Online Secure-Software-Design Test Brain Dump Question and Test Engine
Real WGU Secure-Software-Design Exam Dumps with Correct 118 Questions and Answers
WGU Secure-Software-Design Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
NEW QUESTION # 19
Which mitigation technique is used to fight against an identity spoofing threat?
- A. Require user authorization
- B. Filtering
- C. Audit trails
- D. Encryption
Answer: A
Explanation:
To combat identity spoofing threats, a mitigation technique that is often used is requiring user authorization.
This involves implementing strong authentication methods to verify the identity of users before granting access to sensitive information or systems. Techniques such as two-factor authentication (2FA) or multi-factor authentication (MFA) are effective in reducing the risk of unauthorized access, as they require users to provide multiple pieces of evidence to confirm their identity, making it much harder for attackers to spoof an identity successfully.
:
Best practices for preventing spoofing attacks, including the use of antivirus and firewall tools, and the importance of strong authentication methods like 2FA and MFA1.
The National Security Agency's guidance on identity theft threats and mitigations, emphasizing the need for personal protection and strong authentication measures2.
Discussion on the effectiveness of strong authentication methods in protecting against spoofing attacks3.
The role of comprehensive identity verification and authentication strategies in preventing AI-enhanced identity fraud4.
NEW QUESTION # 20
What sitsbetween a browser and an internet connection and alters requests and responses in a way thedeveloper did not intend?
- A. Reverse engineering
- B. Input validation
- C. Intercept proxy
- D. Load testing
Answer: C
Explanation:
An intercept proxy, also known as a proxy server, sits between a web client (such as a browser) and an external server to filter, monitor, or manipulate the requests and responses passing through it. This can be used for legitimate purposes, such as security testing and user privacy, but it can also be exploited by attackers to alter web traffic in a way that the developer did not intend, potentially leading to security vulnerabilities.
References:
* Understanding of HTTP and HTTPS protocols12.
* Definition and role of proxy servers3.
NEW QUESTION # 21
The security testing team received a report from one of the contracted penetration testing vendors that details a flaw discovered in the login component of the new software product, along with a recommended fix.
Which phase of the penetration testing process is the team in?
- A. Deploy
- B. Identify
- C. Assess
- D. Evaluate and plan
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
The team is in the Assess phase of penetration testing. This phase involves actively testing the software, identifying vulnerabilities, and documenting findings with recommendations. Receiving a report detailing a discovered flaw confirms that testing has been conducted and results are being evaluated. The Identify (A) phase involves defining scope and targets, Evaluate and Plan (B) covers planning test activities, and Deploy (C) refers to executing the test environment setup. The OWASP Penetration Testing Guide and NIST SP 800-
115 clarify that assessment includes vulnerability discovery and documentation.
References:
OWASP Penetration Testing Guide
NIST SP 800-115 Technical Guide to Information Security Testing and Assessment Microsoft SDL Security Testing Guidance
NEW QUESTION # 22
Recent vulnerability scans discovered that the organization's production web servers were responding to ping requests with server type, version, and operating system, which hackers could leverage to plan attacks.
How should the organization remediate this vulnerability?
- A. Always uninstall or disable features that are not required
- B. Ensure servers are configured to return as little information as possible to network requests
- C. Access to configuration files is limited to administrators
- D. Ensure servers are regularly updated with the latest security patches
Answer: B
Explanation:
To remediate the vulnerability of servers responding to ping requests with sensitive information, the organization should configure the servers to return as little information as possible to network requests. This practice is known as reducing the attack surface. By limiting the amount of information disclosed, potential attackers have less data to use when attempting to exploit vulnerabilities. Regular updates and patching (Option B) are also important, but they do not address the specific issue of information disclosure.
Uninstalling or disabling unnecessary features (Option C) and restricting access to configuration files (Option D) are good security practices, but they do not directly prevent the leakage of server information through ping responses.
References: The remediation steps are aligned with best practices in vulnerability management, which include finding, prioritizing, and fixing vulnerabilities, as well as configuring servers to minimize the exposure of sensitive information123.
NEW QUESTION # 23
Which category classifies identified threats that do not have defenses in place and expose the application to exploits?
- A. Partially mitigated threat
- B. Threat profile
- C. Unmitigated threats
- D. Fully mitigated threat
Answer: C
Explanation:
The category that classifies identified threats with no defenses in place, exposing the application to exploits, is Unmitigated Threats. This term refers to vulnerabilities for which no countermeasures or mitigations have been implemented. These threats are critical because they represent actual weaknesses that attackers can exploit. In the context of secure software design, it's essential to identify these threats early in the SDLC to ensure that appropriate security controls can be designed and implemented to protect against them.
:
Taxonomy of Cyber Threats to Application Security and Applicable Defenses1.
OWASP Foundation's Threat Modeling Process2.
Mitigating Persistent Application Security Threats3.
NEW QUESTION # 24
The organization is moving from a waterfall to an agile software development methodology, so the software security group must adapt the security development life cycle as well. They have decided to break out security requirements and deliverables to fit better in the iterative life cycle by defining every-sprint requirements, one-time requirements, bucket requirements, and final security review requirements.
Which type of requirement slates that the team must identify primary security and privacy contacts?
- A. Bucket requirement
- B. Final security review requirement
- C. One-time requirement
- D. Every-sprint requirement
Answer: C
Explanation:
The OpenSAMM business function being assessed is Verification. This function involves activities related to reviewing and testing to ensure that the software meets the requiredsecurity standards and practices. In the context of the question, the software security group's focus on reviewing design artifacts to ensure compliance with organizational security standards falls under the Verification function. This includes tasks such as design review, implementation review, and security testing, which are all aimed at verifying that the security measures and controls are correctly integrated into the software design.
References: The information is verified as per the OWASP SAMM documentation, which outlines the Verification function as a core business function that encompasses activities like design review, which is directly related to the assessment of design artifacts mentioned in the question1.
NEW QUESTION # 25
Which secure coding best practice ensures sensitive information is not disclosed in any responses to users, authorized or unauthorized?
- A. Input validation
- B. Authentication and password management
- C. System configuration
- D. Error handling and logging
Answer: D
Explanation:
Comprehensive and Detailed In-Depth Explanation:
Preventing the disclosure of sensitive information in application responses is primarily addressed by implementing proper Error Handling and Logging practices.
When errors occur, applications may inadvertently reveal sensitive data through detailed error messages. To mitigate this risk, error handling mechanisms should be designed to provide generic error messages to end- users, while detailed error information is logged securely for internal review. This approach ensures that sensitive information, such as system configurations, stack traces, or personal data, is not exposed to unauthorized users.
The OWASP Secure Coding Practices emphasize the importance of error handling and logging to prevent information leakage:
"Ensure that error messages displayed to users do not reveal sensitive information that can be exploited by attackers." References:
* OWASP Secure Coding Practices - Quick Reference Guide
NEW QUESTION # 26
Which threat modeling step collects exploitable weaknesses within the product?
- A. Rate threats
- B. Set the scope
- C. Identify and document threats
- D. Analyze the target
Answer: C
Explanation:
The step in threat modeling that involves collecting exploitable weaknesses within the product is Identify and document threats. This step is crucial as it directly addresses the identification of potential security issues that could be exploited. It involves a detailed examination of the system to uncover vulnerabilities that could be targeted by threats.
: The OWASP Foundation's Threat Modeling Process outlines a structured approach where identifying and documenting threats is a key step1. Additionally, various sources on threat modeling agree that the identification of threats is a fundamental aspect of the process, as it allows for the subsequent analysis and mitigation of these threats2345.
NEW QUESTION # 27
Which software control test examines the internal logical structures of a program and steps through the code line by line to analyze the program for potential errors?
- A. Reasonableness testing
- B. Black box testing
- C. White box testing
- D. Dynamic testing
Answer: C
Explanation:
White box testing, also known as clear box testing, glass box testing, transparent box testing, and structural testing, is a method of software testing where the internal structure, design, and coding of the software are tested to verify the flow of input-output and to improve the design, usability, and security. It involves looking at the structures that are internal to the system, with the tester having knowledge of the internal workings of the product. This type of testing is concerned with examining the internal logical structures of the program and is typically performed by stepping through the code line by line to analyze the program for potential errors, which aligns with the description of the control test in question.
:
Control Structure Testing - GeeksforGeeks1
What is White Box Testing? - BrowserStack2
Software Testing Strategies Chapter 18 - IIT3
NEW QUESTION # 28
Which secure coding best practice says to use well-vetted algorithms to ensure that the application uses random identifiers, that identifiers are appropriately restricted to the application, and that user processes are fully terminated on logout?
- A. Output Encoding
- B. Access Control
- C. Input Validation
- D. Session Management
Answer: D
NEW QUESTION # 29
Using a web-based common vulnerability scoring system (CVSS) calculator, a security response team member performed an assessment on a reported vulnerability in the company's customer portal. The base score of the vulnerability was 9.9 and changed to 8.0 after adjusting temporal and environmental metrics.
Which rating would CVSS assign this vulnerability?
- A. Critical severity
- B. High severity
- C. Low severity
- D. Medium severity
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
CVSS scores are classified into severity levels based on numeric ranges. A base score of 9.9 falls within the Critical range (9.0-10.0), but after adjustment for temporal and environmental metrics, the score is 8.0, which falls into the High severity category (7.0-8.9). Therefore, the final rating assigned is High severity.
Medium severity corresponds to scores between 4.0 and 6.9, and low severity is below 4.0. This scoring methodology is defined by the FIRST Common Vulnerability Scoring System v3.1 Specification which guides how scores are adjusted to reflect real-world risk contexts.
References:
FIRST CVSS v3.1 Specification
OWASP Vulnerability Severity Classification
NIST National Vulnerability Database (NVD)
NEW QUESTION # 30
Which DREAD category is based on how easily a threat exploit can be found?
- A. Damage Potential
- B. Reproducibility
- C. Discoverability
- D. Affected Users
Answer: C
NEW QUESTION # 31
The scrum team decided that before any change can be merged and tested, it must be looked at by the learns lead developer, who will ensure accepted coding patterns are being followed and that the code meets the team's quality standards.
Which category of secure software best practices is the team performing?
- A. Training
- B. Architecture analysis
- C. Penetration testing
- D. Code review
Answer: D
Explanation:
The practice described is Code review, which is a part of secure software development best practices. Code reviews are conducted to ensure that the code adheres to accepted coding patterns and meets the team's quality standards. This process involves the examination of source code by a person or a group other than the author to identify bugs, security vulnerabilities, and ensure compliance with coding standards.
References:
* Fundamental Practices for Secure Software Development - SAFECode1.
* Secure Software Development Framework | CSRC2.
* Secure Software Development Best Practices - Hyperproof3.
NEW QUESTION # 32
Which secure coding best practice says to assume all incoming data should be considered untrusted and should be validated to ensure the system only accepts valid data?
- A. Input validation
- B. System configuration
- C. General coding practices
- D. Session management
Answer: A
Explanation:
The secure coding best practice that emphasizes treating all incoming data as untrusted and subjecting it to validation is known as input validation. This practice is crucial for ensuring that a system only processes valid, clean data, thereby preventing many types of vulnerabilities, such as SQL injection, cross-site scripting (XSS), and buffer overflows, which can arise from maliciously crafted inputs.
* Input validation involves verifying that the data meets certain criteria before it is processed by the system. This includes checking for the correct data type, length, format, and range. It also involves sanitizing the data to ensure that it does not contain any potentially harmful elements that could lead to security breaches.
* A centralized input validation routine is recommended for the entire application, which helps in maintaining consistency and effectiveness in the validation process. This routine should be implemented on a trusted system, typically server-side, to prevent tampering or bypassing of the validation logic.
* It's important to classify all data sources into trusted and untrusted categories and to apply rigorous validation to all data from untrusted sources, such as user input, databases, file streams, and network interfaces.
By adhering to the input validation best practice, developers can significantly reduce the attack surface of their applications and protect against a wide array of common security threats.
: The verified answer is supported by the Secure Coding Practices outlined by the OWASP Foundation1 and other reputable sources such as Coding Dojo2 and CERT Secure Coding3.
NEW QUESTION # 33
Which secure coding best practice says to require authentication before allowing any files to be uploaded and to limit the types of files to only those needed for the business purpose?
- A. Memory management
- B. Data protection
- C. File management
- D. Communication security
Answer: C
Explanation:
The secure coding best practice that requires authentication before allowing any files to be uploaded, and limits the types of files to only those needed for the business purpose, falls under the category of File Management. This practice is crucial for preventing unauthorized file uploads, which can be a common vector for attacks such as uploading malicious files or scripts. By enforcing authentication, the application ensures that only legitimate users can upload files. Additionally, restricting the file types to those necessary for business operations minimizes the risk of uploading potentially harmful files that could compromise the system.
References:
* OWASP Secure Coding Practices1
* File Upload Security Best Practices | CodeHandbook2
* File Upload Protection - 10 Best Practices for Preventing ... - OPSWAT3
NEW QUESTION # 34
Which type of security analysis is performed using automated software tools while an application is running and is most commonly executed during the testing phase of the SDLC?
- A. Static analysis
- B. Dynamic analysis
- C. Fuzz testing
- D. Manual code review
Answer: B
Explanation:
Dynamic analysis is a security testing method that involves analyzing the behavior of software while it is running or in execution. It is most commonly executed during the testing phase of the Software Development Life Cycle (SDLC). This type of analysis is used to detect issues that might not be visible in the code's static state, such as runtime errors and memory leaks. Automated tools are employed to perform dynamic analysis, which can simulate attacks on the application and identify vulnerabilities that could be exploited by malicious actors.
: The information provided here is verified by multiple sources that discuss security automation in the SDLC and the role of dynamic analysis during the testing phase123.
NEW QUESTION # 35
The organization has contracted with an outside firm to simulate an attack on the new software product and report findings and remediation recommendations.
Which activity of the Ship SDL phase is being performed?
- A. Penetration testing
- B. Policy compliance analysis
- C. Final security review
- D. Open-source licensing review
Answer: A
Explanation:
Penetration testing is an activity where a simulated attack is performed on a software product to identify vulnerabilities that could be exploited by attackers. It is a proactive and authorized attempt to evaluate the security of an IT infrastructure by safely trying to exploit system vulnerabilities, including OS, service and application flaws, improper configurations, and risky end-user behavior. In the context of the Ship phase of the Security Development Lifecycle (SDL), penetration testing is conducted as a final check to uncover any potential security issues that might have been missed during previous phases. This ensures that the software product is robust and secure before it is released.
References:
* The Ship phase of the SDL includes activities such as policy compliance review, vulnerability scanning, penetration testing, open-source licensing review, and final security and privacy reviews1.
* Penetration testing is a critical component of the Ship phase, as it helps to identify and fix security vulnerabilities before the software is deployed2.
NEW QUESTION # 36
Security testers have completed testing and are documenting the results of vulnerability scans and penetration analysis They are also creating documentation lo share with the organization's largest customers.
Which deliverable is being prepared?
- A. Open-source licensing review report
- B. Customer engagement framework
- C. Remediation report
- D. Security testing reports
Answer: D
Explanation:
After completing vulnerability scans and penetration analysis, security testers document the results to share with stakeholders, such as the organization's largest customers. The deliverable being prepared in this context is the Security testing reports. These reports typically include detailed findings from the security assessments, explanations of the vulnerabilities discovered, the potential risks they pose, and recommendations for remediation. The purpose of these reports is to provide transparency about the security posture of the software or system and to guide the organization in addressing the identified security issues12. References: 1, 2
https://blog.halosecurity.com/what-really-matters-when-it-comes-to-pentesting-deliverables/
NEW QUESTION # 37
A new product does not display personally identifiable information, will not let private documents be printed, and requires elevation of privilege to retrieve archive documents. Which secure coding practice is this describing?
- A. Authentication
- B. Data protection
- C. Access control
- D. Input validation
Answer: C
Explanation:
The secure coding practice being described is Access Control. This practice ensures that access to data and features within a system is restricted and controlled. The description given indicates that the product has mechanisms to prevent the display of personally identifiable information (PII), restrict the printing of private documents, and require elevated privileges to access archived documents. These are all measures to control who has access to what data and under what circumstances, which is the essence of access control.
:
ISO/IEC 27018 Code of Practice for Protecting Personal Data in the Cloud1.
NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)2.
ISO/IEC 29151:2017, Code of practice for personally identifiable information protection3.
NEW QUESTION # 38
Which software control test examines the internal logical structures of a program and steps through the code line by line to analyze the program for potential errors?
- A. Reasonableness testing
- B. Black box testing
- C. White box testing
- D. Dynamic testing
Answer: C
Explanation:
White box testing, also known as clear box testing, glass box testing, transparent box testing, and structural testing, is a method of software testing where the internal structure, design, and coding of the software are tested to verify the flow of input-output and to improve the design, usability, and security. It involves looking at the structures that are internal to the system, with the tester having knowledge of the internal workings of the product. This type of testing is concerned with examining the internal logical structures of the program and is typically performed by stepping through the code line by line to analyze the program for potential errors, which aligns with the description of the control test in question.
References:
* Control Structure Testing - GeeksforGeeks1
* What is White Box Testing? - BrowserStack2
* Software Testing Strategies Chapter 18 - IIT3
NEW QUESTION # 39
......
Valid Secure-Software-Design Test Answers & WGU Secure-Software-Design Exam PDF: https://www.actualtestsit.com/WGU/Secure-Software-Design-exam-prep-dumps.html
WGU Secure-Software-Design Certification Real 2026 Mock Exam: https://drive.google.com/open?id=1PS_IQ_1SVpGzobbu8T3KDuBb9IF_M2HQ