Secure-Software-Design by WGU Actual Free Exam Q&As

Question 1

While performing functional testing of the ordering feature in the new product, a tester noticed that the order object was transmitted to the POST endpoint of the API as a human-readable JSON object.
How should existing security controls be adjusted to prevent this in the future?

A. Ensure all requests and responses are encrypted B. Ensure the contents of authentication cookies are encrypted C. Ensure sensitive transactions can be traced through an audit log D. Ensure passwords and private information are not logged

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 2

An individual is developing a software application that has a back-end database and is concerned that a malicious user may run the following SOL query to pull information about all accounts from the database:

Which technique should be used to detect this vulnerability without running the source codes?

A. Dynamic analysis B. Static analysis C. Cross-site scripting D. Fuzz testing

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 3

What is one of the tour core values of the agile manifesto?

A. Business people and developers must work together daily throughout the project. B. Teams should have a dedicated and open workspace. C. Individuals and interactions over processes and tools D. Communication between team members

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 4

A security architect is creating a data flow diagram and draws an arrow between two circles.
What does the arrow represent?

A. Data Store B. External Entity C. Data Flow D. Process

Discussion 0

Correct Answer: C Vote an answer

Question 5

Credit card numbers are encrypted when stored in the database but are automatically decrypted when data is fetched. The testing tool intercepted the GET response, and testers were able to view credit card numbers as clear text.
How should the organization remediate this vulnerability?

A. Ensure all data in transit is encrypted B. Ensure there is an audit trail for all sensitive transactions C. Enforce role-based authorization controls in all application layers D. Never cache sensitive data

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 6

Which type of manual code review technique is being used when the reviewer starts at an input control and traces its value through the application to each of the value's outputs?

A. Threat analysis B. Risk analysis C. Data flow analysis D. Control flow analysis

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 7

Which privacy impact statement requirement type defines how personal information will be protected when authorized or independent external entities are involved?

A. Personal information retention requirements B. Third party requirements C. Data integrity requirements D. User controls requirements

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

WGUSecure Software Design (KEO1) - Secure-Software-Design Exam Practice Test