Secure-Software-Design Exam Questions and Answers

QUESTION: 9

Which software control test examines the internal logical structures of a program and steps through the code line by line to analyze the program for potential errors?

White box testing
Reasonableness testing
Black box testing
Dynamic testing

Answer(s): A

Explanation:

White box testing, also known as clear box testing, glass box testing, transparent box testing, and structural testing, is a method of software testing where the internal structure, design, and coding of the software are tested to verify the flow of input-output and to improve the design, usability, and security. It involves looking at the structures that are internal to the system, with the tester having knowledge of the internal workings of the product. This type of testing is concerned with examining the internal logical structures of the program and is typically performed by stepping through the code line by line to analyze the program for potential errors, which aligns with the description of the control test in question.

Reference:

Control Structure Testing - GeeksforGeeks1
What is White Box Testing? - BrowserStack2
Software Testing Strategies Chapter 18 - IIT3

Reveal Solution Next Question

QUESTION: 10

Which secure coding best practice says to assume all incoming data should be considered untrusted and should be validated to ensure the system only accepts valid data?

General coding practices
Input validation
Session management
System configuration

Answer(s): B

Explanation:

The secure coding best practice that emphasizes treating all incoming data as untrusted and subjecting it to validation is known as input validation. This practice is crucial for ensuring that a system only processes valid, clean data, thereby preventing many types of vulnerabilities, such as SQL injection, cross-site scripting (XSS), and buffer overflows, which can arise from maliciously crafted inputs.
Input validation involves verifying that the data meets certain criteria before it is processed by the system. This includes checking for the correct data type, length, format, and range. It also involves sanitizing the data to ensure that it does not contain any potentially harmful elements that could lead to security breaches.
A centralized input validation routine is recommended for the entire application, which helps in maintaining consistency and effectiveness in the validation process. This routine should be implemented on a trusted system, typically server-side, to prevent tampering or bypassing of the validation logic.
It's important to classify all data sources into trusted and untrusted categories and to apply rigorous validation to all data from untrusted sources, such as user input, databases, file streams, and network interfaces.
By adhering to the input validation best practice, developers can significantly reduce the attack surface of their applications and protect against a wide array of common security threats.

Reference:

The verified answer is supported by the Secure Coding Practices outlined by the OWASP Foundation1 and other reputable sources such as Coding Dojo2 and CERT Secure Coding3.

Reveal Solution Next Question

QUESTION: 11

Which secure coding best practice says to require authentication before allowing any files to be uploaded and to limit the types of files to only those needed for the business purpose?

File management
Communication security
Data protection
Memory management

Answer(s): A

Explanation:

The secure coding best practice that requires authentication before allowing any files to be uploaded, and limits the types of files to only those needed for the business purpose, falls under the category of File Management. This practice is crucial for preventing unauthorized file uploads, which can be a common vector for attacks such as uploading malicious files or scripts. By enforcing authentication, the application ensures that only legitimate users can upload files. Additionally, restricting the file types to those necessary for business operations minimizes the risk of uploading potentially harmful files that could compromise the system.

Reference:

OWASP Secure Coding Practices1
File Upload Security Best Practices | CodeHandbook2
File Upload Protection 10 Best Practices for Preventing ... - OPSWAT3

Reveal Solution Next Question

QUESTION: 12

Which secure coding best practice says to use a single application-level authorization component that will lock down the application if it cannot access its configuration information?

Access control
Data protection
Session management
Communication security

Answer(s): A

Explanation:

The secure coding best practice that recommends using a single application-level authorization component to lock down the application if it cannot access its configuration information is known as Access Control. This practice is part of a broader set of security measures aimed at ensuring that only authorized users have access to certain functionalities or data within an application. By centralizing the authorization logic, it becomes easier to manage and enforce security policies consistently across the application. If the authorization component cannot retrieve its configuration, it defaults to a secure state, thus preventing unauthorized access1.

Reference:

1: OWASP Secure Coding Practices - Quick Reference Guide

Reveal Solution Next Question

QUESTION: 13

Which SDL security goal is defined as ensuring timely and reliable access to and use of information?

Information security
Confidentiality
Availability
Integrity

Answer(s): C

Explanation:

The term `availability' in the context of Secure Software Development Lifecycle (SDL) refers to ensuring that systems, applications, and data are accessible to authorized users when needed. This means that the information must be timely and reliable, without undue delays or interruptions. Availability is a critical aspect of security, as it ensures that the software functions correctly and efficiently, providing users with the information they need to perform their tasks.

Reference:

The definition of availability as per the National Institute of Standards and Technology (NIST) Glossary1.
The Microsoft Security Development Lifecycle (SDL) which emphasizes the importance of availability in secure software design2.
General principles of Secure Software Development Life Cycle (SSDLC) that include availability as a key security goal3.

Reveal Solution Next Question

QUESTION: 14

What is one of the tour core values of the agile manifesto?

Communication between team members
Individuals and interactions over processes and tools
Business people and developers must work together daily throughout the project.
Teams should have a dedicated and open workspace.

Answer(s): B

Explanation:

One of the four core values of the Agile Manifesto is prioritizing "individuals and interactions over processes and tools." This value emphasizes the importance of the human element in software development, advocating for direct communication, collaboration, and the flexibility to adapt to change over strict adherence to rigid processes or reliance on specific tools. It recognizes that while processes and tools are important, they should serve the team and the individuals within it, rather than the other way around.

Reference:

The Agile Manifesto itself, along with various interpretations and guides such as those provided by Smartsheet1 and LogRocket2, support this value as one of the central tenets of Agile methodologies. These resources offer insights into how this value, along with the other three, guide the Agile approach to efficient and effective software development.

Reveal Solution Next Question

QUESTION: 15

The scrum team decided that before any change can be merged and tested, it must be looked at by the learns lead developer, who will ensure accepted coding patterns are being followed and that the code meets the team's quality standards.
Which category of secure software best practices is the team performing?

Architecture analysis
Penetration testing
Code review
Training

Answer(s): B

Explanation:

The practice described is Code review, which is a part of secure software development best practices. Code reviews are conducted to ensure that the code adheres to accepted coding patterns and meets the team's quality standards. This process involves the examination of source code by a person or a group other than the author to identify bugs, security vulnerabilities, and ensure compliance with coding standards.

Reference:

Fundamental Practices for Secure Software Development - SAFECode1.
Secure Software Development Framework | CSRC2.
Secure Software Development Best Practices - Hyperproof3.

Reveal Solution Next Question

QUESTION: 16

The security team has a library of recorded presentations that are required viewing tor all new developers in the organization. The video series details organizational security policies and demonstrates how to define, test for. and code tor possible threats.
Which category of secure software best practices does this represent?

Attack models
Training
Architecture analysis
Code review

Answer(s): B

Explanation:

The category of secure software best practices being described is Training. This is because the focus is on educating new developers about organizational security policies and coding practices to mitigate potential threats. Training is a proactive approach to ensure that developers are aware of security concerns and are equipped with the knowledge to address them in their coding practices.

Reference:

The importance of training in secure software best practices is supported by industry resources such as the SAFECode's "Fundamental Practices for Secure Software Development" which emphasizes the need for application security control definition and management1, and the NIST's Secure Software Development Framework (SSDF) which recommends integrating secure development practices throughout the software development lifecycle2. Additional support for this category can be found in resources detailing effective secure development practices345.

Reveal Solution Next Question

WGU Secure-Software-Design Exam (page: 2) WGU Secure Software Design (D487, KEO1) Updated on: 07-Feb-2026

QUESTION: 9

Explanation:

Reference:

QUESTION: 10

Explanation:

Reference:

QUESTION: 11

Explanation:

Reference:

QUESTION: 12

Explanation:

Reference:

QUESTION: 13

Explanation:

Reference:

QUESTION: 14

Explanation:

Reference:

QUESTION: 15

Explanation:

Reference:

QUESTION: 16

Explanation:

Reference:

WGU Secure-Software-Design Exam (page: 2)
WGU Secure Software Design (D487, KEO1)
Updated on: 07-Feb-2026