Secure-Software-Design Dumps - Grab Out For [NEW-2026] WGU Exam
Secure-Software-Design Exam Dumps PDF Guaranteed Success with Accurate & Updated Questions
NEW QUESTION # 10
Company leadership has contracted with a security firm to evaluate the vulnerability of all externally lacing enterprise applications via automated and manual system interactions. Which security testing technique is being used?
- A. Source-code fault injection
- B. Penetration testing
- C. Properly-based-testing
- D. Source-code analysis
Answer: B
Explanation:
The security testing technique that involves evaluating the vulnerability of all externally facing enterprise applications through both automated and manual system interactions is known as Penetration Testing. This method simulates real-world attacks on systems to identify potential vulnerabilities that could be exploited by attackers. It is a proactive approach to discover security weaknesses before they can be exploited in a real attack scenario. Penetration testing can include a variety of methods such as network scanning, application testing, and social engineering tactics to ensure a comprehensive security evaluation.
: The concept of Penetration Testing as a method for evaluating vulnerabilities aligns with industry standards and practices, as detailed in resources from security-focused organizations and literature1.
NEW QUESTION # 11
The software security team has been tasked with assessing a document management application that has been in use for many years and developing a plan to ensure it complies with organizational policies.
Which post-release deliverable is being described?
- A. Security strategy for legacy code
- B. Post-release certifications
- C. External vulnerability disclosure response process
- D. Security strategy tor M&A products
Answer: A
Explanation:
The task described involves assessing a document management application that has been in use for many years. This scenario typically requires a security strategy that addresses the unique challenges of legacy code.
Legacy code refers to software that has been around for a long time and may not have been developed with current security standards in mind. A security strategy for legacy code would include measures to ensure that the application complies with current organizational policies, which may involve code reviews, updates, and the implementation of modern security practices to mitigate any potential vulnerabilities inherent in older code12.
References:
* Remotebase, "Best Practices for Managing Legacy Code"
* Medium, "The Engineer's Complete Guide to Legacy Code"
* Parasoft, "Testing Legacy Code & 3 Steps to Update"
NEW QUESTION # 12
During fuzz testing of the new product, random values were entered into input elements Searchrequests were sent to the correct API endpoint but many of them failed on execution due to type mismatches.
How should existing security controls be adjusted to prevent this in the future?
- A. Ensure sensitive transactions can be traced through an audit log
- B. Ensure all user input data is validated prior to transmitting requests
- C. Ensure all requests and responses are encrypted
- D. Ensure the contents of authentication cookies are encrypted
Answer: B
Explanation:
Validating user input data before it is processed by the application is a fundamental security control in software design. This process, known as input validation, ensures that only properly formed data is entering the workflow of the application, thereby preventing many types of attacks, including type mismatches as mentioned in the question. By validating input data, the application can reject any requests that contain unexpected or malicious data, reducing the risk of security vulnerabilities and ensuring the integrity of the system.
References:
* Secure SDLC practices emphasize the importance of integrating security activities, such as creating security and functional requirements, code reviews, security testing, architectural analysis, and risk assessment, into the existing development workflow1.
* A Secure Software Development Life Cycle (SSDLC) ensures that security is considered at every phase of the development process, from planning and design to coding, testing, deploying, and maintaining the software2.
NEW QUESTION # 13
In which step of the PASTA threat modeling methodology is vulnerability and exploit analysis performed?
- A. Application decomposition
- B. Define technical scope
- C. Define objectives
- D. Attack modeling
Answer: D
Explanation:
In the PASTA (Process for Attack Simulation and Threat Analysis) threat modeling methodology, vulnerability and exploit analysis is performed during the Attack modeling step. This step involves identifying potential threats and vulnerabilities within the system and understanding how they could be exploited.
* Attack modeling is a critical phase where the focus is on simulating attacks based on identified vulnerabilities. It allows for a deep understanding of the threats in the context of the application's architecture and system design.
* During this phase, security analysts use their knowledge of the system's technical scope and application decomposition to simulate how an attacker could exploit the system's vulnerabilities. This helps in prioritizing the risks and planning appropriate mitigation strategies.
* The goal of attack modeling is not just to identify vulnerabilities but also to understand the potential impact of exploits on the system and the business, which is essential for developing a robust security posture.
References: The information provided is aligned with the PASTA methodology as described in resources such as VerSprite1 and the OWASP Foundation2. These sources detail the seven stages of PASTA, with attack modeling being a key component of the process.
NEW QUESTION # 14
Which secure coding practice uses role-based authentication where department-specific credentials will authorize department-specific functionality?
- A. Authentication
- B. Access Control
- C. Data Protection
- D. Input Validation
Answer: B
NEW QUESTION # 15
The scrum team decided that before any change can be merged and tested, it must be looked at by the learns lead developer, who will ensure accepted coding patterns are being followed and that the code meets the team's quality standards.
Which category of secure software best practices is the team performing?
- A. Training
- B. Architecture analysis
- C. Code review
- D. Penetration testing
Answer: C
Explanation:
The practice described is Code review, which is a part of secure software development best practices. Code reviews are conducted to ensure that the code adheres to accepted coding patterns and meets the team's quality standards. This process involves the examination of source code by a person or a group other than the author to identify bugs, security vulnerabilities, and ensure compliance with coding standards.
References:
* Fundamental Practices for Secure Software Development - SAFECode1.
* Secure Software Development Framework | CSRC2.
* Secure Software Development Best Practices - Hyperproof3.
NEW QUESTION # 16
During fuzz testing of the new product, random values were entered into input elements Search requests were sent to the correct API endpoint but many of them failed on execution due to type mismatches.
How should existing security controls be adjusted to prevent this in the future?
- A. Ensure sensitive transactions can be traced through an audit log
- B. Ensure all user input data is validated prior to transmitting requests
- C. Ensure all requests and responses are encrypted
- D. Ensure the contents of authentication cookies are encrypted
Answer: B
Explanation:
Validating user input data before it is processed by the application is a fundamental security control in software design. This process, known as input validation, ensures that only properly formed data is entering the workflow of the application, thereby preventing many types of attacks, including type mismatches as mentioned in the question. By validating input data, the application can reject any requests that contain unexpected or malicious data, reducing the risk of security vulnerabilities and ensuring the integrity of the system.
:
Secure SDLC practices emphasize the importance of integrating security activities, such as creating security and functional requirements, code reviews, security testing, architectural analysis, and risk assessment, into the existing development workflow1.
A Secure Software Development Life Cycle (SSDLC) ensures that security is considered at every phase of the development process, from planning and design to coding, testing, deploying, and maintaining the software2.
NEW QUESTION # 17
An individual is developing a software application that has a back-end database and is concerned that a malicious user may run the following SOL query to pull information about all accounts from the database:
Which technique should be used to detect this vulnerability without running the source codes?
- A. Cross-site scripting
- B. Fuzz testing
- C. Dynamic analysis
- D. Static analysis
Answer: D
Explanation:
Static analysis is a method used to detect vulnerabilities in software without executing the code. It involves examining the codebase for patterns that are indicative of security issues, such as SQL injection vulnerabilities. This technique can identify potential threats and weaknesses by analyzing the code's structure, syntax, and data flow.
:
Static analysis as a means to identify security vulnerabilities1.
The importance of static analysis in the early stages of the SDLC to prevent security issues2.
Learning-based approaches to fix SQL injection vulnerabilities using static analysis3.
NEW QUESTION # 18
Which threat modeling step identifies the assets that need to be protected?
- A. Identify and Document Threats
- B. Analyze the Target
- C. Rate Threats
- D. Set the Scope
Answer: D
NEW QUESTION # 19
Which question reflects the security change management component of the change management process?
- A. How critical is the software to meeting the customers' mission?
- B. How is remote administration secured?
- C. What threats are possible in the environment where the software will be operating?
- D. Which security objectives are required by the software?
Answer: B
Explanation:
Option D best addresses security change management, here's why:
* Focus on Change: The question directly asks about a modification to how remote administration is secured. This aligns with the core goal of security change management, which is to evaluate and control the security implications of changes to systems.
* Security-Specific: The question is explicitly concerned with security, not general functionality or requirements.
* Practical Aspect: Remote administration access is a frequent target for attackers, making it a common area for security change management scrutiny.
NEW QUESTION # 20
The product development team is preparing for the production deployment of recent feature enhancements.
One morning, they noticed the amount of test data grew exponentially overnight. Most fields were filled with random characters, but some structured query language was discovered.
Which type of security development lifecycle (SDL) tool was likely being used?
- A. Threat model
- B. Fuzzing
- C. Static analysis
- D. Dynamic analysis
Answer: B
Explanation:
Comprehensive and Detailed In-Depth Explanation:
The scenario described indicates that the system was subjected to inputs containing random data and some structured query language (SQL) statements, leading to an exponential increase in test data. This behavior is characteristic of fuzzing, a testing technique used to identify vulnerabilities by inputting a wide range of random or unexpected data into the system.
Fuzzing aims to discover coding errors and security loopholes by bombarding the application with malformed or unexpected inputs, observing how the system responds. The presence of random characters and SQL statements suggests that the fuzzing tool was testing for vulnerabilities such as SQL injection by injecting various payloads into the system.
This approach is part of the Verification business function in the OWASP SAMM, specifically within the Security Testing practice. Security testing involves evaluating the software to identify vulnerabilities that could be exploited, and fuzzing is a common technique employed in this practice to ensure the robustness and security of the application.
References:
* OWASP SAMM: Verification - Security Testing
NEW QUESTION # 21
Which security assessment deliverable identifies possible security vulnerabilities in the product?
- A. Threat profile
- B. Metrics template
- C. SDL project outline
- D. List of third-party software
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
A Threat profile is a security assessment deliverable that outlines and identifies possible security vulnerabilities and threats relevant to a product. It includes categorization of threats, their potential impact, and vectors through which the product can be attacked. This deliverable is crucial for guiding mitigation and security testing efforts. Metrics templates (B) track progress or measurements, SDL project outline (C) documents phases and tasks in the secure development lifecycle, and the list of third-party software (D) catalogs external dependencies but does not specifically identify vulnerabilities. As per Microsoft SDL and OWASP Threat Modeling, the threat profile is a foundational deliverable in risk assessment and vulnerability identification.
References:
Microsoft Security Development Lifecycle (SDL) Documentation
OWASP Threat Modeling Guide
NIST SP 800-154: Guide to Data-Centric System Threat Modeling
NEW QUESTION # 22
What is an advantage of using the Agile development methodology?
- A. The overall plan fits very neatly into a Gantt chart so a project manager can easily view the project timeline.
- B. There is much less predictability throughout the project regarding deliverables.
- C. Customer satisfaction is improved through rapid and continuous delivery of useful software.
- D. Each stage is clearly defined, making it easier to assign clear roles to teams and departments who feed into the project.
Answer: C
NEW QUESTION # 23
What is a countermeasure to the web application security frame (ASF) authentication threat category?
- A. Credentials and tokens are encrypted.
- B. Sensitive information is scrubbed from error messages
- C. Role-based access controls restrict access
- D. Cookies have expiration timestamps.
Answer: C
Explanation:
* ASF Authentication Threats: The Web Application Security Frame (ASF) authentication category encompasses threats related to how users and systems prove their identity to the application. This includes issues like weak passwords, compromised credentials, and inadequate access controls.
* Role-Based Access Control (RBAC): RBAC is a well-established security principle that aligns closely with addressing authentication threats. It involves assigning users to roles and granting those roles specific permissions based on the principle of least privilege. This limits the attack surface and reduces the impact of a compromised user account.
Let's analyze the other options:
* B. Credentials and tokens are encrypted: While vital for security, encryption primarily protects data at rest or in transit. It doesn't directly address authentication risks like brute-force attacks or weak password management.
* C. Cookies have expiration timestamps: Expiring cookies are a good practice, but their primary benefit is session management rather than directly mitigating authentication-specific threats.
* D. Sensitive information is scrubbed from error messages: While essential for preventing information leakage, this practice doesn't address the core threats within the ASF authentication category.
References:
* NIST Special Publication 800-53 Revision 4, Access Control (AC) Family: (https://csrc.nist.gov
/publications/detail/sp/800-53/rev-4/final) Details the importance of RBAC as a cornerstone of access control.
* The Web Application Security Frame (ASF): (https://patents.google.com/patent/US7818788B2/en) Outlines the ASF categories, with authentication being one of the primary areas.
NEW QUESTION # 24
While performing functional testing of the ordering feature in the new product, a tester noticed that the order object was transmitted to the POST endpoint of the API as a human-readable JSON object.
How should existing security controls be adjusted to prevent this in the future?
- A. Ensure sensitive transactions can be traced through an audit log
- B. Ensure passwords and private information are not logged
- C. Ensure all requests and responses are encrypted
- D. Ensure the contents of authentication cookies are encrypted
Answer: C
Explanation:
Comprehensive and Detailed In-Depth Explanation:
Transmitting data in a human-readable format, such as JSON, over an API can expose sensitive information if the communication channel is not secure. To protect the confidentiality and integrity of the data, it's essential to encrypt all requests and responses between clients and servers.
Implementing encryption, typically through protocols like HTTPS (which utilizes TLS/SSL), ensures that data transmitted over the network is not readable by unauthorized parties. This prevents potential attackers from intercepting and understanding the data, thereby safeguarding sensitive information contained within the API communications.
This practice is a fundamental aspect of secure software development and aligns with the Implementation business function of the OWASP SAMM. Within this function, the Secure Build practice emphasizes the importance of configuring the software to operate securely in its intended environment, which includes enforcing encryption for data in transit.
References:
* OWASP SAMM: Implementation - Secure Build
NEW QUESTION # 25
......
WGU Secure-Software-Design Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
Get New Secure-Software-Design Certification Practice Test Questions Exam Dumps: https://www.lead1pass.com/WGU/Secure-Software-Design-practice-exam-dumps.html
Pass Secure-Software-Design Exam - Real Test Engine PDF with 118 Questions: https://drive.google.com/open?id=1NPGa1eJZCTiw_FoyCTMeiFMKslpbujFE