Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. WGU
  5. Secure-Software-Design

WGU Secure-Software-Design Exam
WGU Secure Software Design (D487, KEO1) (Page 2 )

Updated On: 7-Feb-2026
Page 2 of 25
PDF with 118 Questions

What are the three primary goals of the secure software development process?

  1. Performance, reliability, and maintainability
  2. Cost, speed to market, and profitability
  3. Redundancy, scalability, and portability
  4. Confidentiality, integrity, and availability

Answer(s): D

Explanation:

The three primary goals of the secure software development process, often referred to as the CIA triad, are confidentiality, integrity, and availability. These principles form the cornerstone of security considerations in the software development life cycle (SDLC). Confidentiality ensures that sensitive information is accessed only by authorized individuals and systems. This involves implementing access controls and encryption to protect data from unauthorized access.
Integrity refers to maintaining the accuracy and consistency of data across its lifecycle. This means that the data is not altered or tampered with by unauthorized entities. Techniques like checksums and digital signatures help ensure data integrity.
Availability ensures that information and resources are accessible to authorized users when needed.

This involves creating resilient systems that can withstand attacks and recover quickly from any disruptions.
By integrating these security goals into each phase of the SDLC, from planning and design to development, testing, and maintenance, organizations can create more secure software systems that are resilient to cyber threats.


Reference:

The information provided here is verified as per the Secure Software Design documents and best practices in the field, as outlined by sources such as Snyk1, GeeksforGeeks2, and SAFECode3.



What refers to the review of software source code by developers other than the original coders to try to identify oversights, mistakes, assumptions, a lack of knowledge, or even experience?

  1. User acceptance testing
  2. Manual peer review
  3. Fault injection
  4. Dynamic code review

Answer(s): B

Explanation:

Manual peer review refers to the systematic examination of software source code by developers other than the original author. This practice is recognized as a valuable tool for reducing software defects and improving the quality of software projects. It involves developers inspecting the code to find and fix mistakes overlooked in the initial development phase, which enhances both the overall quality of software and the developers' skills. Peer code review is less formal and more "lightweight" than the code inspections performed in the past, and it provides benefits such as knowledge transfer, increased team awareness, and creation of alternative solutions to problems.


Reference:

Expectations, Outcomes, and Challenges Of Modern Code Review1 Introduction to Software Engineering/Quality/Code Review2 Software Security during Modern Code Review: The Developer's Perspective3



Which software-testing technique can be automated or semi-automated and provides invalid, unexpected, or random data to the inputs of a computer software program?

  1. Fuzzing
  2. Static analysis
  3. Dynamic analysis
  4. Bugtraq

Answer(s): A

Explanation:

Fuzzing is an automated or semi-automated software testing technique that involves providing invalid, unexpected, or random data to the inputs of a computer program1. This process is designed to uncover coding errors, security vulnerabilities, and other potential issues within the software by observing how it behaves under unexpected or malformed inputs. Fuzzing is particularly effective because it can expose corner cases that have not been properly dealt with and can be used to test programs that take structured inputs, such as file formats or protocols2.


Reference:

1: Wikipedia - Fuzzing
2: DZone - Fuzzing in Software Engineering



What sits between a browser and an internet connection and alters requests and responses in a way the developer did not intend?

  1. Load testing
  2. Input validation
  3. Intercept proxy
  4. Reverse engineering

Answer(s): C

Explanation:

An intercept proxy, also known as a proxy server, sits between a web client (such as a browser) and an external server to filter, monitor, or manipulate the requests and responses passing through it. This can be used for legitimate purposes, such as security testing and user privacy, but it can also be exploited by attackers to alter web traffic in a way that the developer did not intend, potentially leading to security vulnerabilities.


Reference:

Understanding of HTTP and HTTPS protocols12.
Definition and role of proxy servers3.



What is a best practice of secure coding?

  1. Planning
  2. Session management
  3. User acceptance testing
  4. Microservices

Answer(s): B

Explanation:

Session management is a core component of secure coding, which involves maintaining the state of a user's interaction with a system. Proper session management can help protect against various security vulnerabilities, such as session hijacking and session fixation attacks. It is essential for ensuring that user data is handled securely throughout an application's workflow.


Reference:

The OWASP Secure Coding Practices guide emphasizes the importance of implementing secure coding standards, which include robust session management1. Additionally, Snyk's secure coding practices highlight the significance of access control, including authentication and authorization, as fundamental to protecting a system2. These resources align with the concept that effective session management is a best practice in secure coding.






Post your Comments and Discuss WGU Secure-Software-Design exam prep with other Community members:

Join the Secure-Software-Design Discussion