WGU Secure Software Design (D487, KEO1) Exam WGU (D487, KEO1) Secure Software Design Exam Questions

Answer : B

Security testing reports are the deliverables that typically contain detailed results of the security evaluations performed. These reports include the types of tests conducted, such as static and dynamic analysis, penetration testing, and code reviews, as well as the number and types of vulnerabilities discovered. The purpose of these reports is to document the security posture of the software at the time of testing and to provide a basis for remediation efforts.

Answer : D

Answer : C

Security testing reports are the most likely deliverables to contain detailed records of evaluations, their frequency, and re-evaluations. Here's why:

Purpose of Security Testing Reports: These reports document the results of security testing, including:

Types of tests: Vulnerability scans, penetration tests, code reviews, etc.

Frequency: How often tests were conducted (e.g., per build, per release cycle).

Re-evaluations: If vulnerabilities were discovered, these reports will track whether and how often those were retested after remediation.

Focus on Testing: The question specifically emphasizes evaluations, which aligns with the core content of security testing reports.

Answer : A

Comprehensive and Detailed Explanation From Exact Extract:

The Iterative software development model fits this description. It involves specifying and implementing a portion of the software, reviewing it, gathering feedback, and refining or adding requirements in successive cycles. This approach supports evolving requirements and continuous improvement. Iterative models contrast with Waterfall (C), which is linear and sequential, with no repetition of phases. ''Code and fix'' (D) is an informal, ad hoc process lacking formal review cycles. Implementation (B) is a phase, not a model. The iterative approach is advocated in ISO/IEC 12207 and NIST guidelines for secure development, as it allows early detection and remediation of security issues by incremental design and testing.

ISO/IEC 12207 Software Lifecycle Processes

NIST SP 800-64 Revision 2: Security Considerations in SDLC

Microsoft SDL Documentation

Answer : B

Bucket requirements are ongoing requirements that do not need to be addressed every sprint but must be completed before project completion. Identifying primary security and privacy contacts is a bucket requirement because it is a one-time, essential task that supports security governance throughout the project lifecycle. Every-sprint requirements (D) are repeated tasks for each sprint, one-time requirements (C) are tasks performed once usually early in the project, and final security review (B) occurs at project end. Agile SDL adaptation recommendations by Microsoft SDL and OWASP emphasize categorizing security tasks to fit iterative delivery, with bucket requirements ensuring important but non-iterative activities are not overlooked.

Microsoft SDL Agile Adaptation Guidelines

OWASP Secure SDLC in Agile

NIST SP 800-64: Security Considerations in Agile Development

Answer : A

Fuzzing is an automated or semi-automated software testing technique that involves providing invalid, unexpected, or random data to the inputs of a computer program1. This process is designed to uncover coding errors, security vulnerabilities, and other potential issues within the software by observing how it behaves under unexpected or malformed inputs. Fuzzing is particularly effective because it can expose corner cases that have not been properly dealt with and can be used to test programs that take structured inputs, such as file formats or protocols2.

Answer : A