WGU D385 V2 SOFTWARE SECURITY
AND TESTING MASTER FINAL EXAM
QUESTIONS AND ANSWERS 2026/2027
1. Which of the following describes the ‘Tampering’ threat in the STRIDE model?
A. Gaining unauthorized access to private information.
B. Assuming the identity of another user or system entity.
C. Violating the integrity of data by unauthorized modification.
D. Denying a transaction occurred without proof.
Answer: C
Conceptual Explanation: Tampering involves unauthorized modification of data or code,
directly impacting the integrity of the system.
2. In the context of Static Application Security Testing (SAST), what is a ‘false positive’?
A. A reported vulnerability that is actually a non-issue or intended behavior.
B. A vulnerability that exists but is not detected by the tool.
C. A security flaw that has been patched but still appears in reports.
D. A vulnerability that only occurs during runtime execution.
,Answer: A
Conceptual Explanation: A false positive occurs when the analysis tool incorrectly flags
safe code as a potential vulnerability.
3. Which secure coding practice is most effective against SQL Injection?
A. Client-side form validation.
B. Using blacklist-based input filtering.
C. Implementing parameterized queries or prepared statements.
D. Encrypting all database tables.
Answer: C
Conceptual Explanation: Parameterized queries separate the SQL code from the data,
preventing user input from being executed as a command.
4. Which testing method involves checking the software’s internal structure and logic with
full knowledge of the source code?
A. Black-box testing
B. Grey-box testing
C. White-box testing
D. Fuzz testing
Answer: C
, Conceptual Explanation: White-box testing (or clear-box) allows the tester to see the
internal code, logic, and architecture to design test cases.
5. When implementing logging for security audits, which of the following should be avoided?
A. Logging the timestamp of every failed login attempt.
B. Logging full credit card numbers or clear-text passwords.
C. Logging the User-Agent string from the HTTP header.
D. Logging the source IP address of the request.
Answer: B
Conceptual Explanation: Sensitive information like PII or credentials should never be
stored in logs to prevent secondary data breaches.
6. What is the primary purpose of a Cross-Site Request Forgery (CSRF) token?
A. To ensure that the request was intentionally initiated by the authenticated user.
B. To encrypt the data sent between the client and server.
C. To prevent the execution of malicious scripts in the user’s browser.
D. To authenticate a user’s session via a cookie.
Answer: A
Conceptual Explanation: CSRF tokens are unique, unpredictable values that prove the
request originated from the legitimate site, not a third-party malicious site.
AND TESTING MASTER FINAL EXAM
QUESTIONS AND ANSWERS 2026/2027
1. Which of the following describes the ‘Tampering’ threat in the STRIDE model?
A. Gaining unauthorized access to private information.
B. Assuming the identity of another user or system entity.
C. Violating the integrity of data by unauthorized modification.
D. Denying a transaction occurred without proof.
Answer: C
Conceptual Explanation: Tampering involves unauthorized modification of data or code,
directly impacting the integrity of the system.
2. In the context of Static Application Security Testing (SAST), what is a ‘false positive’?
A. A reported vulnerability that is actually a non-issue or intended behavior.
B. A vulnerability that exists but is not detected by the tool.
C. A security flaw that has been patched but still appears in reports.
D. A vulnerability that only occurs during runtime execution.
,Answer: A
Conceptual Explanation: A false positive occurs when the analysis tool incorrectly flags
safe code as a potential vulnerability.
3. Which secure coding practice is most effective against SQL Injection?
A. Client-side form validation.
B. Using blacklist-based input filtering.
C. Implementing parameterized queries or prepared statements.
D. Encrypting all database tables.
Answer: C
Conceptual Explanation: Parameterized queries separate the SQL code from the data,
preventing user input from being executed as a command.
4. Which testing method involves checking the software’s internal structure and logic with
full knowledge of the source code?
A. Black-box testing
B. Grey-box testing
C. White-box testing
D. Fuzz testing
Answer: C
, Conceptual Explanation: White-box testing (or clear-box) allows the tester to see the
internal code, logic, and architecture to design test cases.
5. When implementing logging for security audits, which of the following should be avoided?
A. Logging the timestamp of every failed login attempt.
B. Logging full credit card numbers or clear-text passwords.
C. Logging the User-Agent string from the HTTP header.
D. Logging the source IP address of the request.
Answer: B
Conceptual Explanation: Sensitive information like PII or credentials should never be
stored in logs to prevent secondary data breaches.
6. What is the primary purpose of a Cross-Site Request Forgery (CSRF) token?
A. To ensure that the request was intentionally initiated by the authenticated user.
B. To encrypt the data sent between the client and server.
C. To prevent the execution of malicious scripts in the user’s browser.
D. To authenticate a user’s session via a cookie.
Answer: A
Conceptual Explanation: CSRF tokens are unique, unpredictable values that prove the
request originated from the legitimate site, not a third-party malicious site.
