Skip to content
CramShare
FreePractice exam

WGU D487 OA Exam – 80 Questions with 100% Verified Correct Answers (2025 Version, Secure and Fully Accurate)

COMP100 Computer Science — exam and revision material · Other

Updated today

Computer Science exam material, 9 pages. Originally published on StudyMerit.

Pages
9
Academic year
2025/2026
Language
English

What’s included

Preview 3 of 9 pages

See the first 3 pages exactly as they appear in the document.

Read page 1 as text

D487 Final Exam - Correct Answers 1. What is the study of real-world software security initiatives organized so companies can measure their initiatives and understand how to evolve them over time? Answer: Building Security in Maturity Model (BSIMM) 2. A software security team member has created data flow diagrams, chosen the STRIDE methodology to perform threat reviews, and created the security assessment for the new product. Which category of secure software best practices did the team member perform? Answer: Architecture analysis 3. The security team is reviewing whether new security requirements, based on identified threats or changes to organizational guidelines, can be implemented prior to releasing the new product. Which activity of the Ship SDL phase is being performed? Answer: Policy compliance analysis 4. Which type of requirement states that all user input values must be validated by type, size, and range? Answer: Every-sprint requirement 5. The software security group is conducting a maturity assessment using the Building Security in Maturity Model (BSIMM). They are currently focused on reviewing security testing results from recently completed initiatives. Which BSIMM domain is being assessed? Answer: Software security development life cycle (SSDL) touchpoints 6. Which type of requirement states that the team must perform remote procedure call (RPC) fuzz testing? Answer: Bucket requirement 7. The person being introduced during sprint zero will be a facilitator, will try to remove roadblocks and ensure the team is communicating freely, and will be responsible for Downloaded by Studymerit Dotcom (samuelkaruiki40@gmail.com) lOMoARcPSD|6879242

Read page 2 as text

D487 Final Exam - Correct Answers facilitating all scrum ceremonies. Which role is the team member playing? Answer: Scrum master 8. The new product standards state that all traffic must be secure and encrypted. What is the name for this secure coding practice? Answer: Communication security 9. Which DREAD category is based on how easily a threat exploit can be repeated? Answer: Reproducibility 10. Which mitigation technique can be used to fight against a data tampering threat? Answer: Digital signatures 11. What is a countermeasure to the web application security frame (ASF) configuration management threat category? Answer: Service accounts have no administration capabilities 12. Which type of requirement specifies that file formats the application sends to financial institutions must be certified every four years? Answer: Compliance requirement 13. Which type of requirement specifies that credit card numbers displayed in the application will be masked so they only show the last four digits? Answer: Privacy requirement 14. Which type of requirement specifies that user passwords will require a minimum of 8 characters and must include at least one uppercase character, one number, and one special character? Answer: Security requirement Downloaded by Studymerit Dotcom (samuelkaruiki40@gmail.com) lOMoARcPSD|6879242

Read page 3 as text

D487 Final Exam - Correct Answers 15. Which type of requirement specifies that credit card numbers are designated as highly sensitive confidential personal information? Answer: Data classification requirement 16. Which privacy impact statement requirement type defines how personal information is protected on devices used by more than a single associate? Answer: Privacy control requirements 17. In which step of the PASTA threat modeling methodology does design flaw analysis take place? Answer: Vulnerability and weakness analysis 18. Which privacy impact statement requirement type defines who has access to personal information within the product? Answer: Access requirements 19. Which threat modeling process identifies threats to each individual object in a data flow diagram? Answer: STRIDE-per-element 20. The DREAD methodology has been used to classify an identified exploit. What rating should be assigned after using a ternary ranking scale where high risk = 3 points, medium = 2, low = 1? Answer: High risk 21. What is the recommended way to mitigate a threat identified during threat modeling? Answer: Apply a standard accepted countermeasure 22. Which security assessment deliverable defines milestones that will be met during each Downloaded by Studymerit Dotcom (samuelkaruiki40@gmail.com) lOMoARcPSD|6879242

That’s the free preview

You’ve read 3 of 9 pages. The whole document is yours with a free account, and it stays in your library.

Others on this course also opened

Free

With a free account