[Nov 18, 2025] Latest Secure-Software-Design Exam with Accurate WGUSecure Software Design (KEO1) Exam PDF Questions
Practice To Secure-Software-Design - Actual4dump Remarkable Practice On your WGUSecure Software Design (KEO1) Exam Exam
NEW QUESTION # 12
Which type of threat exists when an attacker can intercept and manipulate form data after the user clicks the save button but before the request is posted to the API?
- A. Spoofing
- B. Information disclosure
- C. Tampering
- D. Elevation of privilege
Answer: C
NEW QUESTION # 13
The security team is reviewing all noncommercial software libraries used in the new product to ensure they are being used according to the legal specifications defined by the authors.
What activity of the Ship SDL phase is being performed?
- A. Penetration testing
- B. Open-source licensing review
- C. Policy compliance analysis
- D. Final security review
Answer: B
Explanation:
The activity described pertains to the review of noncommercial software libraries to ensure compliance with the legal specifications set by the authors. This is part of the open-source licensing review, which is a critical activity in the Ship phase of the Security Development Lifecycle (SDL). This review ensures that all open-source components are used in accordance with their licenses, which is essential for legal and security compliance.
References: The Ship phase of the SDL includes various activities such as policy compliance review, vulnerability scanning, penetration testing, open-source licensingreview, and final security and privacy reviews12. The open-source licensing review specifically addresses the legal aspects of using third-party software components2.
NEW QUESTION # 14
Company leadership has contracted with a security firm to evaluate the vulnerabilityofall externally lacing enterprise applications via automated and manual system interactions. Which security testing technique is being used?
- A. Properly-based-testing
- B. Penetration testing
- C. Source-code analysis
- D. Source-code fault injection
Answer: B
Explanation:
The security testing technique that involves evaluating the vulnerability of all externally facing enterprise applications through both automated and manual system interactions is known as Penetration Testing. This method simulates real-world attacks on systems to identify potential vulnerabilities that could be exploited by attackers. It is a proactive approach to discover security weaknesses before they can be exploited in a real attack scenario. Penetration testing can include a variety of methods such as network scanning, application testing, and social engineering tactics to ensure a comprehensive security evaluation.
References: The concept of Penetration Testing as a method for evaluating vulnerabilities aligns with industry standards and practices, as detailed in resources from security-focused organizations and literature1.
NEW QUESTION # 15
Which secure software design principle assumes attackers have the source code and specifications of the product?
- A. Psychological Acceptability
- B. Total Mediation
- C. Open Design
- D. Separation of Privileges
Answer: C
NEW QUESTION # 16
What is the last slop of the SDLOSDL code review process?
- A. Identify security code review objectives
- B. Review for security issues unique to the architecture
- C. Perform preliminary scan
- D. Review code for security issues
Answer: D
Explanation:
The last step of the SDLC code review process is to review the code for security issues. This involves a detailed examination of the code to identify any potential security vulnerabilities that could be exploited. It's a critical phase where the focus is on ensuring that the code adheres to security best practices and does not contain any flaws that could compromise the security of the application or system. The process typically includes manual inspection as well as automated tools to scan for common security issues. The goal is to ensure that the software is as secure as possible before it is deployed. References: Mastering the Code Review Process, Understanding the SDLC, How Code Reviews Improve Software Quality in SDLC - LinkedIn.
NEW QUESTION # 17
Which secure coding practice uses role-based authentication where department-specific credentials will authorize department-specific functionality?
- A. Access Control
- B. Data Protection
- C. Input Validation
- D. Authentication
Answer: A
NEW QUESTION # 18
Which type of security analysis is performed by injecting malformed data into open interfaces of an executable or running application and is most commonly executed during the testing or deployment phases of the SDLC?
- A. Fuzz Testing
- B. Dynamic Analysis
- C. Static Analysis
- D. Manual Code Review
Answer: A
NEW QUESTION # 19
Using a web-based common vulnerability scoring system (CVSS) calculator, a security response team member performed an assessment on a reported vulnerability in the company's claims intake component. The base score of the vulnerability was 3.5 and changed to 5.9 after adjusting temporal and environmental metrics.
Which rating would CVSS assign this vulnerability?
- A. Low severity
- B. Medium severity
- C. Critical severity
- D. High severity
Answer: D
Explanation:
The Common Vulnerability Scoring System (CVSS) uses the following ranges to determine the severity rating of a vulnerability:
* 0.1 - 3.9: Low severity
* 4.0 - 6.9: Medium severity
* 7.0 - 8.9: High severity
* 9.0 - 10.0: Critical severity
Since the adjusted score for the vulnerability is 5.9, it falls within the High severity range.
References:
CVSS v3.1 Specification Document - FIRST: https://www.first.org/cvss/specification-document National Vulnerability Database (NVD) - NIST: https://nvd.nist.gov/vuln-metrics/cvss
NEW QUESTION # 20
Due to positive publicity from the release of the new software product, leadership has decided that it is in the best interests of the company to become ISO 27001 compliant. ISO 27001 is the leading international standard focused on information security.
Which security development life cycle deliverable is being described?
- A. External vulnerability disclosure response process
- B. Post-release certifications
- C. Security strategy for M&A products
- D. Third-party security review
Answer: B
NEW QUESTION # 21
Which SDL security goal is defined as ensuring timely and reliable access to and use of information?
- A. Availability
- B. Information security
- C. Integrity
- D. Confidentiality
Answer: A
Explanation:
The term 'availability' in the context of Secure Software Development Lifecycle (SDL) refers to ensuring that systems, applications, and data are accessible to authorized users when needed. This means that the information must be timely and reliable, without undue delays or interruptions. Availability is a critical aspect of security, as it ensures that the software functions correctly and efficiently, providing users with the information they need to perform their tasks.
:
The definition of availability as per the National Institute of Standards and Technology (NIST) Glossary1.
The Microsoft Security Development Lifecycle (SDL) which emphasizes the importance of availability in secure software design2.
General principles of Secure Software Development Life Cycle (SSDLC) that include availability as a key security goal3.
NEW QUESTION # 22
Which security assessment deliverable identities unmanaged code that must be kept up to date throughout the life of the product?
- A. Threat profile
- B. List of third-party software
- C. Product risk profile
- D. Metrics template
Answer: B
Explanation:
The security assessment deliverable that identifies unmanaged code that must be kept up to date throughout the life of the product is the List of third-party software. Unmanaged code refers to code that does not run under the garbage-collected environment of the .NET Common Language Runtime, and it often includes legacy code, system libraries, or code written in languages that do not support automatic memory management. Keeping a list of third-party software is crucial because it helps organizations track dependencies and ensure they are updated, patched, and compliant with security standards. This is essential for maintaining the security posture of the software over time, as outdated components can introduce vulnerabilities.
References: The references provided from the web search results support the importance of monitoring and updating software components, including unmanaged code, as part of a secure software development lifecycle12.
NEW QUESTION # 23
Which category classifies identified threats that do not have defenses in place and expose the application to exploits?
- A. Threat profile
- B. Fully mitigated threat
- C. Partially mitigated threat
- D. Unmitigated threats
Answer: D
Explanation:
The category that classifies identified threats with no defenses in place, exposing the application to exploits, is Unmitigated Threats. This term refers to vulnerabilities for which no countermeasures or mitigations have been implemented. These threats are critical because they represent actual weaknesses that attackers can exploit. In the context of secure software design, it's essential to identify these threats early in the SDLC to ensure that appropriate security controls can be designed and implemented to protect against them.
References:
* Taxonomy of Cyber Threats to Application Security and Applicable Defenses1.
* OWASP Foundation's Threat Modeling Process2.
* Mitigating Persistent Application Security Threats3.
NEW QUESTION # 24
Which secure coding best practice says to use well-vetted algorithms to ensure that the application uses random identifiers, that identifiers are appropriately restricted to the application, and that user processes are fully terminated on logout?
- A. Output Encoding
- B. Access Control
- C. Input Validation
- D. Session Management
Answer: D
NEW QUESTION # 25
Which architecture deliverable identifies the organization's tolerance to security issues and how the organization plans to react if a security issue occurs?
- A. Policy Compliance Analysis
- B. Risk Mitigation Plan
- C. Business Requirements
- D. Threat Modeling Artifacts
Answer: B
NEW QUESTION # 26
Which threat modeling step collects exploitable weaknesses within the product?
- A. Rate threats
- B. Set the scope
- C. Identify and document threats
- D. Analyze the target
Answer: C
Explanation:
The step in threat modeling that involves collecting exploitable weaknesses within the product is Identify and document threats. This step is crucial as it directly addresses the identification of potential security issues that could be exploited. It involves a detailed examination of the system to uncover vulnerabilities that could be targeted by threats.
References: The OWASP Foundation's Threat Modeling Process outlines a structured approach where identifying and documenting threats is a key step1. Additionally, various sources on threat modeling agree that the identification of threats is a fundamental aspect of the process, as it allows for the subsequent analysis and mitigation of these threats2345.
NEW QUESTION # 27
In which step of the PASTA threat modeling methodology will the team capture infrastructure, application, and software dependencies?
- A. Attack modeling
- B. Define technical scope
- C. Define objectives
- D. Risk and impact analysis
Answer: B
Explanation:
The step of the PASTA threat modeling methodology where the team will capture infrastructure, application, and software dependencies is the Define technical scope step. This step involves detailing the technical elements of the project, which includes understanding and documenting the infrastructure, applications, and software dependencies that are critical to the system's operation and security.
References: The PASTA (Process for Attack Simulation and Threat Analysis) threat modeling methodology is a seven-step process that includes defining the technical scope as a critical step for capturing the necessary technical details of the system being analyzed123.
NEW QUESTION # 28
The security software team has cloned the source code repository of the new software product so they can perform vulnerability testing by modifying or adding small snippets of code to see if they can cause unexpected behavior and application failure.
Which security testing technique is being used?
- A. Source-Code Fault Injection
- B. Dynamic Code Analysis
- C. Binary Fault Injection
- D. Fuzz Testing
Answer: A
NEW QUESTION # 29
The organization has contracted with an outside firm to simulate an attack on the new software product and report findings and remediation recommendations.
Which activity of the Ship SDL phase is being performed?
- A. Penetration testing
- B. Policy compliance analysis
- C. Final security review
- D. Open-source licensing review
Answer: A
Explanation:
Penetration testing is an activity where a simulated attack is performed on a software product to identify vulnerabilities that could be exploited by attackers. It is a proactive and authorized attempt to evaluate the security of an IT infrastructure by safely trying to exploit system vulnerabilities, including OS, service and application flaws, improper configurations, and risky end-user behavior. In the context of the Ship phase of the Security Development Lifecycle (SDL), penetration testing is conducted as a final check to uncover any potential security issues that might have been missed during previous phases. This ensures that the software product is robust and secure before it is released.
References:
* The Ship phase of the SDL includes activities such as policy compliance review, vulnerability scanning, penetration testing, open-source licensing review, and final security and privacy reviews1.
* Penetration testing is a critical component of the Ship phase, as it helps to identify and fix security vulnerabilities before the software is deployed2.
NEW QUESTION # 30
The security testing team received a report from one of the contracted penetration testing vendors that details a flaw discovered in the login component of the new software product, along with a recommended fix.
Which phase of the penetration testing process is the team in?
- A. Identify
- B. Evaluate and plan
- C. Deploy
- D. Assess
Answer: D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
The team is in the Assess phase of penetration testing. This phase involves actively testing the software, identifying vulnerabilities, and documenting findings with recommendations. Receiving a report detailing a discovered flaw confirms that testing has been conducted and results are being evaluated. The Identify (A) phase involves defining scope and targets, Evaluate and Plan (B) covers planning test activities, and Deploy (C) refers to executing the test environment setup. The OWASP Penetration Testing Guide and NIST SP 800-
115 clarify that assessment includes vulnerability discovery and documentation.
References:
OWASP Penetration Testing Guide
NIST SP 800-115 Technical Guide to Information Security Testing and Assessment Microsoft SDL Security Testing Guidance
NEW QUESTION # 31
Which security assessment deliverable identities unmanaged code that must be kept up to date throughout the life of the product?
- A. Threat profile
- B. List of third-party software
- C. Product risk profile
- D. Metrics template
Answer: B
Explanation:
The security assessment deliverable that identifies unmanaged code that must be kept up to date throughout the life of the product is the List of third-party software. Unmanaged code refers to code that does not run under the garbage-collected environment of the .NET Common Language Runtime, and it often includes legacy code, system libraries, or code written in languages that do not support automatic memory management. Keeping a list of third-party software is crucial because it helps organizations track dependencies and ensure they are updated, patched, and compliant with security standards. This is essential for maintaining the security posture of the software over time, as outdated components can introduce vulnerabilities.
: The references provided from the web search results support the importance of monitoring and updating software components, including unmanaged code, as part of a secure software development lifecycle12.
NEW QUESTION # 32
What refers to the review of software source code by developers other than the original coders to try to identify oversights, mistakes, assumptions, a lack of knowledge, or even experience?
- A. Manual peer review
- B. Dynamic code review
- C. User acceptance testing
- D. Fault injection
Answer: A
Explanation:
Manual peer review refers to the systematic examination of software source code by developers other than the original author. This practice is recognized as a valuable tool for reducing software defects and improving the quality of software projects. It involves developers inspecting the code to find and fix mistakes overlooked in the initial development phase, which enhances both the overall quality of software and the developers' skills.
Peer code review is less formal and more "lightweight" than the code inspections performed in the past, and it provides benefits such as knowledge transfer, increased team awareness, and creation of alternative solutions to problems.
:
Expectations, Outcomes, and Challenges Of Modern Code Review1
Introduction to Software Engineering/Quality/Code Review2
Software Security during Modern Code Review: The Developer's Perspective3
NEW QUESTION # 33
......
Exam Questions and Answers for Secure-Software-Design Study Guide Questions and Answers!: https://examsforall.actual4dump.com/WGU/Secure-Software-Design-actualtests-dumps.html