WGU Courses and Certificates SECURE-SOFTWARE-DESIGN Questions & Answers

• Question 1:

  Security testers have completed testing and are documenting the results of vulnerability scans and penetration analysis. They are also creating documentation to share with the organization's largest customers. Which deliverable is being prepared?

  A. Open-source licensing review report

  B. Customer engagement framework

  C. Remediation report

  D. Security testing reports

  Correct Answer: D

  Reference: https://www.hackthebox.com/blog/penetration-testing-reports-template-and-guide

• Question 2:

  The organization has contracted with an outside firm to simulate an attack on the new software product and report findings and remediation recommendations. Which activity of the Ship SDL phase is being performed?

  A. Penetration testing

  B. Policy compliance analysis

  C. Open-source licensing review

  D. Final security review

  Correct Answer: A

  Reference: https://www.oreilly.com/library/view/core-software-security/9781466560963/xhtml/chapter7.xhtml

• Question 3:

  During fuzz testing of the new product, random values were entered into input elements. Search requests were sent to the correct API endpoint but many of them failed on execution due to type mismatches. How should existing security controls be adjusted to prevent this in the future?

  A. Ensure all user input data is validated prior to transmitting requests

  B. Ensure all requests and responses are encrypted

  C. Ensure sensitive transactions can be traced through an audit log

  D. Ensure the contents of authentication cookies are encrypted

  Correct Answer: A

• Question 4:

  What is the last step of the SDLC/SDL code review process?

  A. Review for security issues unique to the architecture

  B. Identify security code review objectives

  C. Perform preliminary scan

  D. Review code for security issues

  Correct Answer: D

• Question 5:

  Which type of security analysis is performed using automated software tools while an application is running and is most commonly executed during the testing phase of the SDLC?

  A. Dynamic analysis

  B. Manual code review

  C. Static analysis

  D. Fuzz testing

  Correct Answer: A

  Reference: https://www.imperva.com/learn/application-security/sast-iast-dast/#:~:text=Dynamic%20Application%20Security%20Testing%20(DAST,QA%20phase%20of%20the%20SDLC

• Question 6:

  Which threat modeling approach concentrates on things the organization wants to protect?

  A. Asset-centric

  B. Server-centric

  C. Attacker-centric

  D. Application-centric

  Correct Answer: A

• Question 7:

  The software security team is performing security testing for a new software product that is close to production release. They are concentrating on integrations between the new product and database servers, web servers, and web services. Which security testing technique is being used?

  A. Fuzz testing

  B. Dynamic code analysis

  C. Binary fault injection

  D. Binary code analysis

  Correct Answer: B

• Question 8:

  Which privacy impact statement requirement type defines how personal information will be protected when authorized or independent external entities are involved?

  A. Personal information retention requirements

  B. User controls requirements

  C. Third party requirements

  D. Data integrity requirements

  Correct Answer: C

  Reference: https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/privacy-impact-assessments/guide-to-undertaking-privacy-impact-assessments

• Question 9:

  In which step of the PASTA threat modeling methodology will the team capture infrastructure, application, and software dependencies?

  A. Attack modeling

  B. Define technical scope

  C. Define objectives

  D. Risk and impact analysis

  Correct Answer: B

  Reference: https://versprite.com/blog/what-is-pasta-threat-modeling/

• Question 10:

  Which mitigation technique is used to fight against an identity spoofing threat?

  A. Require user authorization

  B. Filtering

  C. Audit trails

  D. Encryption

  Correct Answer: A

  Reference: https://www.safetydetectives.com/blog/what-is-spoofing-and-how-to-mitigate-an-under-the-radar-threat/