WGU D487 SECURE SOFTWARE
DESIGN OBJECTIVE
ASSESSMENT (OA) EXAM BANK
LATEST MOCK PRACTICE SET
180 Questions with Answers and Detailed Rationales
100 PERCENT GUARANTEED PASS
INSTANT DOWNLOAD ANSWERS INCLUDED
IMPORTANCE OF THIS DOCUMENT
This comprehensive examination preparation guide has been meticulously developed to help you succeed in the
WGU D487 SECURE SOFTWARE DESIGN OBJECTIVE ASSESSMENT (OA) EXAM BANK VERIFIED
QUESTIONS WITH EXPERT RATIONALES LATEST 2026 UPDATE | ACCURATE & VERIFIED. It contains 180
carefully selected questions that reflect the most current exam content and testing strategies. Each question is
accompanied by a correct answer and a detailed rationale that explains the underlying pathophysiology,
pharmacology, or clinical reasoning.
Self-Assessment – Test your knowledge and Exam Preparation – Familiarize yourself with the
identify areas requiring further question format and content
study areas
Concept Reinforcement – Deepen your Confidence Building – Develop test-taking
understanding through strategies and reduce
evidence-based exam anxiety
rationales
Time Management – Practice answering
questions under simulated
exam conditions
Review Summary 180 Questions
Foundations - Application - WGU D487 Secure Software Design Objective Assessment OA BANK WITH
Expert Rationales 2026 Update Accurate & Secure Software Design Graduate
All answers with rationales
,Table of Contents
Content Area Questions Key Topics
Security 1-45 Application, Developer, Threat, Design, Review
Application 46-90 Security, Developer, Threat, Secure, Approach
Developer 91-135 Security, Application, Design, Threat, Session
Threat 136-180 Application, Security, Session, Developer, Secure
TOTAL 180 All questions include answers and detailed rationales
,Section A - Security
Q1.
In a microservices architecture, a developer proposes using JSON Web Tokens (JWT) for
stateless authentication. Which design flaw introduces a critical vulnerability?
A. Storing the JWT in local storage on the B. Using a symmetric key shared among all
client services for JWT signing
C. Setting a short expiration time on the D. Including the user's role in the JWT
token payload
Correct: B - Using a symmetric key shared among all services for JWT signing
Rationale:Using a symmetric key shared among all services means any compromised
service can forge tokens for any user. Storing in local storage is a risk but not the critical
design flaw. Short expiration is a best practice. Including role is common but should be
validated.
Q2.
During a threat modeling session for an e-commerce application, the team uses STRIDE.
Which mitigation directly addresses the 'Spoofing' threat?
A. Implementing input validation on all B. Enforcing multi-factor authentication for
user-supplied fields admin accounts
C. Encrypting data in transit with TLS D. Logging all access attempts to sensitive
resources
Correct: B - Enforcing multi-factor authentication for admin accounts
Rationale:Spoofing involves impersonating a user or system. MFA mitigates spoofing by
requiring additional proof of identity. Input validation addresses tampering. TLS addresses
information disclosure. Logging addresses repudiation.
Q3.
Which of the following is the most effective approach to prevent SQL injection in a legacy
PHP application without rewriting the entire codebase?
A. Using a web application firewall (WAF) to B. Escaping all user input with a global
filter malicious requests function
C. Migrating to parameterized prepared D. Disabling error messages that reveal
statements for all database queries database structure
Correct: C - Migrating to parameterized prepared statements for all database queries
Page 3
, Section A - Security
Rationale: Parameterized prepared statements ensure SQL queries are parsed separately
from data, eliminating injection. WAF is a mitigation, not a fix. Escaping can be error-prone.
Disabling errors reduces information disclosure but does not prevent injection.
Q4.
In a CI/CD pipeline, a security scanner flags a dependency with a known critical
vulnerability. The team decides to proceed to production because the vulnerability is not
exploitable in their environment. This decision is an example of which risk management
strategy?
A. Risk acceptance B. Risk avoidance
C. Risk mitigation D. Risk transfer
Correct: A - Risk acceptance
Rationale:Risk acceptance involves acknowledging the risk and choosing not to act because
the impact or likelihood is low. Avoidance would remove the dependency. Mitigation would
apply a patch or workaround. Transfer would shift risk to a third party.
Q5.
An application uses OAuth 2.0 with the authorization code flow. Which additional security
measure is essential to prevent authorization code interception?
A. Using client-side JavaScript to handle the B. Validating the 'state' parameter
redirect
C. Shortening the authorization code D. Using PKCE (Proof Key for Code
expiration to 1 minute Exchange)
Correct: D - Using PKCE (Proof Key for Code Exchange)
Rationale:PKCE adds a dynamic secret that prevents code interception and replay attacks,
especially for public clients. The state parameter prevents CSRF but not interception. Short
expiration reduces the window but does not prevent interception. Client-side handling
increases risk.
Q6.
Which of the following is a primary advantage of using a threat model such as DREAD
over a simple checklist?
A. It provides a quantitative risk score for B. It eliminates the need for manual security
prioritizing threats. testing.
C. It automatically generates security test D. It ensures compliance with regulatory
cases. standards.
Page 4
DESIGN OBJECTIVE
ASSESSMENT (OA) EXAM BANK
LATEST MOCK PRACTICE SET
180 Questions with Answers and Detailed Rationales
100 PERCENT GUARANTEED PASS
INSTANT DOWNLOAD ANSWERS INCLUDED
IMPORTANCE OF THIS DOCUMENT
This comprehensive examination preparation guide has been meticulously developed to help you succeed in the
WGU D487 SECURE SOFTWARE DESIGN OBJECTIVE ASSESSMENT (OA) EXAM BANK VERIFIED
QUESTIONS WITH EXPERT RATIONALES LATEST 2026 UPDATE | ACCURATE & VERIFIED. It contains 180
carefully selected questions that reflect the most current exam content and testing strategies. Each question is
accompanied by a correct answer and a detailed rationale that explains the underlying pathophysiology,
pharmacology, or clinical reasoning.
Self-Assessment – Test your knowledge and Exam Preparation – Familiarize yourself with the
identify areas requiring further question format and content
study areas
Concept Reinforcement – Deepen your Confidence Building – Develop test-taking
understanding through strategies and reduce
evidence-based exam anxiety
rationales
Time Management – Practice answering
questions under simulated
exam conditions
Review Summary 180 Questions
Foundations - Application - WGU D487 Secure Software Design Objective Assessment OA BANK WITH
Expert Rationales 2026 Update Accurate & Secure Software Design Graduate
All answers with rationales
,Table of Contents
Content Area Questions Key Topics
Security 1-45 Application, Developer, Threat, Design, Review
Application 46-90 Security, Developer, Threat, Secure, Approach
Developer 91-135 Security, Application, Design, Threat, Session
Threat 136-180 Application, Security, Session, Developer, Secure
TOTAL 180 All questions include answers and detailed rationales
,Section A - Security
Q1.
In a microservices architecture, a developer proposes using JSON Web Tokens (JWT) for
stateless authentication. Which design flaw introduces a critical vulnerability?
A. Storing the JWT in local storage on the B. Using a symmetric key shared among all
client services for JWT signing
C. Setting a short expiration time on the D. Including the user's role in the JWT
token payload
Correct: B - Using a symmetric key shared among all services for JWT signing
Rationale:Using a symmetric key shared among all services means any compromised
service can forge tokens for any user. Storing in local storage is a risk but not the critical
design flaw. Short expiration is a best practice. Including role is common but should be
validated.
Q2.
During a threat modeling session for an e-commerce application, the team uses STRIDE.
Which mitigation directly addresses the 'Spoofing' threat?
A. Implementing input validation on all B. Enforcing multi-factor authentication for
user-supplied fields admin accounts
C. Encrypting data in transit with TLS D. Logging all access attempts to sensitive
resources
Correct: B - Enforcing multi-factor authentication for admin accounts
Rationale:Spoofing involves impersonating a user or system. MFA mitigates spoofing by
requiring additional proof of identity. Input validation addresses tampering. TLS addresses
information disclosure. Logging addresses repudiation.
Q3.
Which of the following is the most effective approach to prevent SQL injection in a legacy
PHP application without rewriting the entire codebase?
A. Using a web application firewall (WAF) to B. Escaping all user input with a global
filter malicious requests function
C. Migrating to parameterized prepared D. Disabling error messages that reveal
statements for all database queries database structure
Correct: C - Migrating to parameterized prepared statements for all database queries
Page 3
, Section A - Security
Rationale: Parameterized prepared statements ensure SQL queries are parsed separately
from data, eliminating injection. WAF is a mitigation, not a fix. Escaping can be error-prone.
Disabling errors reduces information disclosure but does not prevent injection.
Q4.
In a CI/CD pipeline, a security scanner flags a dependency with a known critical
vulnerability. The team decides to proceed to production because the vulnerability is not
exploitable in their environment. This decision is an example of which risk management
strategy?
A. Risk acceptance B. Risk avoidance
C. Risk mitigation D. Risk transfer
Correct: A - Risk acceptance
Rationale:Risk acceptance involves acknowledging the risk and choosing not to act because
the impact or likelihood is low. Avoidance would remove the dependency. Mitigation would
apply a patch or workaround. Transfer would shift risk to a third party.
Q5.
An application uses OAuth 2.0 with the authorization code flow. Which additional security
measure is essential to prevent authorization code interception?
A. Using client-side JavaScript to handle the B. Validating the 'state' parameter
redirect
C. Shortening the authorization code D. Using PKCE (Proof Key for Code
expiration to 1 minute Exchange)
Correct: D - Using PKCE (Proof Key for Code Exchange)
Rationale:PKCE adds a dynamic secret that prevents code interception and replay attacks,
especially for public clients. The state parameter prevents CSRF but not interception. Short
expiration reduces the window but does not prevent interception. Client-side handling
increases risk.
Q6.
Which of the following is a primary advantage of using a threat model such as DREAD
over a simple checklist?
A. It provides a quantitative risk score for B. It eliminates the need for manual security
prioritizing threats. testing.
C. It automatically generates security test D. It ensures compliance with regulatory
cases. standards.
Page 4
