WGU D487 Secure Software Design Objective
Assessment (OA) Exam Review | Comprehensive
Practice Exam with Verified Questions, Correct
Answers and Detailed Rationales | Latest Update
2026/2027 - Graded A+
Question 1
Which post-release support key success factor says that any change or
component reuse should trigger security development life cycle activities?
A. User feedback collection for product enhancements
B. Annual performance reviews for development teams
C. Regular updates for user interface improvements
D. SDL cycle for any architectural changes or code reuses
Answer: D
Rationale: The post-release support key success factor states that any
change or component reuse should trigger the Security Development
Lifecycle (SDL) cycle. This ensures that security is maintained throughout
the product lifecycle, even when modifications are made after release.
Question 2
What is the product risk profile?
A. A marketing analysis deliverable that projects future sales of the product
B. A financial report that tracks the development budget of the product
C. A security assessment deliverable that estimates the actual cost of the
product
D. A project management document that outlines the product timeline
Answer: C
Rationale: The product risk profile is a security assessment deliverable
that estimates the actual cost of the product from different perspectives,
helping organizations understand the security risks associated with the
product.
pg. 1
,Question 3
What are scans to identify security issues that a malicious attacker could
exploit from inside the network?
A. External scans
B. Passive scanner
C. Credentialed application vulnerability scans
D. Internal scans
Answer: D
Rationale: Internal scans are conducted from inside the network to
identify security issues that a malicious attacker could exploit from within
the organization's internal network. These scans help identify
vulnerabilities that may not be visible from outside the network.
Question 4
What are the advantages of conducting static code analysis?
A. Improved user interface design
B. Increased performance during runtime execution
C. The ability to modify code in real-time
D. Access to the actual instructions the software will be executing
Answer: D
Rationale: Static code analysis provides access to the actual instructions
the software will be executing, allowing for thorough security analysis
without needing to run the code. It can identify vulnerabilities such as
buffer overflows, injection flaws, and other security issues.
Question 5
What is phase five of the SDL?
A. D4 Maintenance
B. B1 Design
C. C3 Testing
D. A5 Ship
Answer: D
Rationale: Phase five of the Security Development Lifecycle (SDL) is A5
Ship, which involves preparing the product for release, including final
security reviews, policy compliance analysis, and release activities.
pg. 2
,Question 6
What is the reason software security teams host discovery meetings with
stakeholders early in the development life cycle?
A. To finalize the product features before development begins
B. To allocate budget resources for the project
C. To gather user feedback on the initial design concepts
D. To ensure that security is built into the product from the start
Answer: D
Rationale: Security teams host discovery meetings early in the
development life cycle to ensure that security is built into the product from
the start. This proactive approach integrates security considerations into
the initial design and planning phases.
Question 7
Within OpenSAMM, what focuses on the processes and activities related to
creating software within development projects within OpenSAMM practice
areas?
A. Integration
B. Maintenance
C. Governance
D. Construction
Answer: D
Rationale: Within OpenSAMM, Construction focuses on the processes
and activities related to creating software within development projects. This
includes secure coding practices, code review, and other development-
related security activities.
Question 8
During what phase of SDL is an initial project outline for security
milestones developed and integrated into the development project
schedule?
A. B2 Design Review
B. D4 User Acceptance Testing
C. A1 Security Assessment
pg. 3
, D. C3 Quality Assurance
Answer: C
Rationale: During the A1 Security Assessment phase, an initial project
outline for security milestones is developed and integrated into the
development project schedule. This ensures security activities are planned
and resourced throughout the project.
Question 9
What is a non-system-related component in software security testing attack
surface validation?
A. Administrators
B. Hardware
C. Regulators
D. Users
Answer: C
Rationale: Regulators are a non-system-related component in software
security testing attack surface validation. While administrators (A),
hardware (B), and users (D) are system-related components, regulators are
external entities that impose compliance requirements.
Question 10
What is reusable software developed externally from the organization's
platforms?
A. Third-party codes
B. Functional requirements
C. Two parallel horizontal lines
D. Software security policy
Answer: A
Rationale: Third-party code is reusable software developed externally
from the organization's platforms. This can include open-source libraries,
commercial components, and other externally developed software that is
integrated into the product.
Question 11
What does PASTA stand for?
pg. 4
Assessment (OA) Exam Review | Comprehensive
Practice Exam with Verified Questions, Correct
Answers and Detailed Rationales | Latest Update
2026/2027 - Graded A+
Question 1
Which post-release support key success factor says that any change or
component reuse should trigger security development life cycle activities?
A. User feedback collection for product enhancements
B. Annual performance reviews for development teams
C. Regular updates for user interface improvements
D. SDL cycle for any architectural changes or code reuses
Answer: D
Rationale: The post-release support key success factor states that any
change or component reuse should trigger the Security Development
Lifecycle (SDL) cycle. This ensures that security is maintained throughout
the product lifecycle, even when modifications are made after release.
Question 2
What is the product risk profile?
A. A marketing analysis deliverable that projects future sales of the product
B. A financial report that tracks the development budget of the product
C. A security assessment deliverable that estimates the actual cost of the
product
D. A project management document that outlines the product timeline
Answer: C
Rationale: The product risk profile is a security assessment deliverable
that estimates the actual cost of the product from different perspectives,
helping organizations understand the security risks associated with the
product.
pg. 1
,Question 3
What are scans to identify security issues that a malicious attacker could
exploit from inside the network?
A. External scans
B. Passive scanner
C. Credentialed application vulnerability scans
D. Internal scans
Answer: D
Rationale: Internal scans are conducted from inside the network to
identify security issues that a malicious attacker could exploit from within
the organization's internal network. These scans help identify
vulnerabilities that may not be visible from outside the network.
Question 4
What are the advantages of conducting static code analysis?
A. Improved user interface design
B. Increased performance during runtime execution
C. The ability to modify code in real-time
D. Access to the actual instructions the software will be executing
Answer: D
Rationale: Static code analysis provides access to the actual instructions
the software will be executing, allowing for thorough security analysis
without needing to run the code. It can identify vulnerabilities such as
buffer overflows, injection flaws, and other security issues.
Question 5
What is phase five of the SDL?
A. D4 Maintenance
B. B1 Design
C. C3 Testing
D. A5 Ship
Answer: D
Rationale: Phase five of the Security Development Lifecycle (SDL) is A5
Ship, which involves preparing the product for release, including final
security reviews, policy compliance analysis, and release activities.
pg. 2
,Question 6
What is the reason software security teams host discovery meetings with
stakeholders early in the development life cycle?
A. To finalize the product features before development begins
B. To allocate budget resources for the project
C. To gather user feedback on the initial design concepts
D. To ensure that security is built into the product from the start
Answer: D
Rationale: Security teams host discovery meetings early in the
development life cycle to ensure that security is built into the product from
the start. This proactive approach integrates security considerations into
the initial design and planning phases.
Question 7
Within OpenSAMM, what focuses on the processes and activities related to
creating software within development projects within OpenSAMM practice
areas?
A. Integration
B. Maintenance
C. Governance
D. Construction
Answer: D
Rationale: Within OpenSAMM, Construction focuses on the processes
and activities related to creating software within development projects. This
includes secure coding practices, code review, and other development-
related security activities.
Question 8
During what phase of SDL is an initial project outline for security
milestones developed and integrated into the development project
schedule?
A. B2 Design Review
B. D4 User Acceptance Testing
C. A1 Security Assessment
pg. 3
, D. C3 Quality Assurance
Answer: C
Rationale: During the A1 Security Assessment phase, an initial project
outline for security milestones is developed and integrated into the
development project schedule. This ensures security activities are planned
and resourced throughout the project.
Question 9
What is a non-system-related component in software security testing attack
surface validation?
A. Administrators
B. Hardware
C. Regulators
D. Users
Answer: C
Rationale: Regulators are a non-system-related component in software
security testing attack surface validation. While administrators (A),
hardware (B), and users (D) are system-related components, regulators are
external entities that impose compliance requirements.
Question 10
What is reusable software developed externally from the organization's
platforms?
A. Third-party codes
B. Functional requirements
C. Two parallel horizontal lines
D. Software security policy
Answer: A
Rationale: Third-party code is reusable software developed externally
from the organization's platforms. This can include open-source libraries,
commercial components, and other externally developed software that is
integrated into the product.
Question 11
What does PASTA stand for?
pg. 4
