New 2026 Guaranteed Success with UpdateDumps Secure-Software-Design Dumps WGU PDF Questions
Exceptional Practice To WGUSecure Software Design (KEO1) Exam Pass the First Time
WGU Secure-Software-Design Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
NEW QUESTION # 25
The scrum team decided that before any change can be merged and tested, it must be looked at by the learns lead developer, who will ensure accepted coding patterns are being followed and that the code meets the team's quality standards.
Which category of secure software best practices is the team performing?
- A. Training
- B. Code review
- C. Penetration testing
- D. Architecture analysis
Answer: C
Explanation:
The practice described is Code review, which is a part of secure software development best practices. Code reviews are conducted to ensure that the code adheres to accepted coding patterns and meets the team's quality standards. This process involves the examination of source code by a person or a group other than the author to identify bugs, security vulnerabilities, and ensure compliance with coding standards.
References:
* Fundamental Practices for Secure Software Development - SAFECode1.
* Secure Software Development Framework | CSRC2.
* Secure Software Development Best Practices - Hyperproof3.
NEW QUESTION # 26
Which DREAD category is based on how easily a threat exploit can be found?
- A. Discoverability
- B. Damage Potential
- C. Affected Users
- D. Reproducibility
Answer: A
NEW QUESTION # 27
What is the last slop of the SDLOSDL code review process?
- A. Review for security issues unique to the architecture
- B. Perform preliminary scan
- C. Review code for security issues
- D. Identify security code review objectives
Answer: C
Explanation:
The last step of the SDLC code review process is to review the code for security issues. This involves a detailed examination of the code to identify any potential security vulnerabilities that could be exploited. It's a critical phase where the focus is on ensuring that the code adheres to security best practices and does not contain any flaws that could compromise the security of the application or system. The process typically includes manual inspection as well as automated tools to scan for common security issues. The goal is to ensure that the software is as secure as possible before it is deployed. References: Mastering the Code Review Process, Understanding the SDLC, How Code Reviews Improve Software Quality in SDLC - LinkedIn.
NEW QUESTION # 28
The software security team has been tasked with assessing a document management application that has been in use for many years and developing a plan to ensure it complies with organizational policies.
Which post-release deliverable is being described?
- A. Security strategy tor M&A products
- B. External vulnerability disclosure response process
- C. Post-release certifications
- D. Security strategy for legacy code
Answer: D
Explanation:
The task described involves assessing a document management application that has been in use for many years. This scenario typically requires a security strategy that addresses the unique challenges of legacy code.
Legacy code refers to software that has been around for a long time and may not have been developed with current security standards in mind. A security strategy for legacy code would include measures to ensure that the application complies with current organizational policies, which may involve code reviews, updates, and the implementation of modern security practices to mitigate any potential vulnerabilities inherent in older code12.
References:
* Remotebase, "Best Practices for Managing Legacy Code"
* Medium, "The Engineer's Complete Guide to Legacy Code"
* Parasoft, "Testing Legacy Code & 3 Steps to Update"
NEW QUESTION # 29
The product security incident response team (PSIRT) has decided to make a formal public disclosure, including base and temporal common vulnerability scoring system (CVSS) scores and a common vulnerabilities and exposures (CVE) ID report, of an externally discovered vulnerability.
What is the most likely reason for making a public disclosure?
- A. The vulnerability reporter has threatened to make the finding public after being notified that their case was not credible.
- B. Notification of a vulnerability from an external party has occurred.
- C. The response team has determined that the vulnerability is credible.
- D. The potential for increased public awareness of a vulnerability is probable, which could lead to higher risk for customers.
Answer: C
NEW QUESTION # 30
While performing functional testing of the new product from a shared machine, a QA analyst closed their browser window but did not logout of the application. A different QA analyst accessed the application an hour later and was not prompted to login. They then noticed the previous analyst was still logged into the application.
How should existing security controls be adjusted to prevent this in the future?
- A. Ensure user sessions timeout after short intervals
- B. Ensure no sensitive information is stored in plain text in cookies
- C. Ensure role-based access control is enforced for access to all resources
- D. Ensure strong password policies are enforced
Answer: A
Explanation:
The issue described involves a session management vulnerability where the user's session remains active even after the browser window is closed, allowing another user on the same machine to access the application without logging in. To prevent this security risk, it's essential to adjust the session management controls to include an automatic timeout feature. This means that after a period of inactivity, or when the browser window is closed, the session should automatically expire, requiring a new login to access the application.
This adjustment ensures that even if a user forgets to log out, their session won't remain active indefinitely, reducing the risk of unauthorized access.
References:
* Secure SDLC practices emphasize the importance of security at every stage of the software development life cycle, including the implementation of proper session management controls12.
* Best practices for access control in security highlight the significance of managing session timeouts to prevent unauthorized access3.
* Industry standards and guidelines often recommend session timeouts as a critical security control to protect against unauthorized access4.
NEW QUESTION # 31
The software security group is conducting a maturity assessment using the Open Web Application Security Project Software Assurance Maturity Model (OWASP OpenSAMM). They are currently focused on reviewing design artifacts to ensure they comply with organizational security standards.
Which OpenSAMM business function is being assessed?
- A. Governance
- B. Verification
- C. Construction
- D. Deployment
Answer: B
Explanation:
The OpenSAMM business function being assessed is Verification. This function involves activities related to reviewing and testing to ensure that the software meets the required security standards and practices. In the context of the question, the software security group's focus on reviewing design artifacts to ensure compliance with organizational security standards falls under the Verification function. This includes tasks such as design review, implementation review, and security testing, which are all aimed at verifying that the security measures and controls are correctly integrated into the software design.
References: The information is verified as per the OWASP SAMM documentation, which outlines the Verification function as a core business function that encompasses activities like design review, which is directly related to the assessment of design artifacts mentioned in the question1.
NEW QUESTION # 32
Which threat modeling step assigns a score to discovered threats?
- A. Rate Threats
- B. Analyze the Target
- C. Identify and Document Threats
- D. Set the Scope
Answer: A
NEW QUESTION # 33
Which type of threat exists when an attacker can intercept and manipulate form data after the user clicks the save button but before the request is posted to the API?
- A. Elevation of privilege
- B. Information disclosure
- C. Tampering
- D. Spoofing
Answer: C
Explanation:
The type of threat described is Tampering. This threat occurs when an attacker intercepts and manipulates data being sent from the client to the server, such as form data being submitted to an API. The attacker may alter the data to change the intended operation, inject malicious content, or compromise the integrity of the system. Tampering attacks are a significant concern in secure software design because they can lead to unauthorized changes and potentially harmful actions within the application.
:
Understanding the different types of API attacks and their prevention1.
Comprehensive guide on API security and threat mitigation2.
Detailed analysis of Man-in-the-Middle (MitM) attacks and their impact on API security3.
NEW QUESTION # 34
Which secure coding best practice says to use a single application-level authorization component that will lock down the application if it cannot access its configuration information?
- A. Session management
- B. Data protection
- C. Communication security
- D. Access control
Answer: D
Explanation:
The secure coding best practice that recommends using a single application-level authorization component to lock down the application if it cannot access its configuration information is known as Access Control. This practice is part of a broader set of security measures aimed at ensuring that only authorized users have access to certain functionalities or data within an application. By centralizing the authorization logic, it becomes easier to manage and enforce security policies consistently across the application. If the authorization component cannot retrieve its configuration, it defaults to a secure state, thus preventing unauthorized access1.
References: 1: OWASP Secure Coding Practices - Quick Reference Guide
NEW QUESTION # 35
Which type of security analysis is performed using automated software tools while an application is running and is most commonly executed during the testing phase of the SDLC?
- A. Fuzz testing
- B. Dynamic analysis
- C. Static analysis
- D. Manual code review
Answer: B
Explanation:
Dynamic analysis is a security testing method that involves analyzing the behavior of software while it is running or in execution. It is most commonly executed during the testing phase of the Software Development Life Cycle (SDLC). This type of analysis is used to detect issues that might not be visible in the code's static state, such as runtime errors and memory leaks. Automated tools are employed to perform dynamic analysis, which can simulate attacks on the application and identify vulnerabilities that could be exploited by malicious actors.
: The information provided here is verified by multiple sources that discuss security automation in the SDLC and the role of dynamic analysis during the testing phase123.
NEW QUESTION # 36
Recent vulnerability scans discovered that the organization's production web servers were responding to ping requests with server type, version, and operating system, which hackers could leverage to plan attacks.
How should the organization remediate this vulnerability?
- A. Always uninstall or disable features that are not required
- B. Ensure servers are regularly updated with the latest security patches
- C. Access to configuration files is limited to administrators
- D. Ensure servers are configured to return as little information as possible to network requests
Answer: D
Explanation:
To remediate the vulnerability of servers responding to ping requests with sensitive information, the organization should configure the servers to return as little information as possible to network requests. This practice is known as reducing the attack surface. By limiting the amount of information disclosed, potential attackers have less data to use when attempting to exploit vulnerabilities. Regular updates and patching (Option B) are also important, but they do not address the specific issue of information disclosure.
Uninstalling or disabling unnecessary features (Option C) and restricting access to configuration files (Option D) are good security practices, but they do not directly prevent the leakage of server information through ping responses.
: The remediation steps are aligned with best practices in vulnerability management, which include finding, prioritizing, and fixing vulnerabilities, as well as configuring servers to minimize the exposure of sensitive information123.
NEW QUESTION # 37
Which concept is demonstrated when every module in a particular abstraction layer of a computing environment can only access the information and resources that are necessary for its legitimate purpose?
- A. Confidentiality
- B. Privacy
- C. Elevation of Privilege
- D. Principle of Least Privilege
Answer: D
NEW QUESTION # 38
Which type of security analysis is performed by injecting malformed data into open interfaces of an executable or running application and is most commonly executed during the testing or deployment phases of the SDLC?
- A. Manual Code Review
- B. Dynamic Analysis
- C. Static Analysis
- D. Fuzz Testing
Answer: D
NEW QUESTION # 39
Which type of security analysis is performed using automated software tools while an application is running and is most commonly executed during the testing phase of the SDLC?
- A. Fuzz testing
- B. Dynamic analysis
- C. Static analysis
- D. Manual code review
Answer: B
Explanation:
Dynamic analysis is a security testing method that involves analyzing the behavior of software while it is running or in execution. It is most commonly executed during the testing phase of the Software Development Life Cycle (SDLC). This type of analysis is used to detect issues that might not be visible in the code's static state, such as runtime errors and memory leaks. Automated tools are employed to perform dynamic analysis, which can simulate attacks on the application and identify vulnerabilities that could be exploited by malicious actors.
References: The information provided here is verified by multiple sources that discuss security automation in the SDLC and the role of dynamic analysis during the testing phase123.
NEW QUESTION # 40
The scrum team decided that before any change can be merged and tested, it must be looked at by the learns lead developer, who will ensure accepted coding patterns are being followed and that the code meets the team's quality standards.
Which category of secure software best practices is the team performing?
- A. Training
- B. Code review
- C. Penetration testing
- D. Architecture analysis
Answer: B
Explanation:
The practice described is Code review, which is a part of secure software development best practices. Code reviews are conducted to ensure that the code adheres to accepted coding patterns and meets the team's quality standards. This process involves the examination of source code by a person or a group other than the author to identify bugs, security vulnerabilities, and ensure compliance with coding standards.
References:
* Fundamental Practices for Secure Software Development - SAFECode1.
* Secure Software Development Framework | CSRC2.
* Secure Software Development Best Practices - Hyperproof3.
NEW QUESTION # 41
Which threat modeling step collects exploitable weaknesses within the product?
- A. Analyze the target
- B. Identify and document threats
- C. Set the scope
- D. Rate threats
Answer: B
Explanation:
The step in threat modeling that involves collecting exploitable weaknesses within the product is Identify and document threats. This step is crucial as it directly addresses the identification of potential security issues that could be exploited. It involves a detailed examination of the system to uncover vulnerabilities that could be targeted by threats.
References: The OWASP Foundation's Threat Modeling Process outlines a structured approach where identifying and documenting threats is a key step1. Additionally, various sources on threat modeling agree that the identification of threats is a fundamental aspect of the process, as it allows for the subsequent analysis and mitigation of these threats2345.
NEW QUESTION # 42
Which step in the change management process includes modifying the source code?
- A. Policy compliance analysis
- B. Installation management
- C. Privacy implementation assessment
- D. Patch management
Answer: D
Explanation:
Modifying the source code is typically associated with the patch management step in the change management process. Patch management involves the acquisition, testing, and installation of code changes, which can include updates, bug fixes, or improvements to existing software. This step ensures that modifications to the software are made in a controlled and systematic manner, maintaining the integrity and security of the software throughout the change.
References: The information provided aligns with industry-standard practices for change management in software engineering1.
NEW QUESTION # 43
Which secure coding best practice says to only use tested and approved components and use task-specific, built-in APIs to conduct operating system functions?
- A. Data Protection
- B. Authentication and Password Management
- C. Session Management
- D. General Coding Practices
Answer: D
NEW QUESTION # 44
......
Secure-Software-Design EXAM DUMPS WITH GUARANTEED SUCCESS: https://actualtest.updatedumps.com/WGU/Secure-Software-Design-updated-exam-dumps.html