WGU D385 V2 SOFTWARE SECURITY
AND TESTING MASTER QUESTIONS
AND ANSWERS
1. Which phase of the Software Development Life Cycle (SDLC) is the most cost-effective for
identifying and addressing security requirements?
A. Maintenance Phase
B. Requirements Analysis Phase
C. Testing Phase
D. Implementation Phase
Answer: B
Conceptual Explanation: Addressing security requirements early in the Requirements
Analysis phase (Shift-Left) prevents costly redesigns during later stages of development.
2. In the context of secure coding, which technique is most effective at preventing SQL
Injection?
A. Blacklisting dangerous characters like single quotes
B. Using client-side JavaScript validation
,C. Encoding output in HTML format
D. Implementing parameterized queries or prepared statements
Answer: D
Conceptual Explanation: Parameterized queries ensure that the database treats user
input as data only, not as executable code, effectively neutralizing SQL injection attacks.
3. What is the primary difference between Static Application Security Testing (SAST) and
Dynamic Application Security Testing (DAST)?
A. SAST is performed during production; DAST is performed during coding.
B. SAST requires the source code; DAST requires a running application.
C. SAST identifies runtime errors; DAST identifies logic flaws in source code.
D. SAST is performed by testers; DAST is performed by developers.
Answer: B
Conceptual Explanation: SAST (White-box) analyzes source code without executing it,
while DAST (Black-box) tests the application while it is running to find vulnerabilities like
session management issues.
4. Which of the following describes a ‘Mutation-Based’ Fuzzing approach?
A. Generating inputs based on a specific protocol or file format definition.
B. Comparing two versions of the same code to find security regressions.
C. Modifying existing valid data inputs to create slightly malformed test cases.
, D. Manually entering edge-case values into form fields.
Answer: C
Conceptual Explanation: Mutation-based fuzzing starts with valid data and applies
random or heuristic changes (mutations) to see how the software handles unexpected
input.
5. Which vulnerability involves an attacker forcing a user’s browser to send a request to a
vulnerable web application where the user is currently authenticated?
A. Cross-Site Request Forgery (CSRF)
B. Insecure Direct Object Reference (IDOR)
C. Cross-Site Scripting (XSS)
D. Server-Side Request Forgery (SSRF)
Answer: A
Conceptual Explanation: CSRF exploits the trust a site has in the user’s browser, tricking
it into performing actions the user did not intend.
6. When implementing OAuth 2.0, which flow is recommended for highly secure server-to-
server communication without a specific user present?
A. Authorization Code Flow
B. Implicit Flow
C. Resource Owner Password Credentials Grant
AND TESTING MASTER QUESTIONS
AND ANSWERS
1. Which phase of the Software Development Life Cycle (SDLC) is the most cost-effective for
identifying and addressing security requirements?
A. Maintenance Phase
B. Requirements Analysis Phase
C. Testing Phase
D. Implementation Phase
Answer: B
Conceptual Explanation: Addressing security requirements early in the Requirements
Analysis phase (Shift-Left) prevents costly redesigns during later stages of development.
2. In the context of secure coding, which technique is most effective at preventing SQL
Injection?
A. Blacklisting dangerous characters like single quotes
B. Using client-side JavaScript validation
,C. Encoding output in HTML format
D. Implementing parameterized queries or prepared statements
Answer: D
Conceptual Explanation: Parameterized queries ensure that the database treats user
input as data only, not as executable code, effectively neutralizing SQL injection attacks.
3. What is the primary difference between Static Application Security Testing (SAST) and
Dynamic Application Security Testing (DAST)?
A. SAST is performed during production; DAST is performed during coding.
B. SAST requires the source code; DAST requires a running application.
C. SAST identifies runtime errors; DAST identifies logic flaws in source code.
D. SAST is performed by testers; DAST is performed by developers.
Answer: B
Conceptual Explanation: SAST (White-box) analyzes source code without executing it,
while DAST (Black-box) tests the application while it is running to find vulnerabilities like
session management issues.
4. Which of the following describes a ‘Mutation-Based’ Fuzzing approach?
A. Generating inputs based on a specific protocol or file format definition.
B. Comparing two versions of the same code to find security regressions.
C. Modifying existing valid data inputs to create slightly malformed test cases.
, D. Manually entering edge-case values into form fields.
Answer: C
Conceptual Explanation: Mutation-based fuzzing starts with valid data and applies
random or heuristic changes (mutations) to see how the software handles unexpected
input.
5. Which vulnerability involves an attacker forcing a user’s browser to send a request to a
vulnerable web application where the user is currently authenticated?
A. Cross-Site Request Forgery (CSRF)
B. Insecure Direct Object Reference (IDOR)
C. Cross-Site Scripting (XSS)
D. Server-Side Request Forgery (SSRF)
Answer: A
Conceptual Explanation: CSRF exploits the trust a site has in the user’s browser, tricking
it into performing actions the user did not intend.
6. When implementing OAuth 2.0, which flow is recommended for highly secure server-to-
server communication without a specific user present?
A. Authorization Code Flow
B. Implicit Flow
C. Resource Owner Password Credentials Grant
