Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
The software security group is conducting a maturity assessment using the Open Web Application Security Project Software Assurance Maturity Model (OWASP SAMM). They are currently focused on reviewing design artifacts to ensure they comply with organizational security standards.
Which OpenSAMM business function is being assessed?
Comprehensive and Detailed In-Depth Explanation:
The Open Web Application Security Project (OWASP) Software Assurance Maturity Model (SAMM) is a framework designed to help organizations assess and improve their software security posture. SAMM is structured around five primary business functions: Governance, Design, Implementation, Verification, and Operations.
In this scenario, the focus is on reviewing design artifacts to ensure compliance with organizational security standards. This activity aligns with the Verification business function within SAMM. The Verification function encompasses security practices related to assessing and validating the security of software artifacts throughout the development lifecycle. Key practices under this function include:
Design Review: Evaluating design documents and models to identify potential security issues and ensure that security requirements are adequately addressed.
Code Review: Analyzing source code to detect security vulnerabilities and ensure adherence to secure coding standards.
Security Testing: Conducting various testing methodologies, such as penetration testing and vulnerability scanning, to identify and remediate security weaknesses in the software.
By focusing on the Verification function, the organization aims to proactively identify and address security concerns during the design and development phases, thereby enhancing the overall security posture of their software products.
OWASP SAMM - Verification
Recent vulnerability scans discovered that the organization's production web servers were responding to ping requests with server type, version, and operating system, which hackers could leverage to plan attacks.
How should the organization remediate this vulnerability?
To remediate the vulnerability of servers responding to ping requests with sensitive information, the organization should configure the servers to return as little information as possible to network requests. This practice is known as reducing the attack surface. By limiting the amount of information disclosed, potential attackers have less data to use when attempting to exploit vulnerabilities. Regular updates and patching (Option B) are also important, but they do not address the specific issue of information disclosure. Uninstalling or disabling unnecessary features (Option C) and restricting access to configuration files (Option D) are good security practices, but they do not directly prevent the leakage of server information through ping responses.
A new product does not display personally identifiable information, will not let private documents be printed, and requires elevation of privilege to retrieve archive documents. Which secure coding practice is this describing?
The secure coding practice being described is Access Control. This practice ensures that access to data and features within a system is restricted and controlled. The description given indicates that the product has mechanisms to prevent the display of personally identifiable information (PII), restrict the printing of private documents, and require elevated privileges to access archived documents. These are all measures to control who has access to what data and under what circumstances, which is the essence of access control.
ISO/IEC 27018 Code of Practice for Protecting Personal Data in the Cloud1.
NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)2.
ISO/IEC 29151:2017, Code of practice for personally identifiable information protection3.
What are the eight phases of the software development lifecycle (SDLC)?
What are the three primary goals of the secure software development process?
The three primary goals of the secure software development process, often referred to as the CIA triad, are confidentiality, integrity, and availability. These principles form the cornerstone of security considerations in the software development life cycle (SDLC).
Confidentiality ensures that sensitive information is accessed only by authorized individuals and systems. This involves implementing access controls and encryption to protect data from unauthorized access.
Integrity refers to maintaining the accuracy and consistency of data across its lifecycle. This means that the data is not altered or tampered with by unauthorized entities. Techniques like checksums and digital signatures help ensure data integrity.
Availability ensures that information and resources are accessible to authorized users when needed. This involves creating resilient systems that can withstand attacks and recover quickly from any disruptions.
By integrating these security goals into each phase of the SDLC, from planning and design to development, testing, and maintenance, organizations can create more secure software systems that are resilient to cyber threats.
Which secure software design principle assumes attackers have the source code and specifications of the product?
Exam domains verified against: Official WGU Secure-Software-Design exam guide, last checked October 2026.
This module covers topics in designing, analyzing, and managing large scale software systems. Students will learn various architecture types, how to select and implement appropriate design patterns, and how to build well structured, reliable, and secure software systems.
This section of the exam measures skills of Software Architects and covers various architecture types used in large scale software systems. Learners explore different architectural models and frameworks that guide system design decisions. The content addresses how to identify and evaluate architectural patterns that best fit specific project requirements and organizational needs.
This section of the exam measures skills of Software Developers and Software Architects and covers the selection and implementation of appropriate design patterns. Learners examine common design patterns and their applications in software development. The material focuses on understanding when and how to apply specific patterns to solve recurring design problems and improve code organization.
This section of the exam measures skills of Software Architects and covers the design and analysis of large scale software systems. Learners investigate methods for planning complex software architectures that can scale and adapt to changing requirements. The content addresses techniques for creating system designs that accommodate growth and handle increased workload demands.
Sample question from this domain above: Q6
This section of the exam measures skills of Software Project Managers and covers the management of large scale software systems. Learners study approaches for overseeing software projects from conception through deployment. The material focuses on coordination strategies and management techniques that ensure successful delivery of complex software solutions.
This section of the exam measures skills of Software Engineers and Security Architects and covers building well structured, reliable, and secure software systems. Learners explore principles for creating software that performs consistently and protects against security threats. The content addresses methods for implementing reliability measures and security controls throughout the software development lifecycle.
Common questions about the exam itself
