Accurate & Verified 2026 New Secure-Software-Design Answers As Experienced in the Actual Test!
Secure-Software-Design Certification Sample Questions certification Exam
WGU Secure-Software-Design Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 65
A product team, consisting of a Scrum Master, a Business Analyst, two Developers, and a Quality Assurance Tester, are on a video call with the Product Owner. The team is reviewing a list of work items to determine how many they feel can be added to their backlog and completed within the next two-week iteration.
Which Scrum ceremony is the team participating in?
- A. Sprint Retrospective
- B. Sprint Review
- C. Sprint Planning
- D. Daily Scrum
Answer: C
NEW QUESTION # 66
Which type of threat exists when an attacker can intercept and manipulate form data after the user clicks the save button but before the request is posted to the API?
- A. Spoofing
- B. Tampering
- C. Information disclosure
- D. Elevation of privilege
Answer: B
Explanation:
The type of threat described is Tampering. This threat occurs when an attacker intercepts and manipulates data being sent from the client to the server, such as formdata being submitted to an API. The attacker may alter the data to change the intended operation, inject malicious content, or compromise the integrity of the system. Tampering attacks are a significant concern in secure software design because they can lead to unauthorized changes and potentially harmful actions within the application.
References:
* Understanding the different types of API attacks and their prevention1.
* Comprehensive guide on API security and threat mitigation2.
* Detailed analysis of Man-in-the-Middle (MitM) attacks and their impact on API security3.
NEW QUESTION # 67
Recent vulnerability scans discovered that the organization's production web servers were responding to ping requests with server type, version, and operating system, which hackers could leverage to plan attacks.
How should the organization remediate this vulnerability?
- A. Access to configuration files is limited to administrators
- B. Ensure servers are configured to return as little information as possible to network requests
- C. Ensure servers are regularly updated with the latest security patches
- D. Always uninstall or disable features that are not required
Answer: B
Explanation:
To remediate the vulnerability of servers responding to ping requests with sensitive information, the organization should configure the servers to return as little information as possible to network requests. This practice is known as reducing the attack surface. By limiting the amount of information disclosed, potential attackers have less data to use when attempting to exploit vulnerabilities. Regular updates and patching (Option B) are also important, but they do not address the specific issue of information disclosure.
Uninstalling or disabling unnecessary features (Option C) and restricting access to configuration files (Option D) are good security practices, but they do not directly prevent the leakage of server information through ping responses.
: The remediation steps are aligned with best practices in vulnerability management, which include finding, prioritizing, and fixing vulnerabilities, as well as configuring servers to minimize the exposure of sensitive information123.
NEW QUESTION # 68
Which secure software design principle states that it is always safer to require agreement of more than one entity to make a decision?
- A. Least Privilege
- B. Psychological Acceptability
- C. Total Mediation
- D. Separation of Privileges
Answer: D
NEW QUESTION # 69
Which type of security analysis is limited by the fact that a significant time investment of a highly skilled team member is required?
- A. Dynamic code analysis
- B. Fuzz testing
- C. Static code analysis
- D. Manual code review
Answer: D
Explanation:
Manual code review is a type of security analysis that requires a significant time investment from a highly skilled team member. This process involves a detailed and thorough examination of the source code to identify security vulnerabilities that automated tools might miss. It is labor-intensive because it relies on the expertise of the reviewer to understand the context, logic, and potential security implications of the code. Unlike automated methods like static or dynamic code analysis, manual codereview demands a deep understanding of the codebase, which can be time-consuming and requires a high level of skill and experience.
References: The information provided here is based on industry best practices and standards for secure software design and development, as well as my understanding of security analysis methodologies12.
NEW QUESTION # 70
The organization has contracted with an outside firm to simulate an attack on the new software product and report findings and remediation recommendations.
Which activity of the Ship SDL phase is being performed?
- A. Open-source licensing review
- B. Final security review
- C. Penetration testing
- D. Policy compliance analysis
Answer: C
Explanation:
Penetration testing is an activity where a simulated attack is performed on a software product to identify vulnerabilities that could be exploited by attackers. It is a proactive and authorized attempt to evaluate the security of an IT infrastructure by safely trying to exploit system vulnerabilities, including OS, service and application flaws, improper configurations, and risky end-user behavior. In the context of the Ship phase of the Security Development Lifecycle (SDL), penetration testing is conducted as a final check to uncover any potential security issues that might have been missed during previous phases. This ensures that the software product is robust and secure before it is released.
:
The Ship phase of the SDL includes activities such as policy compliance review, vulnerability scanning, penetration testing, open-source licensing review, and final security and privacy reviews1.
Penetration testing is a critical component of the Ship phase, as it helps to identify and fix security vulnerabilities before the software is deployed2.
NEW QUESTION # 71
Which type of security analysis is limited by the fact that a significant time investment of a highly skilled team member is required?
- A. Dynamic code analysis
- B. Fuzz testing
- C. Static code analysis
- D. Manual code review
Answer: D
Explanation:
Manual code review is a type of security analysis that requires a significant time investment from a highly skilled team member. This process involves a detailed and thorough examination of the source code to identify security vulnerabilities that automated tools might miss. It is labor-intensive because it relies on the expertise of the reviewer to understand the context, logic, and potential security implications of the code.
Unlike automated methods like static or dynamic code analysis, manual code review demands a deep understanding of the codebase, which can be time-consuming and requires a high level of skill and experience.
: The information provided here is based on industry best practices and standards for secure software design and development, as well as my understanding of security analysis methodologies12.
NEW QUESTION # 72
The security testing team received a report from one of the contracted penetration testing vendors that details a flaw discovered in the login component of the new software product, along with a recommended fix.
Which phase of the penetration testing process is the team in?
- A. Deploy
- B. Evaluate and plan
- C. Identify
- D. Assess
Answer: D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
The team is in the Assess phase of penetration testing. This phase involves actively testing the software, identifying vulnerabilities, and documenting findings with recommendations. Receiving a report detailing a discovered flaw confirms that testing has been conducted and results are being evaluated. The Identify (A) phase involves defining scope and targets, Evaluate and Plan (B) covers planning test activities, and Deploy (C) refers to executing the test environment setup. The OWASP Penetration Testing Guide and NIST SP 800-
115 clarify that assessment includes vulnerability discovery and documentation.
References:
OWASP Penetration Testing Guide
NIST SP 800-115 Technical Guide to Information Security Testing and Assessment Microsoft SDL Security Testing Guidance
NEW QUESTION # 73
Which secure coding best practice says to ensure that buffers are allocated correctly and at the right size, that input strings are truncated to a reasonable length, and that resources, connections, objects, and file handles are destroyed once the application no longer needs them?
- A. Session Management
- B. Data Protection
- C. Memory Management
- D. Input Validation
Answer: C
NEW QUESTION # 74
The final security review determined that two low-risk security issues identified in testing are still outstanding. Developers have assured the security team that both issues can be resolved quickly once they have time to fix them. The security team is confident that developers can fix the flaws in the first post-release patch.
What is the result of the final security review?
- A. Not Passed and Requires Escalation
- B. Passed
- C. Not Passed but Does Not Require Escalation
- D. Passed with Exceptions
Answer: D
NEW QUESTION # 75
Which design and development deliverable contains the results of each type of evaluation that was performed and the type and number of vulnerabilities discovered?
- A. Privacy compliance report
- B. Security testing reports
- C. Security test execution report
- D. Remediation report
Answer: B
Explanation:
Security testing reports are the deliverables that typically contain detailed results of the security evaluations performed. These reports include the types of tests conducted, such as static and dynamic analysis, penetration testing, and code reviews, as well as the number and types of vulnerabilities discovered. The purpose of these reports is to document the security posture of the software at the time of testing and to provide a basis for remediation efforts.
: The information aligns with best practices in secure software development, which emphasize the importance of documenting security requirements and conducting risk analysis during the design phase to identify and mitigate vulnerabilities early in the SDLC12.
NEW QUESTION # 76
The software security group is conducting a maturity assessment using the Open Web Application Security Project Software Assurance Maturity Model (OWASP SAMM). They are currently focused on reviewing design artifacts to ensure they comply with organizational security standards.
Which OpenSAMM business function is being assessed?
- A. Governance
- B. Construction
- C. Verification
- D. Deployment
Answer: C
Explanation:
Comprehensive and Detailed In-Depth Explanation:
The Open Web Application Security Project (OWASP) Software Assurance Maturity Model (SAMM) is a framework designed to help organizations assess and improve their software security posture. SAMM is structured around five primary business functions: Governance, Design, Implementation, Verification, and Operations.
In this scenario, the focus is on reviewing design artifacts to ensure compliance with organizational security standards. This activity aligns with the Verification business function within SAMM. The Verification function encompasses security practices related to assessing and validating the security of software artifacts throughout the development lifecycle. Key practices under this function include:
* Design Review: Evaluating design documents and models to identify potential security issues and ensure that security requirements are adequately addressed.
* Code Review: Analyzing source code to detect security vulnerabilities and ensure adherence to secure coding standards.
* Security Testing: Conducting various testing methodologies, such as penetration testing and vulnerability scanning, to identify and remediate security weaknesses in the software.
By focusing on the Verification function, the organization aims to proactively identify and address security concerns during the design and development phases, thereby enhancing the overall security posture of their software products.
References:
* OWASP SAMM - Verification
NEW QUESTION # 77
Which type of security analysis is performed using automated software tools while an application is running and is most commonly executed during the testing phase of the SDLC?
- A. Manual code review
- B. Fuzz testing
- C. Static analysis
- D. Dynamic analysis
Answer: D
Explanation:
Dynamic analysis is a security testing method that involves analyzing the behavior of software while it is running or in execution. It is most commonly executed during the testing phase of the Software Development Life Cycle (SDLC). This type of analysis is used to detect issues that might not be visible in the code's static state, such as runtime errors and memory leaks. Automated tools are employed to perform dynamic analysis, which can simulate attacks on the application and identify vulnerabilities that could be exploited by malicious actors.
: The information provided here is verified by multiple sources that discuss security automation in the SDLC and the role of dynamic analysis during the testing phase123.
NEW QUESTION # 78
A company is moving forward with a new product. Product scope has been determined, teams have formed, and backlogs have been created. Developers areactively writing code for the new product, with one team concentrating on delivering data via REST services, one Team working on the mobile apps, and a third team writing the web application.
Which phase of the software developmentlifecycle(SDLC) is being described?
- A. Implementation
- B. Design
- C. Deployment
- D. Requirements
Answer: A
Explanation:
The phase being described is the Implementation phase of the SDLC. During this phase, the actual development starts, and the product begins to be built. The teams are actively writing code, which is a key activity of the Implementation phase. This phase involves translating the design and specifications into executable code, developing the software's features, and then integrating the various components into a full-fledged system.
References:
* The Software Development Life Cycle (SDLC): 7 Phases and 5 Models1.
* What Is the Software Development Life Cycle? SDLC Explained2.
* SDLC: 6 Main Stages of the Software Product Development Lifecycle3.
* Software Development Life Cycle (SDLC) Phases & Models4.
NEW QUESTION # 79
Which secure coding practice uses role-based authentication where department-specific credentials will authorize department-specific functionality?
- A. Authentication
- B. Data Protection
- C. Access Control
- D. Input Validation
Answer: C
NEW QUESTION # 80
Which category classifies identified threats that have some defenses in place and expose the application to limited exploits?
- A. Unmitigated Threats
- B. Partially Mitigated Threat
- C. Threat Profile
- D. Fully Mitigated Threat
Answer: B
NEW QUESTION # 81
The software security team has been tasked with assessing a document management application that has been in use for many years and developing a plan to ensure it complies with organizational policies.
Which post-release deliverable is being described?
- A. Security strategy for legacy code
- B. External vulnerability disclosure response process
- C. Security strategy tor M&A products
- D. Post-release certifications
Answer: A
Explanation:
The task described involves assessing a document management application that has been in use for many years. This scenario typically requires a security strategy that addresses the unique challenges of legacy code.
Legacy code refers to software that has been around for a long time and may not have been developed with current security standards in mind. A security strategy for legacy code would include measures to ensure that the application complies with current organizational policies, which may involve code reviews, updates, and the implementation of modern security practices to mitigate any potential vulnerabilities inherent in older code12.
References:
* Remotebase, "Best Practices for Managing Legacy Code"
* Medium, "The Engineer's Complete Guide to Legacy Code"
* Parasoft, "Testing Legacy Code & 3 Steps to Update"
NEW QUESTION # 82
Which type of security analysis is performed by reviewing source code line-by-line after other security analysis techniques have been executed?
- A. Dynamic Analysis
- B. Manual Code Review
- C. Fuzz Testing
- D. Static Analysis
Answer: B
NEW QUESTION # 83
Which software control test examines an application from a user perspective by providing a wide variety of input scenarios and inspecting the output?
- A. White box
- B. Black box
- C. Static
- D. Dynamic
Answer: B
Explanation:
The software control test that examines an application from a user perspective by providing a wide variety of input scenarios and inspecting the output is known as black box testing. This testing method focuses on the functionality of the application rather than its internal structures or workings. Testers provide inputs and examine outputs without knowing how and where the inputs are worked upon. It's designed to test the system' s external behavior.
* Black box testing is used to verify that the system meets the requirements and behaves as expected in various scenarios, including edge cases and incorrect input data. It helps in identifying discrepancies between the system's actual functionality and its specified requirements.
* This type of testing is applicable across various levels of software testing, including unit, integration, system, and acceptance testing. It is particularly useful for validating user stories and use cases during the software development process.
* Since black box testing treats the software as a "black box", it does not require the tester to have knowledge of the programming languages or the system's implementation. This allows testers to objectively test the software's behavior and performance.
: The concept of black box testing is well-documented and is a standard practice in secure software design, as outlined by sources such as LambdaTest1 and other industry best practices.
NEW QUESTION # 84
Automated security testing was performed by attempting to log in to the new product with a known username using a collection of passwords. Access was granted after a few hundred attempts.
How should existing security controls be adjusted to prevent this in the future?
- A. Ensure strong password policies are enforced
- B. Ensure passwords are encrypted when stored in persistent data stores
- C. Ensure authentication controls are resistant to brute force attacks
- D. Ensure credentials and authentication tokens are encrypted during transit
Answer: C
NEW QUESTION # 85
After being notified of a vulnerability in the company's online payment system, the Product Security Incident Response Team (PSIRT) was unable to recreate the vulnerability in a testing lab.
What is the response team's next step?
- A. Determine How the Reporter Was Able to Create the Vulnerability
- B. Identify Resources and Schedule the Fix
- C. Notify the Reporter That the Case Is Going to Be Closed
- D. Determine the Severity of the Vulnerability
Answer: A
NEW QUESTION # 86
The security team contracts with an independent security consulting firm to simulate attacks on deployed products and report results to organizational leadership.
Which category of secure software best practices is the team performing?
- A. Code review
- B. Penetration testing
- C. Architecture analysis
- D. Attack models
Answer: B
Explanation:
Comprehensive and Detailed In-Depth Explanation:
Engaging an independent security consulting firm to simulate attacks on deployed products is an example of Penetration Testing.
Penetration testing involves authorized simulated attacks on a system to evaluate its security. The objective is to identify vulnerabilities that could be exploited by malicious entities and to assess the system's resilience against such attacks. This proactive approach helps organizations understand potential weaknesses and implement necessary safeguards.
According to the OWASP Testing Guide, penetration testing is a critical component of a comprehensive security program:
"Penetration testing involves testing the security of systems and applications by simulating attacks from malicious individuals." References:
* OWASP Testing Guide
NEW QUESTION # 87
......
Certification Topics of Secure-Software-Design Exam PDF Recently Updated Questions: https://www.dumptorrent.com/Secure-Software-Design-braindumps-torrent.html
Secure-Software-Design Exam Prep Guide: Prep guide for the Secure-Software-Design Exam: https://drive.google.com/open?id=1GeJU29PUVlA43XGVtJvEcw5CzD8Z1qZR