WGU D487 Secure Software Design Exam 2025/2026 – Versions A & B | Verified Questions & Answers | Graded A+ Introduction This document includes 100% verified and up-to-date questions with correct answers for the WGU D487 Secure Software Design Exam (Versions A & B), aligned with the 2025/2026 assessment. The content covers key topics in secure software design, ensuring comprehensive preparation for the exam.
Topics Covered:
• Secure coding practices • Threat modeling and risk assessment • Software Development Life Cycle (SDLC) security • Authentication and authorization mechanisms • OWASP principles and secure design guidelines Exam Questions and Answers Version A Question 1 What is the primary purpose of threat modeling in secure software design?
- To optimize application performance
- To identify and mitigate potential security risks
- To reduce development costs
- To improve user interface design
Correct Answer: To identify and mitigate potential security risks
Rationale: Threat modeling identifies potential security risks early in the SDLC, allowing developers to implement mitigations proactively.Question 2 Which OWASP Top 10 vulnerability involves executing malicious scripts in a user’s browser?
- SQL Injection
- Cross-Site Scripting (XSS)
- Broken Authentication
- Insecure Deserialization 1 / 4
Correct Answer: Cross-Site Scripting (XSS)
Rationale: Cross-Site Scripting (XSS) allows attackers to inject malicious scripts into web pages viewed by users.Question 3 What is a key practice in the SDLC to ensure secure software?
- Skipping code reviews to meet deadlines
- Implementing input validation and sanitization
- Using unencrypted data transmission
- Ignoring dependency updates
Correct Answer: Implementing input validation and sanitization
Rationale: Input validation and sanitization prevent common vulnerabilities like SQL injection and XSS by ensuring data integrity.Question 4 Which authentication mechanism is considered most secure for web applications?
- Password-based authentication
- Multi-factor authentication (MFA)
- Single sign-on (SSO)
- Session-based authentication
Correct Answer: Multi-factor authentication (MFA)
Rationale: Multi-factor authentication (MFA) enhances security by requiring multiple verification methods, reducing the risk of unauthorized access.Question 5 What is the purpose of a secure coding standard like OWASP Secure Coding Practices?
- To increase application load times
- To provide guidelines for writing secure code
- To replace automated testing tools
- To simplify debugging processes
Correct Answer: To provide guidelines for writing secure code
Rationale: OWASP Secure Coding Practices provide guidelines to help developers write code that minimizes security vulnerabilities.Question 6 What is the primary goal of input sanitization in secure coding?
- To improve code readability
- To prevent injection attacks
- To reduce server load
- To enhance user experience
Correct Answer: To prevent injection attacks
Rationale: Input sanitization removes or escapes malicious content from user inputs, preventing injection attacks like XSS or SQL injection.Question 7 Which of the following is a secure way to handle sensitive data in memory? 2 / 4
- Storing data in plain text
- Using immutable strings for sensitive data
- Clearing sensitive data from memory after use
- Storing data in global variables
Correct Answer: Clearing sensitive data from memory after use
Rationale: Clearing sensitive data from memory after use reduces the risk of it being accessed by unauthorized processes or memory dumps.Question 8 What does the STRIDE model stand for in threat modeling?
- Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation
- Security, Testing, Reliability, Integration, Deployment, Encryption
- Scalability, Trust, Redundancy, Isolation, Debugging, Efficiency
- Standards, Threats, Risks, Incidents, Defenses, Exploitation
of Privilege
Correct Answer: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege Rationale: STRIDE is a threat modeling framework that categorizes threats into six types to identify security risks.Question 9 Which cryptographic algorithm is recommended for secure password hashing?
A) MD5
B) SHA-1
- bcrypt
D) DES
Correct Answer: bcrypt
Rationale: bcrypt is a secure, adaptive hashing algorithm designed for password hashing, resistant to brute-force attacks.Question 10 What is a key benefit of using HTTPS over HTTP for web applications?
- Faster data transmission
- Encrypted data transmission
- Simplified session management
- Reduced server costs
Correct Answer: Encrypted data transmission
Rationale: HTTPS encrypts data transmitted between the client and server, protecting it from interception.Question 11 What is a common cause of broken authentication vulnerabilities?
- Using strong passwords
- Implementing session timeouts
- Storing session IDs in URLs
- Enforcing HTTPS 3 / 4
Correct Answer: Storing session IDs in URLs
Rationale: Storing session IDs in URLs exposes them to interception or logging, leading to session hijacking.Question 12 Which of the following is a secure practice for API authentication?
- Hardcoding API keys in source code
- Using OAuth 2.0 for token-based authentication
- Disabling token expiration
- Sharing API keys publicly
Correct Answer: Using OAuth 2.0 for token-based authentication
Rationale: OAuth 2.0 provides secure, token-based authentication, allowing controlled access without exposing credentials.Question 13 What is the purpose of a Content Security Policy (CSP)?
- To optimize website performance
- To restrict sources of content execution
- To enable cross-site scripting
- To disable client-side validation
Correct Answer: To restrict sources of content execution
Rationale: CSP restricts the sources from which scripts, styles, and other resources can be loaded, mitigating XSS risks.Question 14 Which phase of the SDLC is most critical for identifying security requirements?
- Deployment
- Requirements Analysis
- Testing
- Maintenance
Correct Answer: Requirements Analysis
Rationale: Security requirements identified during the requirements analysis phase ensure security is built into the software from the start.Question 15 What is a common mitigation for Cross-Site Request Forgery (CSRF)?
- Disabling cookies
- Using anti-CSRF tokens
- Allowing cross-origin requests
- Storing session data in local storage
Correct Answer: Using anti-CSRF tokens
Rationale: Anti-CSRF tokens validate the authenticity of requests, preventing unauthorized actions from forged requests.Question 16 What is the purpose of a secure software design principle like "defense in depth"?
- / 4