WGU D385 SOFTWARE SECURITY AND
TESTING 2025/2026 | Complete Exam
Review, Verified Questions & Answers with
Detailed Rationales | A+ Success Pack
, Comprehensive Coverage:
✓ HTTP Status Codes & Headers
✓ Security Vulnerabilities & Attacks
✓ Defensive Programming Techniques
✓ Code Examples & Solutions
✓ Encryption & Authentication
✓ Testing & Debugging Methods
✓ OA-Specific Code Patterns
,Table of Contents
Table of Contents ............................................................................................................................ 3
SECTION 1: HTTP STATUS CODES & HEADERS ................................................................... 7
HTTP Status Codes - Quick Reference ...................................................................................... 7
2xx - Success Codes................................................................................................................ 7
4xx - Client Error Codes ......................................................................................................... 7
5xx - Server Error Codes ........................................................................................................ 8
HTTP Headers - Essential Reference ......................................................................................... 9
SECTION 2: SECURITY VULNERABILITIES & ATTACKS ................................................. 10
Injection Attacks ....................................................................................................................... 10
SQL Injection ........................................................................................................................ 10
Command Injection............................................................................................................... 10
Log Injection ......................................................................................................................... 10
Cross-Site Scripting (XSS) ....................................................................................................... 12
Types of XSS ........................................................................................................................ 12
Cross-Site Request Forgery (CSRF) ......................................................................................... 13
Access Control Vulnerabilities ................................................................................................. 13
Broken Access Control ......................................................................................................... 13
Broken Object Level Authorization (BOLA) ....................................................................... 13
Privilege Escalation .............................................................................................................. 13
Other Critical Vulnerabilities .................................................................................................... 14
Insecure Deserialization ........................................................................................................ 14
Man-in-the-Middle (MITM) ................................................................................................. 14
Denial of Service (DoS) ........................................................................................................ 14
Server-Side Request Forgery (SSRF) ................................................................................... 14
Other Vulnerabilities............................................................................................................. 15
SECTION 3: DEFENSIVE PROGRAMMING & INPUT VALIDATION................................. 16
Core Principles of Defensive Programming ............................................................................. 16
Common Defensive Coding Techniques .................................................................................. 16
Input Validation Types ............................................................................................................. 16
Type Check ........................................................................................................................... 16
Range Check ......................................................................................................................... 16
Length Check ........................................................................................................................ 16
, Null Check ............................................................................................................................ 16
Validation Strategies ............................................................................................................. 16
Assertions .................................................................................................................................. 17
Categories of Assertions ....................................................................................................... 17
Error Handling Strategies ......................................................................................................... 17
SECTION 4: CRYPTOGRAPHY & AUTHENTICATION ........................................................ 18
Hashing ..................................................................................................................................... 18
Hash Algorithm Requirements ............................................................................................. 18
Safe Hash Algorithms ........................................................................................................... 18
Unsafe Hash Algorithms ....................................................................................................... 18
Salting ................................................................................................................................... 18
Password Hashing Functions ................................................................................................ 18
HMAC (Hash-based Message Authentication Code) ........................................................... 18
Encryption ................................................................................................................................. 19
Symmetric Encryption .......................................................................................................... 19
AES Encryption Modes ........................................................................................................ 19
Initialization Vector (IV) ...................................................................................................... 19
Asymmetric Encryption ........................................................................................................ 19
Digital Signatures.................................................................................................................. 19
TLS and Network Security ....................................................................................................... 20
TLS (Transport Layer Security)............................................................................................ 20
X.509 Certificates ................................................................................................................. 20
Authentication & Authorization ............................................................................................... 20
Token-Based Authentication ................................................................................................ 20
OAuth .................................................................................................................................... 20
MSAL (Microsoft Authentication Library) .......................................................................... 20
Token Management .............................................................................................................. 20
Session Management ............................................................................................................ 20
Secure Cookie Attributes ...................................................................................................... 21
CORS (Cross-Origin Resource Sharing) .............................................................................. 21
SECTION 5: TESTING & DEBUGGING ................................................................................... 22
Testing Methods........................................................................................................................ 22
Static Testing (SAST) ........................................................................................................... 22
Dynamic Testing (DAST) ..................................................................................................... 22
TESTING 2025/2026 | Complete Exam
Review, Verified Questions & Answers with
Detailed Rationales | A+ Success Pack
, Comprehensive Coverage:
✓ HTTP Status Codes & Headers
✓ Security Vulnerabilities & Attacks
✓ Defensive Programming Techniques
✓ Code Examples & Solutions
✓ Encryption & Authentication
✓ Testing & Debugging Methods
✓ OA-Specific Code Patterns
,Table of Contents
Table of Contents ............................................................................................................................ 3
SECTION 1: HTTP STATUS CODES & HEADERS ................................................................... 7
HTTP Status Codes - Quick Reference ...................................................................................... 7
2xx - Success Codes................................................................................................................ 7
4xx - Client Error Codes ......................................................................................................... 7
5xx - Server Error Codes ........................................................................................................ 8
HTTP Headers - Essential Reference ......................................................................................... 9
SECTION 2: SECURITY VULNERABILITIES & ATTACKS ................................................. 10
Injection Attacks ....................................................................................................................... 10
SQL Injection ........................................................................................................................ 10
Command Injection............................................................................................................... 10
Log Injection ......................................................................................................................... 10
Cross-Site Scripting (XSS) ....................................................................................................... 12
Types of XSS ........................................................................................................................ 12
Cross-Site Request Forgery (CSRF) ......................................................................................... 13
Access Control Vulnerabilities ................................................................................................. 13
Broken Access Control ......................................................................................................... 13
Broken Object Level Authorization (BOLA) ....................................................................... 13
Privilege Escalation .............................................................................................................. 13
Other Critical Vulnerabilities .................................................................................................... 14
Insecure Deserialization ........................................................................................................ 14
Man-in-the-Middle (MITM) ................................................................................................. 14
Denial of Service (DoS) ........................................................................................................ 14
Server-Side Request Forgery (SSRF) ................................................................................... 14
Other Vulnerabilities............................................................................................................. 15
SECTION 3: DEFENSIVE PROGRAMMING & INPUT VALIDATION................................. 16
Core Principles of Defensive Programming ............................................................................. 16
Common Defensive Coding Techniques .................................................................................. 16
Input Validation Types ............................................................................................................. 16
Type Check ........................................................................................................................... 16
Range Check ......................................................................................................................... 16
Length Check ........................................................................................................................ 16
, Null Check ............................................................................................................................ 16
Validation Strategies ............................................................................................................. 16
Assertions .................................................................................................................................. 17
Categories of Assertions ....................................................................................................... 17
Error Handling Strategies ......................................................................................................... 17
SECTION 4: CRYPTOGRAPHY & AUTHENTICATION ........................................................ 18
Hashing ..................................................................................................................................... 18
Hash Algorithm Requirements ............................................................................................. 18
Safe Hash Algorithms ........................................................................................................... 18
Unsafe Hash Algorithms ....................................................................................................... 18
Salting ................................................................................................................................... 18
Password Hashing Functions ................................................................................................ 18
HMAC (Hash-based Message Authentication Code) ........................................................... 18
Encryption ................................................................................................................................. 19
Symmetric Encryption .......................................................................................................... 19
AES Encryption Modes ........................................................................................................ 19
Initialization Vector (IV) ...................................................................................................... 19
Asymmetric Encryption ........................................................................................................ 19
Digital Signatures.................................................................................................................. 19
TLS and Network Security ....................................................................................................... 20
TLS (Transport Layer Security)............................................................................................ 20
X.509 Certificates ................................................................................................................. 20
Authentication & Authorization ............................................................................................... 20
Token-Based Authentication ................................................................................................ 20
OAuth .................................................................................................................................... 20
MSAL (Microsoft Authentication Library) .......................................................................... 20
Token Management .............................................................................................................. 20
Session Management ............................................................................................................ 20
Secure Cookie Attributes ...................................................................................................... 21
CORS (Cross-Origin Resource Sharing) .............................................................................. 21
SECTION 5: TESTING & DEBUGGING ................................................................................... 22
Testing Methods........................................................................................................................ 22
Static Testing (SAST) ........................................................................................................... 22
Dynamic Testing (DAST) ..................................................................................................... 22
