UPDATED [2025] Pass WGU Secure-Software-Design Exam in First Attempt Guaranteed [Q30-Q47]

NO.30 A recent security review has identified an aging credential recovery/forgotten password component that emails temporary passwords to users who claim to have forgotten their application password.
How should the organization remediate this vulnerability?

NO.31 Which mitigation technique can be used to light against a threat where a user may gain access to administrator level functionality?

NO.32 What is the privacy impact rating of an application that stores personally identifiable information, monitors users with ongoing transfers of anonymous data, and changes settings without notifying the user?

NO.33 What are the three primary goals of the secure software development process?

NO.34 Which secure coding best practice says to only use tested and approved components and use task-specific, built-in APIs to conduct operating system functions?

NO.35 Which type of security analysis is limited by the fact that a significant time investment of a highly skilled team member is required?

NO.36 Which concept is demonstrated when every module in a particular abstraction layer of a computing environment can only access the information and resources that are necessary for its legitimate purpose?

NO.37 Which security assessment deliverable identifies possible security vulnerabilities in the product?

NO.38 What are the eight phases of the software development lifecycle (SDLC)?

NO.39 Which threat modeling methodology involves creating or using collections of similar threats?

NO.40 In which step of the PASTA threat modeling methodology is vulnerability and exploit analysis performed?

NO.41 Which type of threat exists when an attacker can intercept and manipulate form data after the user clicks the save button but before the request is posted to the API?

NO.42 The software security group is conducting a maturity assessment using the Open Web Application Security Project Software Assurance Maturity Model (OWASP OpenSAMM). They are currently focused on reviewing design artifacts to ensure they comply with organizational security standards.
Which OpenSAMM business function is being assessed?

NO.43 Which DREAD category is based on how easily a threat exploit can be found?

NO.44 Due to positive publicity from the release of the new software product, leadership has decided that it is in the best interests of the company to become ISO 27001 compliant. ISO 27001 is the leading international standard focused on information security.
Which security development life cycle deliverable is being described?

NO.45 Senior IT staff has determined that a new product will be hosted in the cloud and will support web and mobile users. Developers will need to deliver secure REST services. Android and IOS mobile apps. and a web application. Developers are currently determining how to deliver each part of the overall product.
Which phase of the software development lifecycle (SDLC) is being described?

NO.46 Which mitigation technique is used to fight against an identity spoofing threat?

NO.47 Automated security testing was performed by attempting to log in to the new product with a known username using a collection of passwords. Access was granted after a few hundred attempts.
How should existing security controls be adjusted to prevent this in the future?