WGU D487 OA 2025 TEST BANK 2 WITH 420

pg. 1

WGU D487 OA 2025 TEST BANK 2 WITH 420

QUESTIONS AND CORRECT ANSWERS

(100% CORRECT VERIFIED ANSWERS) D487

SECURE SOFTWARE DESIGN OBJECTIVE

ASSESSMENT 2025 TEST BANK V2

A project team is documenting software requirements, including security controls.Which of the following should be prioritized in this documentation process?

• Listing only functional requirements to speed up the SDL
• Documenting all security controls necessary to address identified risks and

compliance needs

• Avoiding detailed documentation to maintain flexibility
• Limiting documentation to the testing phase
• Documenting all security controls necessary to address identified risks and

compliance needs During the SDL, a project manager stresses the importance of documenting security requirements. What is one primary reason for documenting security requirements?

• To limit security requirements to only the development team
• To provide a clear, trackable record of security controls that helps ensure all

requirements are met

• To reduce the need for security assessments
• To allow security requirements to be adjusted informally without oversight
• To provide a clear, trackable record of security controls that helps ensure all

requirements are met The security team uses a Requirements Traceability Matrix (RTM) to track requirements. What is the main benefit of using an RTM for security documentation?

• / 4

pg. 2

• It allows stakeholders to change requirements at any point without impact
• It enables the team to trace each security requirement throughout the SDL to

verify compliance and coverage

• It limits the number of security requirements for a project
• It eliminates the need to communicate with stakeholders
• It enables the team to trace each security requirement throughout the SDL to

verify compliance and coverage Why is it essential to obtain formal acceptance from management for documented security requirements?

• To bypass the need for further security assessments
• To ensure management acknowledges and commits to the security

requirements, securing necessary resources and support

• To allow for the reduction of security requirements
• To ensure that only the development team is accountable for security
• To ensure management acknowledges and commits to the security

requirements, securing necessary resources and support What is the primary purpose of thoroughly documenting software requirements, including security controls, in secure software development?

• To meet auditing requirements and provide a reference for compliance
• To restrict changes to the software design
• To delay security planning until the final stages
• To reduce the involvement of stakeholders
• To meet auditing requirements and provide a reference for compliance

A company is outsourcing software development to a third-party vendor. Which of the following should be included in the contract to ensure data security?

• A provision allowing the third party to bypass security requirements
• Specific security controls, compliance obligations, and access restrictions that

the third party must follow

• A clause stating the third party is responsible for all regulatory compliance
• A provision allowing unrestricted data access by the third party 2 / 4

pg. 3

• Specific security controls, compliance obligations, and access restrictions that

the third party must follow A project team is developing software that processes sensitive customer information. To secure this data, the team decides to categorize it based on sensitivity levels. Why is this categorization essential in data protection?

• It allows the team to ignore security requirements for low-sensitivity data
• It enables the team to apply appropriate security controls based on data

sensitivity, ensuring high-risk data is more protected

• It removes the need for data access controls
• It minimizes the importance of encrypting sensitive data
• It enables the team to apply appropriate security controls based on data

sensitivity, ensuring high-risk data is more protected As part of a data protection strategy, a security analyst suggests classifying data to determine ownership and access levels. Why is identifying data ownership important?

• It allows only the development team to access data
• It clarifies accountability for data security and helps set permissions based on

data ownership

• It eliminates the need to monitor data access logs
• It restricts data handling to a single user
• It clarifies accountability for data security and helps set permissions based on

data ownership The development team is required to implement data protection for both structured and unstructured data. What is one critical reason for protecting unstructured data, such as documents or emails?

• Unstructured data is less valuable, so protection is optional
• Unstructured data often contains sensitive information that, if exposed, could

lead to security breaches

• Structured data alone requires protection for regulatory compliance
• Data protection applies only to structured formats 3 / 4

pg. 4

• Unstructured data often contains sensitive information that, if exposed, could

lead to security breaches A software application requires access controls to limit data access to authorized users. What is the primary purpose of implementing access controls as part of data protection?

• To simplify the data access process for all users
• To restrict data access to individuals based on their role and need, ensuring

sensitive data remains protected

• To allow unrestricted data access for internal users
• To ensure that all users have equal access to data
• To restrict data access to individuals based on their role and need, ensuring

sensitive data remains protected As part of data protection efforts, the team is tasked with establishing guidelines for sensitive data. Which guideline is most critical for protecting sensitive data?

• Limiting all users from accessing data
• Encrypting sensitive data to prevent unauthorized access
• Allowing sensitive data to be shared freely within the organization
• Storing all sensitive data in plaintext for easy access
• Encrypting sensitive data to prevent unauthorized access

As part of a secure data lifecycle strategy, the team is instructed to apply protections to data from its creation to its disposal. Why is it essential to manage data protection throughout its entire lifecycle?

• To ensure data protection only during high-use phases
• To provide continuous security and compliance at each stage, from creation to

disposal

• To limit data protection efforts to storage phases only
• To allow data to be securely deleted at any time without additional processes
• To provide continuous security and compliance at each stage, from creation to

disposal A development team is tasked with implementing "right to be forgotten" features in compliance with data privacy laws. At which stage of the data lifecycle is this

• / 4