- | Page
WGU D487 OA WITH 80 QUESTIONS AND
CORRECT ANSWER S (100% CORRECT
VERIFIED ANSWERS) D487 SECURE SOFTWARE
DESIGN OBJECTIVE ASSESSMENT
Building Security In Maturity Model (BSIMM)
Correct answer: A study of real-world software security
initiatives organized so that you can determine where you stand with your software security initiative and how to evolve your efforts over time
SAMM
Correct answer: Offers a roadmap and a well-defined maturity
model for secure software development and deployment, along with useful tools for self-assessment and planning.
Core OpenSAMM activities
Correct answer: Governance, Construction, Verification,
Deployment
Static analysis
Correct answer: Source code of an application is reviewed
manually or with automatic tools without running the code
- | Page
Dynamic analysis
Correct answer: Analysis and testing of a program occurs while
it is being executed or run
Fuzzing
Correct answer: Injection of randomized data into a software
program in an attempt to find system failures, memory leaks, error handling issues, and improper input validation
OWASP ZAP
Correct answer: -Open-source web application security scanner
-Can be used as a proxy to manipulate traffic running through it (even https)
ISO/IEC 27001
Correct answer: Specifies requirements for establishing,
implementing, operating, monitoring, reviewing, maintaining and improving a documented information security management system
- | Page
ISO/IEC 17799
Correct answer: ISO/EIC is a joint committee that develops and
maintains standards in the IT industry. It is an international code of practice for information security management. This section defines confidentiality, integrity, and availability controls.
ISO/IEC 27034
Correct answer: A standard that provides guidance to help
organizations embed security within their processes that help secure applications running in the environment, including application lifecycle processes
Software security champion
Correct answer: A developer with an interest in security who
helps amplify the security message at the team level
Waterfall methodology
Correct answer: A sequential, activity-based process in which
each phase in the SDLC is performed sequentially from planning through implementation and maintenance
Agile Development
- | Page
Correct answer: A software development methodology that
delivers functionality in rapid iterations, measured in weeks, requiring frequent communication, development, testing, and delivery.
Scrum
Correct answer: An agile project management framework that
helps teams structure and manage their work through a set of values, principles, and practices
Daily scrum
Correct answer: Daily time-boxed event of 15 minutes, or less,
for the Development Team to re-plan the next day of development work during a Sprint. Updates are reflected in the Sprint Backlog.
Sprint review
Correct answer: A meeting that occurs after each sprint to show
the product or process to stakeholders for approval and to receive feedback.
Sprint retrospective