Download Free WGU Secure-Software-Design Real Exam Questions Download [Q29-Q47]

admin • April 7, 2026

Download Free WGU Secure-Software-Design Real Exam Questions Download [Q29-Q47]

Rate this post

Download Free WGU Secure-Software-Design Real Exam Questions Download

Latest WGU Secure-Software-Design Real Exam Dumps PDF

NO.29 The software security group is conducting a maturity assessment using the Building Security in Maturity Model (BSIMM). They are currently focused on reviewing attack models created during recently completed initiatives.
Which BSIMM domain is being assessed?

Governance

Software security development life cycle (SSDL) touchpoints

Intelligence

Deployment

The Intelligence domain in the Building Security in Maturity Model (BSIMM) focuses on gathering and using information about software security. This includes understanding the types of attacks that are possible against the software being developed, which is why reviewing attack models falls under this domain. The BSIMM domain of Intelligence involves creating models of potential attacks on software (attack models), analyzing actual attacks that have occurred (attack intelligence), and sharing this information to improve security measures. By reviewing attack models, the software security group is essentially assessing the organization’s ability to anticipate and understand potential security threats, which is a key aspect of the Intelligence domain.
: The references used to verify this answer include the official BSIMM documentation and related resources that describe the various domains and their activities within the BSIMM framework12345.

NO.30 A company is moving forward with a new product. Product scope has been determined, teams have formed, and backlogs have been created. Developers areactively writing code for the new product, with one team concentrating on delivering data via REST services, one Team working on the mobile apps, and a third team writing the web application.
Which phase of the software developmentlifecycle(SDLC) is being described?

Deployment

Design

Implementation

Requirements

The phase being described is the Implementation phase of the SDLC. During this phase, the actual development starts, and the product begins to be built. The teams are actively writing code, which is a key activity of the Implementation phase. This phase involves translating the design and specifications into executable code, developing the software’s features, and then integrating the various components into a full-fledged system.
References:
* The Software Development Life Cycle (SDLC): 7 Phases and 5 Models1.
* What Is the Software Development Life Cycle? SDLC Explained2.
* SDLC: 6 Main Stages of the Software Product Development Lifecycle3.
* Software Development Life Cycle (SDLC) Phases & Models4.

NO.31 Which design and development deliverable contains the results of each type of evaluation that was performed and the type and number of vulnerabilities discovered?

Security test execution report

Security testing reports

Privacy compliance report

Remediation report

Security testing reports are the deliverables that typically contain detailed results of the security evaluations performed. These reports include the types of tests conducted, such as static and dynamic analysis, penetration testing, and code reviews, as well as the number and types of vulnerabilities discovered. The purpose of these reports is to document the security posture of the software at the time of testing and to provide a basis for remediation efforts.
: The information aligns with best practices in secure software development, which emphasize the importance of documenting security requirements and conducting risk analysis during the design phase to identify and mitigate vulnerabilities early in the SDLC12.

NO.32 The software security team prepared a detailed schedule napping security development lifecycle phases to the type of analysis they will execute.
Which design and development deliverable aid the team prepare?

Design security review

Updated threat modeling artifacts

Privacy implementation assessment results

Security test plans

The deliverable that would aid a software security team in preparing a detailed schedule mapping security development lifecycle phases to the type of analysis they will execute is Security test plans. These plans are crucial as they outline the testing strategies and specific security tests that will be conducted during the development lifecycle to ensure the software meets the required security standards.
* Security test plans are developed after the requirements and design phases and are used throughout the implementation, verification, and release phases. They include detailed instructions for security testing, criteria for success, and the types of security testing to be performed, such as static and dynamic analysis, penetration testing, and code review.
* These plans are living documents that should be updated as new threats are identified and as the project evolves. They ensure that all team members understand the security goals, the risks, and the measures that need to be taken to mitigate those risks.
* By having a well-defined security test plan, the team can ensure that security is not an afterthought but is integrated into every phase of the software development lifecycle, thus producing more secure software.
References: The importance of security test plans in the software development lifecycle is supported by best practices and guidelines from sources such as Microsoft’s Security Development Lifecycle1 and Snyk’s Secure Software Development Life Cycle principles2.

NO.33 Which mitigation technique is used to fight against an identity spoofing threat?

Require user authorization

Filtering

Audit trails

Encryption

To combat identity spoofing threats, a mitigation technique that is often used is requiring user authorization.
This involves implementing strong authentication methods to verify the identity of users before granting access to sensitive information or systems. Techniques such as two-factor authentication (2FA) or multi-factor authentication (MFA) are effective in reducing the risk of unauthorized access, as they require users to provide multiple pieces of evidence to confirm their identity, making it much harder for attackers to spoof an identity successfully.
:
Best practices for preventing spoofing attacks, including the use of antivirus and firewall tools, and the importance of strong authentication methods like 2FA and MFA1.
The National Security Agency’s guidance on identity theft threats and mitigations, emphasizing the need for personal protection and strong authentication measures2.
Discussion on the effectiveness of strong authentication methods in protecting against spoofing attacks3.
The role of comprehensive identity verification and authentication strategies in preventing AI-enhanced identity fraud4.

NO.34 The security team is identifying technical resources that will be needed to perform the final product security review.
Which step of the final product security review process are they in?

Release and Ship

Identify Feature Eligibility

Evaluate and Plan for Remediation

Assess Resource Availability

NO.35 In which step of the PASTA threat modeling methodology is vulnerability and exploit analysis performed?

Define technical scope

Attack modeling

Define objectives

Application decomposition

In the PASTA (Process for Attack Simulation and Threat Analysis) threat modeling methodology, vulnerability and exploit analysis is performed during the Attack modeling step. This step involves identifying potential threats and vulnerabilities within the system and understanding how they could be exploited.
* Attack modeling is a critical phase where the focus is on simulating attacks based on identified vulnerabilities. It allows for a deep understanding of the threats in the context of the application’s architecture and system design.
* During this phase, security analysts use their knowledge of the system’s technical scope and application decomposition to simulate how an attacker could exploit the system’s vulnerabilities. This helps in prioritizing the risks and planning appropriate mitigation strategies.
* The goal of attack modeling is not just to identify vulnerabilities but also to understand the potential impact of exploits on the system and the business, which is essential for developing a robust security posture.
References: The information provided is aligned with the PASTA methodology as described in resources such as VerSprite1 and the OWASP Foundation2. These sources detail the seven stages of PASTA, with attack modeling being a key component of the process.

NO.36 What are the eight phases of the software development lifecycle (SDLC)?

Planning, security analysis, requirement analysis, design, implementation, threat mitigation, testing, maintenance

Planning, requirements, design, implementation, testing, deployment, maintenance, end of life

Plan, gather requirements, identify attack surface, design, write code, perform code reviews, test, deploy

Gather requirements, prototype, perform threat modeling, write code, test, user acceptance testing, deploy, maintain

NO.37 The security testing team received a report from one of the contracted penetration testing vendors that details a flaw discovered in the login component of the new software product, along with a recommended fix.
Which phase of the penetration testing process is the team in?

Identify

Evaluate and plan

Deploy

Assess

Comprehensive and Detailed Explanation From Exact Extract:
The team is in the Assess phase of penetration testing. This phase involves actively testing the software, identifying vulnerabilities, and documenting findings with recommendations. Receiving a report detailing a discovered flaw confirms that testing has been conducted and results are being evaluated. The Identify (A) phase involves defining scope and targets, Evaluate and Plan (B) covers planning test activities, and Deploy (C) refers to executing the test environment setup. The OWASP Penetration Testing Guide and NIST SP 800-
115 clarify that assessment includes vulnerability discovery and documentation.
References:
OWASP Penetration Testing Guide
NIST SP 800-115 Technical Guide to Information Security Testing and Assessment Microsoft SDL Security Testing Guidance

NO.38 Which secure coding best practice says to require authentication before allowing any files to be uploaded and to limit the types of files to only those needed for the business purpose?

File management

Communication security

Data protection

Memory management

The secure coding best practice that requires authentication before allowing any files to be uploaded, and limits the types of files to only those needed for the business purpose, falls under the category of File Management. This practice is crucial for preventing unauthorized file uploads, which can be a common vector for attacks such as uploading malicious files or scripts. By enforcing authentication, the application ensures that only legitimate users can upload files. Additionally, restricting the file types to those necessary for business operations minimizes the risk of uploading potentially harmful files that could compromise the system.
:
OWASP Secure Coding Practices1
File Upload Security Best Practices | CodeHandbook2
File Upload Protection – 10 Best Practices for Preventing … – OPSWAT3

NO.39 The software security team is performing security testing for a new software product that is close to production release. They are concentrating on integrations between the new product and database servers, web servers, and web services.
Which security testing technique is being used?

Fuzz testing

Dynamic code analysis

Binary fault injection

Binary code analysis

Fuzz testing is the ideal technique in this scenario. Here’s why:
* Focus on Integrations: The scenario emphasizes testing links between the software, databases, web servers, and web services. Fuzz testing is specifically designed to find vulnerabilities in how software handles data and communication between components.
* Pre-release Testing: The product being close to release indicates a critical need to identify security flaws before public deployment. Fuzz testing is effective in uncovering unexpected behavior and potential vulnerabilities.
* Fuzz Testing Targets: Fuzz testing works by injecting invalid or unexpected data into interfaces (like those between databases, web components, etc.) to observe how the software reacts. This helps expose potential security gaps and weaknesses.

NO.40 What are the three primary goals of the secure software development process?

Performance, reliability, and maintainability

Cost, speed to market, and profitability

Redundancy, scalability, and portability

Confidentiality, integrity, and availability

The three primary goals of the secure software development process, often referred to as the CIA triad, are confidentiality, integrity, and availability. These principles form the cornerstone of security considerations in the software development life cycle (SDLC).
* Confidentiality ensures that sensitive information is accessed only by authorized individuals and systems. This involves implementing access controls and encryption to protect data from unauthorized access.
* Integrity refers to maintaining the accuracy and consistency of data across its lifecycle. This means that the data is not altered or tampered with by unauthorized entities. Techniques like checksums and digital signatures help ensure data integrity.
* Availability ensures that information and resources are accessible to authorized users when needed.
This involves creating resilient systems that can withstand attacks and recover quickly from any disruptions.
By integrating these security goals into each phase of the SDLC, from planning and design to development, testing, and maintenance, organizations can create more secure software systems that are resilient to cyber threats.
References: The information provided here is verified as per the Secure Software Design documents and best practices in the field, as outlined by sources such as Snyk1, GeeksforGeeks2, and SAFECode3.

NO.41 An individual is developing a software application that has a back-end database and is concerned that a malicious user may run the following SOL query to pull information about all accounts from the database:

Which technique should be used to detect this vulnerability without running the source codes?

Dynamic analysis

Cross-site scripting

Static analysis

Fuzz testing

Static analysis is a method used to detect vulnerabilities in software without executing the code. It involves examining the codebase for patterns that are indicative of security issues, such as SQL injection vulnerabilities. This technique can identify potential threats and weaknesses by analyzing the code’s structure, syntax, and data flow.
:
Static analysis as a means to identify security vulnerabilities1.
The importance of static analysis in the early stages of the SDLC to prevent security issues2.
Learning-based approaches to fix SQL injection vulnerabilities using static analysis3.

NO.42 Which software development model starts by specifying and implementing just a part of the software, which is then reviewed and identifies further requirements that are implemented by repeating the cycle?

Iterative

Implementation

Waterfall

Code and fix

Comprehensive and Detailed Explanation From Exact Extract:
The Iterative software development model fits this description. It involves specifying and implementing a portion of the software, reviewing it, gathering feedback, and refining or adding requirements in successive cycles. This approach supports evolving requirements and continuous improvement. Iterative models contrast with Waterfall (C), which is linear and sequential, with no repetition of phases. “Code and fix” (D) is an informal, ad hoc process lacking formal review cycles. Implementation (B) is a phase, not a model. The iterative approach is advocated in ISO/IEC 12207 and NIST guidelines for secure development, as it allows early detection and remediation of security issues by incremental design and testing.
References:
ISO/IEC 12207 Software Lifecycle Processes
NIST SP 800-64 Revision 2: Security Considerations in SDLC
Microsoft SDL Documentation

NO.43 The scrum team decided that before any change can be merged and tested, it must be looked at by the learns lead developer, who will ensure accepted coding patterns are being followed and that the code meets the team’s quality standards.
Which category of secure software best practices is the team performing?

Architecture analysis

Penetration testing

Code review

Training

The practice described is Code review, which is a part of secure software development best practices. Code reviews are conducted to ensure that the code adheres to accepted coding patterns and meets the team’s quality standards. This process involves the examination of source code by a person or a group other than the author to identify bugs, security vulnerabilities, and ensure compliance with coding standards.
References:
* Fundamental Practices for Secure Software Development – SAFECode1.
* Secure Software Development Framework | CSRC2.
* Secure Software Development Best Practices – Hyperproof3.

NO.44 The security team has a library of recorded presentations that are required viewing tor all new developers in the organization. The video series details organizational security policies and demonstrates how to define, test for. and code tor possible threats.
Which category of secure software best practices does this represent?

Attack models

Training

Architecture analysis

Code review

The category of secure software best practices being described is Training. This is because the focus is on educating new developers about organizational security policies and coding practices to mitigate potential threats. Training is a proactive approach to ensure that developers are aware of security concerns and are equipped with the knowledge to address them in their coding practices.
: The importance of training in secure software best practices is supported by industry resources such as the SAFECode’s “Fundamental Practices for Secure Software Development” which emphasizes the need for application security control definition and management1, and the NIST’s Secure Software Development Framework (SSDF) which recommends integrating secure development practices throughout the software development lifecycle2. Additional support for this category can be found in resources detailing effective secure development practices345.

NO.45 Which privacy impact statement requirement type defines how personal information will be protected when authorized or independent external entities are involved?

Personal information retention requirements

User controls requirements

Third party requirements

Data integrity requirements

The privacy impact statement requirement that defines how personal information will be protected when authorized or independent external entities are involved is best categorized under Third party requirements.
This aspect of privacy impact assessments ensures that personal data is safeguarded even when it is necessary to involve third parties, which could be service providers, partners, or other entities that might handle personal information on behalf of the primary organization. These requirements typically include stipulations for data handling agreements, securitymeasures, and compliance checks to ensure that third parties maintain the confidentiality and integrity of the personal information they process.
References:
* Guide to undertaking privacy impact assessments | OAIC1
* A guide to Privacy Impact Assessments – Information and Privacy2
* Personal Information Protection Law of China: Key Compliance Considerations3
* Privacy Impact Assessment – General Data Protection Regulation (GDPR)4
* Privacy impact assessment (PIA) – TechTarget5

NO.46 Which secure coding practice involves clearing all local storage as soon as a user logs of for the night and will automatically log a user out after an hour of inactivity?

Access control

System configuration

Communication security

Session management

The practice of clearing all local storage when a user logs off and automatically logging a user out after an hour of inactivity falls under the category of Session Management. This is a security measure designed to prevent unauthorized access to a user’s session and to protect sensitive data that might be stored in the local storage. By clearing the local storage, any tokens, session identifiers, or other sensitive information are removed, reducing the risk of session hijacking or other attacks. The automatic logout feature ensures that inactive sessions do not remain open indefinitely, which could otherwise be exploited by attackers.
: The information aligns with the secure coding practices outlined by the OWASP Foundation1, and is supported by common practices in web development for managing sessions and local storage2.

NO.47 Which secure coding practice requires users to log in to their accounts using an email address and a password they choose?

Access Control

Data Protection

Input Validation

Authentication

Loading …