOFTWARE
DESIGN EXAM LATEST 2024 ACTUAL EXAM 400
QUESTIONS
AND CORRECT DETAILED ANSWERS WITH RATIONALES
(VERIFIED ANSWERS) |ALREADY GRADED A+
How do you mitigate STRIDE Elevation of Privilege and what security principle does it affect?
Authorization. includes managing the identity lifecycle, enforcing the principle of least privilege for all
users, hardening systems and applications through configuration changes, removing unnecessary
rights and access, closing ports
What are some common defects software testing should look for?
a. XSS
b. SQL Injection
c. Errors with applications
d. Patch errors
e. Buffer overflow
f. Memory leaks
g. Assertion failures
h. Error handling
What types of tools are these?
a. AppScan by IBM
b. GFI Languard by GFI
c. Hailstorm by Cenzic
d. McAfee Vulnerability Manager (MVM) by McAfee
e. Nessus by Tenable Network Security
DESIGN EXAM LATEST 2024 ACTUAL EXAM 400
QUESTIONS
AND CORRECT DETAILED ANSWERS WITH RATIONALES
(VERIFIED ANSWERS) |ALREADY GRADED A+
What is the National Vulnerability Database?
The NVD takes CVEs as input and builds upon the information included in the CVE entries to provide
enhanced information for each CVE Identifier, such as fix information, severity scores, and impact
ratings. NVD also provides advanced searching features such as by individual CVE-ID; by OS; by vendor
name, product name, and/or version number; and by vulnerability type, severity, related exploit
range, and impact.
What are the key factors in security Assessment regarding secure software?
a. Accuracy of planned Security Development Life Cycle (SDL) activities
i. All SDL activities are accurately identified
b. Product risk profile
i. Management understands the true cost of developing the product
c. Accuracy of threat profile
i. Mitigating steps and countermeasures are in place for the product to be successful in its
environment.
d. Coverage of relevant regulations, certifications, and compliance frameworks
i. All applicable legal and compliance aspects are covered.
, WGU MASTER'S COURSE C706 - SECURE SOFTWARE
DESIGN EXAM LATEST 2024 ACTUAL EXAM 400
QUESTIONS
AND CORRECT DETAILED ANSWERS WITH RATIONALES
(VERIFIED ANSWERS) |ALREADY GRADED A+
e. Coverage of security objectives needed for software
“Must have” security objectives are met.
Why are data flow documents (DFD) an important analytical tool?
DFDs allow you to visualize the data flow through software, decompose the software architecture,
and focus on specific processes involved in processing specific data.
Explain the Generic Risk Model.
The General Risk Model is a more subjective model that uses the formula "Risk = Likelihood x Impact"
to represent a threat mathematically.
i. With the General Risk Model, likelihood is defined by the ease of exploitation and the
possibility of realizing a threat.
ii. Impact is defined by the damage potential and the extent of the impact
Explain the TRIKE Model.
TRIKE is a unique, open-source threat modeling process focused on satisfying the security auditing
process from a cyber risk management perspective. The foundation of the Trike threat modeling
methodology is a "requirements model." The requirements model ensures the assigned level of risk
for each asset is "acceptable" to the various stakeholders.
, WGU MASTER'S COURSE C706 - SECURE SOFTWARE
DESIGN EXAM LATEST 2024 ACTUAL EXAM 400
QUESTIONS
AND CORRECT DETAILED ANSWERS WITH RATIONALES
(VERIFIED ANSWERS) |ALREADY GRADED A+
How do you mitigate STRIDE spoofing and what security principle does it affect?
Authentication. Implement secure user authentication methods, including both secure password
requirements and multi-factor authentication (MFA).
How do you mitigate STRIDE Tampering and what security principle does it affect?
Integrity. The application should be designed to validate user inputs, and encode outputs. Static code
analysis should be used to identify vulnerabilities to tampering in the application both during the
development stage and once the application is in production.
How do you mitigate STRIDE Repudiation and what security principle does it affect?
Non-Repudiation. incorporating digital signatures in the application that provide proof of actions, or
ensuring that full, tamper-proof logs are in place.
How do you mitigate STRIDE Info Disclosure and what security principle does it affect?
Confidentiality. Error messages, response headers, and background information should be as generic
as possible to avoid revealing clues about the application's behavior.
Proper access controls and authorizations should be in place to prevent unauthorized access to
information. The application itself should be checked over from a user perspective to validate that
developer comments and other information are not revealed in the production environment.
How do you mitigate STRIDE Denial of Service and what security principle does it affect?
Availability. Configuring firewalls to block traffic from certain sources such as reserved, loopback, or
private IP addresses, or unassigned DCHPDHCP clients, or introducing rate limiting to manage traffic
, WGU MASTER'S COURSE C706 - SECURE SOFTWARE
DESIGN EXAM LATEST 2024 ACTUAL EXAM 400
QUESTIONS
AND CORRECT DETAILED ANSWERS WITH RATIONALES
(VERIFIED ANSWERS) |ALREADY GRADED A+
How do you mitigate STRIDE Elevation of Privilege and what security principle does it affect?
Authorization. includes managing the identity lifecycle, enforcing the principle of least privilege for all
users, hardening systems and applications through configuration changes, removing unnecessary
rights and access, closing ports
What are some common defects software testing should look for?
a. XSS
b. SQL Injection
c. Errors with applications
d. Patch errors
e. Buffer overflow
f. Memory leaks
g. Assertion failures
h. Error handling
What types of tools are these?
a. AppScan by IBM
b. GFI Languard by GFI
c. Hailstorm by Cenzic
d. McAfee Vulnerability Manager (MVM) by McAfee
e. Nessus by Tenable Network Security
