D487 Secure Software Design
Access The Exact Questions for D487 Secure Software Design
💯 100% Pass Rate guaranteed
🗓️ Unlock for 1 Month
Rated 4.8/5 from over 1000+ reviews
- Unlimited Exact Practice Test Questions
- Trusted By 200 Million Students and Professors
What’s Included:
- Unlock Actual Exam Questions and Answers for D487 Secure Software Design on monthly basis
- Well-structured questions covering all topics, accompanied by organized images.
- Learn from mistakes with detailed answer explanations.
- Easy To understand explanations for all students.
Free D487 Secure Software Design Questions
Which DREAD category has a risk rating based on the threat exploit’s potential level of harm?
-
Damage potential
-
Affected users
-
Exploitability
-
Reproducibility
Explanation
Explanation:
Correct answer: Damage potential
The DREAD risk model is used to evaluate security threats based on several categories. The category that measures the potential severity or impact of an exploit—meaning how much damage it could cause if successfully carried out—is Damage potential. This focuses on the level of harm to systems, data, or users. The other options refer to different aspects: affected users measures how many users are impacted, exploitability measures how easy it is to carry out the attack, and reproducibility measures how consistently the exploit can be repeated.
A software security team recently completed an internal assessment of the company's security assurance program. The team delivered a set of scorecards to leadership and changes designed to improve low-scoring governance, development, and deployment functions. Which software security maturity model did the team use
-
International Organization for Standardization ISO/IEC 27034
-
S. Department of Homeland Security Software Assurance Program
-
Building Security In Maturity Model (BSIMM)
-
Open Web Application Security Project (OWASP) Open Software Assurance Maturity Model (SAMM)
Explanation
Correct Answer:
d) Open Web Application Security Project (OWASP) Open Software Assurance Maturity Model (SAMM)
Explanation:
The OWASP Open Software Assurance Maturity Model (SAMM) is designed to assess and improve an organization's software assurance program. It uses scorecards to measure and track progress across various security domains, including governance, development, and deployment, which aligns with the situation described.
Why other options are wrong:
a) International Organization for Standardization ISO/IEC 27034: This standard focuses on the integration of security in software development but is not structured in terms of maturity assessments using scorecards.
b) U.S. Department of Homeland Security Software Assurance Program: This program provides guidance for secure software development but does not use scorecards in the same way as SAMM.
c) Building Security In Maturity Model (BSIMM): BSIMM is an industry framework to assess the maturity of software security initiatives but focuses more on practices rather than the specific scoring and improvement approach used in SAMM.
Senior IT staff has determined that a new product will be hosted in the cloud and will support web and mobile users. Developers will need to deliver secure REST services, Android and iOS mobile apps, and a web application. Developers are currently determining how to deliver each part of the overall product. Which phase of the software development lifecycle (SDLC) is being described?
-
Design
-
Deployment
-
Maintenance
-
End of life
Explanation
Explanation
Correct answer: Design
This scenario describes the SDLC design phase, where developers and architects determine how the system will be built based on already defined requirements. At this stage, decisions are made about system architecture, technologies, components, and how different parts of the solution (such as REST services, mobile applications, and web applications) will be implemented. Since the team is focusing on how to deliver each part of the product rather than deploying, maintaining, or retiring it, this clearly aligns with system design activities.
Using a web-based Common Vulnerability Scoring System (CVSS) calculator, a security response team member performed an assessment on a reported vulnerability in the company's claims intake component. The base score of the vulnerability was 3.5 and changed to 5.9 after adjusting temporal and environmental metrics. Which rating would CVSS assign this vulnerability?
-
Low severity
-
Medium severity
-
High severity
-
Critical severity
Explanation
Explanation:
Correct answer: Medium severity
CVSS severity ratings are determined using the final adjusted score. A score of 5.9 falls within the Medium severity range (4.0–6.9). This indicates a moderate risk vulnerability that should be addressed but is not immediately critical or high urgency compared to higher-scoring issues.
Which secure coding practice involves clearing all local storage as soon as a user logs off for the night and automatically logging a user out after an hour of inactivity?
-
Communication security
-
Access control
-
System configuration
-
Session management
Explanation
Explanation:
Correct answer: Session management
The scenario describes handling and controlling user sessions, including clearing local storage upon logout and automatically logging users out after a period of inactivity. These actions are part of session management, which focuses on securely creating, maintaining, and terminating user sessions to prevent unauthorized access and session hijacking. The other options do not fit: communication security focuses on protecting data in transit, access control governs permissions and authorization, and system configuration relates to system settings and environment setup.
Which privacy impact statement requirement type defines processes to keep personal information updated and accurate
-
Data integrity requirements
-
Collection of personal information requirements
-
Access requirements
-
Personal information retention requirements
Explanation
Correct Answer:
a) Data integrity requirements
Explanation:
Data integrity requirements define the processes necessary to ensure that personal information remains accurate, complete, and up to date. These requirements are critical for maintaining the quality and accuracy of personal data over time.
Why other options are wrong:
b) Collection of personal information requirements: These pertain to how personal information is gathered and consented to but not how it should be kept updated.
c) Access requirements: These focus on who can access the personal information and under what circumstances, not on its accuracy.
d) Personal information retention requirements: These pertain to how long personal information should be kept, not on ensuring it is accurate or up to date.
Company leadership has discovered an untapped revenue stream within its customer base and wants to meet with IT to share its vision for the future and determine whether to move forward. Which phase of the software development lifecycle (SDLC) is being described?
-
Requirements
-
Implementation
-
Planning
-
Design
Explanation
Explanation
Correct answer: Planning
This scenario describes the early stage of the SDLC where business leadership is identifying opportunities, sharing high-level vision, and working with IT to evaluate feasibility before committing resources. This aligns with the planning phase, which focuses on defining objectives, assessing business value, and determining whether a proposed initiative should proceed into more detailed requirements and design work. It is not yet at the requirements or design stage because no detailed specifications or system structures are being defined.
What is a countermeasure to the web application security frame (ASF) data validation/parameter validation threat category
-
All administrative activities are logged and audited
-
Sensitive information is not logged
-
All exceptions are handled in a structured way
-
Inputs enforce type, format, length, and range checks
Explanation
Correct Answer:
d) Inputs enforce type, format, length, and range checks
Explanation:
The data validation/parameter validation threat category involves ensuring that inputs to a web application are properly validated to prevent malicious data from being processed. By enforcing type, format, length, and range checks on inputs, the application ensures that only valid data is accepted and reduces the risk of attacks such as SQL injection or buffer overflows.
Why other options are wrong:
a) All administrative activities are logged and audited: This is a good security practice for tracking and monitoring activities, but it is not directly related to data validation or parameter validation.
b) Sensitive information is not logged: While this is important for protecting sensitive data, it doesn't address the validation of user inputs.
c) All exceptions are handled in a structured way: Handling exceptions properly is important for application stability and security, but it is not specifically related to validating user inputs for correctness or security.
After every other security analysis technique has been used, what kind of security analysis involves going over the source code line by line?
-
Static analysis
-
Fuzz testing
-
Manual code review
-
Dynamic analysis
Explanation
Correct Answer:
c) Manual code review
Explanation:
Manual code review involves security experts reviewing the source code line-by-line to identify potential vulnerabilities. It is usually performed after other automated security analysis techniques have been completed to ensure thorough inspection. This process is essential for finding logic errors, security flaws, and issues that automated tools may miss.
The software security team prepared a detailed schedule mapping security development lifecycle phase to the type of analysis they will execute. Which design and development deliverable did the team prepare?
-
Privacy implementation assessment results
-
Security test plans
-
Design security review
-
Updated threat modeling artifacts
Explanation
Explanation:
Correct answer: Security test plans
A document that maps Security Development Lifecycle (SDL) phases to the specific types of analysis or testing that will be performed is a security test plan. Security test plans define what security activities will occur, when they will occur, and how they align with development phases such as design, implementation, and testing. The other options do not match: privacy implementation assessment results are outcomes of privacy evaluations, design security review is a specific evaluation activity rather than a schedule, and updated threat modeling artifacts are outputs of threat modeling rather than a lifecycle planning schedule.
How to Order
Select Your Exam
Click on your desired exam to open its dedicated page with resources like practice questions, flashcards, and study guides.Choose what to focus on, Your selected exam is saved for quick access Once you log in.
Subscribe
Hit the Subscribe button on the platform. With your subscription, you will enjoy unlimited access to all practice questions and resources for a full 1-month period. After the month has elapsed, you can choose to resubscribe to continue benefiting from our comprehensive exam preparation tools and resources.
Pay and unlock the practice Questions
Once your payment is processed, you’ll immediately unlock access to all practice questions tailored to your selected exam for 1 month .
Frequently Asked Question
The course focuses on secure coding principles, software vulnerabilities, authentication mechanisms, cryptography, and best practices for designing secure applications.
Secure software design helps prevent cyber threats such as SQL Injection, Cross-Site Scripting (XSS), authentication bypasses, and data breaches, ensuring application security and compliance with industry standards.
The course covers vulnerabilities like SQL Injection, XSS, Cross-Site Request Forgery (CSRF), insecure authentication, weak cryptography, and improper error handling.
Using prepared statements and parameterized queries is the most effective method to prevent SQL Injection, as it ensures user input is treated strictly as data, not executable code.
XSS occurs when an attacker injects malicious scripts into web pages viewed by users. It can be prevented by sanitizing and encoding user input, using a Content Security Policy (CSP), and avoiding innerHTML in JavaScript.
MFA requires users to verify their identity using multiple factors (e.g., password + one-time code). It significantly enhances security by preventing unauthorized access, even if a password is compromised.
Authentication verifies a user’s identity (e.g., username and password). Authorization determines what actions or data a user is allowed to access after authentication.