All Obstacles During Secure-Software-Design Exam Preparation with Secure-Software-Design Real Test Questions
Fully Updated Free Actual WGU Secure-Software-Design Exam Questions
NEW QUESTION # 26
Which DREAD category is based on how easily a threat exploit can be found?
- A. Discoverability
- B. Reproducibility
- C. Affected Users
- D. Damage Potential
Answer: A
NEW QUESTION # 27
Which architecture deliverable identifies the organization's tolerance to security issues and how the organization plans to react if a security issue occurs?
- A. Business Requirements
- B. Risk Mitigation Plan
- C. Policy Compliance Analysis
- D. Threat Modeling Artifacts
Answer: B
NEW QUESTION # 28
In which step of the PASTA threat modeling methodology is vulnerability and exploit analysis performed?
- A. Attack modeling
- B. Define objectives
- C. Define technical scope
- D. Application decomposition
Answer: A
Explanation:
In the PASTA (Process for Attack Simulation and Threat Analysis) threat modeling methodology, vulnerability and exploit analysis is performed during the Attack modeling step. This step involves identifying potential threats and vulnerabilities within the system and understanding how they could be exploited.
* Attack modeling is a critical phase where the focus is on simulating attacks based on identified vulnerabilities. It allows for a deep understanding of the threats in the context of the application's architecture and system design.
* During this phase, security analysts use their knowledge of the system's technical scope and application decomposition to simulate how an attacker could exploit the system's vulnerabilities. This helps in prioritizing the risks and planning appropriate mitigation strategies.
* The goal of attack modeling is not just to identify vulnerabilities but also to understand the potential impact of exploits on the system and the business, which is essential for developing a robust security posture.
References: The information provided is aligned with the PASTA methodology as described in resources such as VerSprite1 and the OWASP Foundation2. These sources detail the seven stages of PASTA, with attack modeling being a key component of the process.
NEW QUESTION # 29
What is a countermeasure to the web application security frame (ASF) data validation/parameter validation threat category?
- A. Inputs enforce type, format, length, and range checks.
- B. All exceptions are handled in a structured way.
- C. Sensitive information is not logged.
- D. All administrative activities are logged and audited.
Answer: A
NEW QUESTION # 30
Which threat modeling step collects exploitable weaknesses within the product?
- A. Rate threats
- B. Set the scope
- C. Identify and document threats
- D. Analyze the target
Answer: C
Explanation:
The step in threat modeling that involves collecting exploitable weaknesses within the product is Identify and document threats. This step is crucial as it directly addresses the identification of potential security issues that could be exploited. It involves a detailed examination of the system to uncover vulnerabilities that could be targeted by threats.
References: The OWASP Foundation's Threat Modeling Process outlines a structured approach where identifying and documenting threats is a key step1. Additionally, various sources on threat modeling agree that the identification of threats is a fundamental aspect of the process, as it allows for the subsequent analysis and mitigation of these threats2345.
NEW QUESTION # 31
Which threat modeling approach concentrates on things the organization wants to protect?
- A. Attacker-centric
- B. Application-centric
- C. Server-centric
- D. Asset-centric
Answer: D
Explanation:
The Asset-centric approach to threat modeling focuses on identifying and protecting the assets that are most valuable to an organization. This method prioritizes the assets themselves, assessing their sensitivity, value, and the impact on the business should they be compromised. It is a strategic approach that aims to safeguard the confidentiality, integrity, and availability of the organization's key assets.
References:
* A Review of Asset-Centric Threat Modelling Approaches1.
* Approaches to Threat Modeling - are you getting what you need?2.
* What Is Threat Modeling? - CrowdStrike3.
NEW QUESTION # 32
Security testers have completed testing and are documenting the results of vulnerability scans and penetration analysis They are also creating documentation lo share with the organization's largest customers.
Which deliverable is being prepared?
- A. Security testing reports
- B. Open-source licensing review report
- C. Customer engagement framework
- D. Remediation report
Answer: A
Explanation:
After completing vulnerability scans and penetration analysis, security testers document the results to share with stakeholders, such as the organization's largest customers. The deliverable being prepared in this context is the Security testing reports. These reports typically include detailed findings from the security assessments, explanations of the vulnerabilities discovered, the potential risks they pose, and recommendations for remediation. The purpose of these reports is to provide transparency about the security posture of the software or system and to guide the organization in addressing the identified security issues12. References: 1, 2
https://blog.halosecurity.com/what-really-matters-when-it-comes-to-pentesting-deliverables/
NEW QUESTION # 33
Which type of security analysis is limited by the fact that a significant time investment of a highly skilled team member is required?
- A. Dynamic code analysis
- B. Manual code review
- C. Fuzz testing
- D. Static code analysis
Answer: B
Explanation:
Manual code review is a type of security analysis that requires a significant time investment from a highly skilled team member. This process involves a detailed and thorough examination of the source code to identify security vulnerabilities that automated tools might miss. It is labor-intensive because it relies on the expertise of the reviewer to understand the context, logic, and potential security implications of the code.
Unlike automated methods like static or dynamic code analysis, manual code review demands a deep understanding of the codebase, which can be time-consuming and requires a high level of skill and experience.
References: The information provided here is based on industry best practices and standards for secure software design and development, as well as my understanding of security analysis methodologies12.
NEW QUESTION # 34
Which secure coding best practice says to use a single application-level authorization component that will lock down the application if it cannot access its configuration information?
- A. Communication security
- B. Session management
- C. Data protection
- D. Access control
Answer: D
NEW QUESTION # 35
Which design and development deliverable contains the types of evaluations that were performed, how many times they were performed, and how many times they were re-evaluated?
- A. Security testing reports
- B. Security test execution report
- C. Privacy compliance report
- D. Remediation report
Answer: A
Explanation:
Security testing reports are the most likely deliverables to contain detailed records of evaluations, their frequency, and re-evaluations. Here's why:
* Purpose of Security Testing Reports: These reports document the results of security testing, including:
* Types of tests: Vulnerability scans, penetration tests, code reviews, etc.
* Frequency: How often tests were conducted (e.g., per build, per release cycle).
* Re-evaluations: If vulnerabilities were discovered, these reports will track whether and how often those were retested after remediation.
* Focus on Testing: The question specifically emphasizes evaluations, which aligns with the core content of security testing reports.
NEW QUESTION # 36
What is one of the tour core values of the agile manifesto?
- A. Individuals and interactions over processes and tools
- B. Teams should have a dedicated and open workspace.
- C. Communication between team members
- D. Business people and developers must work together daily throughout the project.
Answer: A
Explanation:
One of the four core values of the Agile Manifesto is prioritizing "individuals and interactions over processes and tools." This value emphasizes the importance of the human element in software development, advocating for direct communication, collaboration, and the flexibility to adapt to change over strict adherence to rigid processes or reliance on specific tools. It recognizes that while processes and tools are important, they should serve the team and the individuals within it, rather than the other way around.
References: The Agile Manifesto itself, along with various interpretations and guides such as those provided by Smartsheet1 and LogRocket2, support this value as one of the central tenets of Agile methodologies. These resources offer insights into how this value, along with the other three, guide the Agile approach to efficient and effective software development.
NEW QUESTION # 37
Which security assessment deliverable defines measures that can be periodically reported to management?
- A. Metrics Template
- B. SDL Project Outline
- C. Product Risk Profile
- D. Threat Profile
Answer: A
NEW QUESTION # 38
Which secure software design principle assumes attackers have the source code and specifications of the product?
- A. Total Mediation
- B. Psychological Acceptability
- C. Separation of Privileges
- D. Open Design
Answer: D
NEW QUESTION # 39
What is a countermeasure to the web application security frame (ASF) authentication threat category?
- A. Credentials and tokens are encrypted.
- B. Role-based access controls restrict access
- C. Sensitive information is scrubbed from error messages
- D. Cookies have expiration timestamps.
Answer: B
Explanation:
* ASF Authentication Threats: The Web Application Security Frame (ASF) authentication category encompasses threats related to how users and systems prove their identity to the application. This includes issues like weak passwords, compromised credentials, and inadequate access controls.
* Role-Based Access Control (RBAC): RBAC is a well-established security principle that aligns closely with addressing authentication threats. It involves assigning users to roles and granting those roles specific permissions based on the principle of least privilege. This limits the attack surface and reduces the impact of a compromised user account.
Let's analyze the other options:
* B. Credentials and tokens are encrypted: While vital for security, encryption primarily protects data at rest or in transit. It doesn't directly address authentication risks like brute-force attacks or weak password management.
* C. Cookies have expiration timestamps: Expiring cookies are a good practice, but their primary benefit is session management rather than directly mitigating authentication-specific threats.
* D. Sensitive information is scrubbed from error messages: While essential for preventing information leakage, this practice doesn't address the core threats within the ASF authentication category.
References:
* NIST Special Publication 800-53 Revision 4, Access Control (AC) Family: (https://csrc.nist.gov
/publications/detail/sp/800-53/rev-4/final) Details the importance of RBAC as a cornerstone of access control.
* The Web Application Security Frame (ASF): (https://patents.google.com/patent/US7818788B2/en) Outlines the ASF categories, with authentication being one of the primary areas.
NEW QUESTION # 40
Which threat modeling step identifies the assets that need to be protected?
- A. Rate Threats
- B. Analyze the Target
- C. Identify and Document Threats
- D. Set the Scope
Answer: D
NEW QUESTION # 41
......
Validate your Secure-Software-Design Exam Preparation with Secure-Software-Design Practice Test: https://passleader.testpassking.com/Secure-Software-Design-exam-testking-pass.html