WGU MASTER'S COURSE C706 - SECURE SOFTWARE
DESIGN EXAM LATEST 2025 ACTUAL EXAM 400 QUESTIONS
AND CORRECT DETAILED ANSWERS WITH RATIONALES
(VERIFIED ANSWERS) |ALREADY GRADED A+
What is a step for constructing a threat model for a project when using practical risk analysis?
A Align your business goals
B Apply engineering methods
C Estimate probability of project time
D Make a list of what you are trying to protect - ANSWER-D
Which cyber threats are typically surgical by nature, have highly specific targeting, and are
technologically sophisticated?
A Tactical attacks
B Criminal attacks
C Strategic attacks
D User-specific attacks - ANSWER-A
Which type of cyberattacks are often intended to elevate awareness of a topic?
A Cyberwarfare
B Tactical attacks
C User-specific attacks
D Sociopolitical attacks - ANSWER-D
What type of attack locks a user's desktop and then requires a payment to unlock it?
A Phishing
, WGU MASTER'S COURSE C706 - SECURE SOFTWARE
DESIGN EXAM LATEST 2025 ACTUAL EXAM 400 QUESTIONS
AND CORRECT DETAILED ANSWERS WITH RATIONALES
(VERIFIED ANSWERS) |ALREADY GRADED A+
B Keylogger
C Ransomware
D Denial-of-service - ANSWER-C
What is a countermeasure against various forms of XML and XML path injection attacks?
A XML name wrapping
B XML unicode encoding
C XML attribute escaping
D XML distinguished name escaping - ANSWER-C
Which countermeasure is used to mitigate SQL injection attacks?
A SQL Firewall
B Projected bijection
C Query parameterization
D Progressive ColdFusion - ANSWER-C
What is an appropriate countermeasure to an escalation of privilege attack?
A Enforcing strong password policies
B Using standard encryption algorithms and correct key sizes
C Enabling the auditing and logging of all administration activities
D Restricting access to specific operations through role-based access controls - ANSWER-D
, WGU MASTER'S COURSE C706 - SECURE SOFTWARE
DESIGN EXAM LATEST 2025 ACTUAL EXAM 400 QUESTIONS
AND CORRECT DETAILED ANSWERS WITH RATIONALES
(VERIFIED ANSWERS) |ALREADY GRADED A+
Which configuration management security countermeasure implements least privilege access control?
A Following strong password policies to restrict access
B Restricting file access to users based on authorization
C Avoiding clear text format for credentials and sensitive data
D Using AES 256 encryption for communications of a sensitive nature - ANSWER-B
Which sphase sof sthe ssoftware sdevelopment slife scycle s(SDL/SDLC) swould sbe sused sto sdetermine
sthe sminimum sset sof sprivileges srequired sto sperform sthe stargeted stask sand srestrict sthe suser sto
sa sdomain swith sthose sprivileges?
A sDesign
B sDeploy
C sDevelopment
D sImplementation s- sANSWER-A
Which sleast sprivilege smethod sis smore sgranular sin sscope sand sgrants sspecific sprocesses sonly sthe
sprivileges snecessary sto sperform scertain srequired sfunctions, sinstead sof sgranting sthem
sunrestricted saccess sto sthe ssystem?
A sEntitlement sprivilege
B sSeparation sof sprivilege
C sAggregation sof sprivileges
D sSegregation sof sresponsibilities s- sANSWER-B
Why sdoes sprivilege screep spose sa spotential ssecurity srisk?
, WGU sMASTER'S sCOURSE sC706 s- sSECURE sSOFTWARE
sDESIGN sEXAM sLATEST s2025 sACTUAL sEXAM s400 sQUESTIONS
sAND sCORRECT sDETAILED sANSWERS sWITH sRATIONALES
s(VERIFIED sANSWERS) s|ALREADY sGRADED sA+
A sUser sprivileges sdo snot smatch stheir sjob srole.
B sWith smore sprivileges, sthere sare smore sresponsibilities.
C sAuditing swill sshow sa smismatch sbetween sindividual sresponsibilities sand stheir saccess srights.
D sUsers shave smore sprivileges sthan sthey sneed sand smay sperform sactions soutside stheir sjob
sdescription. s- sANSWER-D
A ssystem sdeveloper sis simplementing sa snew ssales ssystem. sThe ssystem sdeveloper sis sconcerned sthat
sunauthorized sindividuals smay sbe sable sto sview ssensitive scustomer sfinancial sdata.
Which sfamily sof snonfunctional srequirements sshould sbe sconsidered sas spart sof sthe sacceptance scriteria?
A sIntegrity
B sAvailability
C sNonrepudition
D sConfidentiality s- sANSWER-D
A sproject smanager sis sgiven sthe stask sto scome sup swith snonfunctional sacceptance scriteria
srequirements sfor sbusiness sowners sas spart sof sa sproject sdelivery.
Which snonfunctional srequirement sshould sbe sapplied sto sthe sacceptance scriteria?
A sGive ssearch soptions sto susers
B sEvaluate stest sexecution sresults
C sDivide susers sinto sgroups sand sgive sthem sseparate srights
D sDevelop ssoftware sthat skeeps sdownward scompatibility sintact s- sANSWER-B
DESIGN EXAM LATEST 2025 ACTUAL EXAM 400 QUESTIONS
AND CORRECT DETAILED ANSWERS WITH RATIONALES
(VERIFIED ANSWERS) |ALREADY GRADED A+
What is a step for constructing a threat model for a project when using practical risk analysis?
A Align your business goals
B Apply engineering methods
C Estimate probability of project time
D Make a list of what you are trying to protect - ANSWER-D
Which cyber threats are typically surgical by nature, have highly specific targeting, and are
technologically sophisticated?
A Tactical attacks
B Criminal attacks
C Strategic attacks
D User-specific attacks - ANSWER-A
Which type of cyberattacks are often intended to elevate awareness of a topic?
A Cyberwarfare
B Tactical attacks
C User-specific attacks
D Sociopolitical attacks - ANSWER-D
What type of attack locks a user's desktop and then requires a payment to unlock it?
A Phishing
, WGU MASTER'S COURSE C706 - SECURE SOFTWARE
DESIGN EXAM LATEST 2025 ACTUAL EXAM 400 QUESTIONS
AND CORRECT DETAILED ANSWERS WITH RATIONALES
(VERIFIED ANSWERS) |ALREADY GRADED A+
B Keylogger
C Ransomware
D Denial-of-service - ANSWER-C
What is a countermeasure against various forms of XML and XML path injection attacks?
A XML name wrapping
B XML unicode encoding
C XML attribute escaping
D XML distinguished name escaping - ANSWER-C
Which countermeasure is used to mitigate SQL injection attacks?
A SQL Firewall
B Projected bijection
C Query parameterization
D Progressive ColdFusion - ANSWER-C
What is an appropriate countermeasure to an escalation of privilege attack?
A Enforcing strong password policies
B Using standard encryption algorithms and correct key sizes
C Enabling the auditing and logging of all administration activities
D Restricting access to specific operations through role-based access controls - ANSWER-D
, WGU MASTER'S COURSE C706 - SECURE SOFTWARE
DESIGN EXAM LATEST 2025 ACTUAL EXAM 400 QUESTIONS
AND CORRECT DETAILED ANSWERS WITH RATIONALES
(VERIFIED ANSWERS) |ALREADY GRADED A+
Which configuration management security countermeasure implements least privilege access control?
A Following strong password policies to restrict access
B Restricting file access to users based on authorization
C Avoiding clear text format for credentials and sensitive data
D Using AES 256 encryption for communications of a sensitive nature - ANSWER-B
Which sphase sof sthe ssoftware sdevelopment slife scycle s(SDL/SDLC) swould sbe sused sto sdetermine
sthe sminimum sset sof sprivileges srequired sto sperform sthe stargeted stask sand srestrict sthe suser sto
sa sdomain swith sthose sprivileges?
A sDesign
B sDeploy
C sDevelopment
D sImplementation s- sANSWER-A
Which sleast sprivilege smethod sis smore sgranular sin sscope sand sgrants sspecific sprocesses sonly sthe
sprivileges snecessary sto sperform scertain srequired sfunctions, sinstead sof sgranting sthem
sunrestricted saccess sto sthe ssystem?
A sEntitlement sprivilege
B sSeparation sof sprivilege
C sAggregation sof sprivileges
D sSegregation sof sresponsibilities s- sANSWER-B
Why sdoes sprivilege screep spose sa spotential ssecurity srisk?
, WGU sMASTER'S sCOURSE sC706 s- sSECURE sSOFTWARE
sDESIGN sEXAM sLATEST s2025 sACTUAL sEXAM s400 sQUESTIONS
sAND sCORRECT sDETAILED sANSWERS sWITH sRATIONALES
s(VERIFIED sANSWERS) s|ALREADY sGRADED sA+
A sUser sprivileges sdo snot smatch stheir sjob srole.
B sWith smore sprivileges, sthere sare smore sresponsibilities.
C sAuditing swill sshow sa smismatch sbetween sindividual sresponsibilities sand stheir saccess srights.
D sUsers shave smore sprivileges sthan sthey sneed sand smay sperform sactions soutside stheir sjob
sdescription. s- sANSWER-D
A ssystem sdeveloper sis simplementing sa snew ssales ssystem. sThe ssystem sdeveloper sis sconcerned sthat
sunauthorized sindividuals smay sbe sable sto sview ssensitive scustomer sfinancial sdata.
Which sfamily sof snonfunctional srequirements sshould sbe sconsidered sas spart sof sthe sacceptance scriteria?
A sIntegrity
B sAvailability
C sNonrepudition
D sConfidentiality s- sANSWER-D
A sproject smanager sis sgiven sthe stask sto scome sup swith snonfunctional sacceptance scriteria
srequirements sfor sbusiness sowners sas spart sof sa sproject sdelivery.
Which snonfunctional srequirement sshould sbe sapplied sto sthe sacceptance scriteria?
A sGive ssearch soptions sto susers
B sEvaluate stest sexecution sresults
C sDivide susers sinto sgroups sand sgive sthem sseparate srights
D sDevelop ssoftware sthat skeeps sdownward scompatibility sintact s- sANSWER-B
