WGU D385 V2 SOFTWARE SECURITY
AND TESTING MASTER EXAM
QUESTIONS AND ANSWERS
1. Which technique is most effective at preventing SQL Injection when handling user-provided
data in a database query?
A. Implementing client-side input length validation
B. Blacklisting common SQL keywords like SELECT and DROP
C. Using prepared statements with parameterized queries
D. Escaping all single quotes in the input string
Answer: C
Conceptual Explanation: Prepared statements ensure that the database treats the user
input as data, not as executable code, which is the primary defense against SQL injection.
2. In the context of Cross-Site Scripting (XSS), what is the primary purpose of context-aware
output encoding?
A. To ensure data is interpreted as text rather than code by the browser
B. To encrypt the data before it is stored in the database
,C. To validate that the input contains only alphanumeric characters
D. To compress the response to improve loading times
Answer: A
Conceptual Explanation: Context-aware encoding converts potentially dangerous
characters into their safe HTML, JavaScript, or CSS equivalents, preventing the browser
from executing them.
3. A developer is implementing an API and wants to prevent Cross-Site Request Forgery
(CSRF). Which mechanism is considered a modern best practice for stateless REST APIs?
A. Checking the User-Agent header for every request
B. Implementing Double Submit Cookies or custom headers like X-Requested-With
C. Using a hidden form field for the session ID
D. Increasing the session timeout duration
Answer: B
Conceptual Explanation: Since REST APIs are often stateless, using custom headers or
double submit cookies helps ensure the request originated from a trusted client.
4. Which type of security testing involves analyzing the application’s source code without
executing the program?
A. Dynamic Application Security Testing (DAST)
B. Interactive Application Security Testing (IAST)
, C. Penetration Testing
D. Static Application Security Testing (SAST)
Answer: D
Conceptual Explanation: SAST (Static Analysis) examines code, byte code, or binaries for
security vulnerabilities without running the application.
5. When securing a JSON Web Token (JWT), which of the following practices is most critical to
prevent token forgery?
A. Using a strong, secret key with the HS256 algorithm or an RSA private key
B. Storing the JWT in the browser’s local storage
C. Reducing the size of the payload to improve performance
D. Setting the ‘alg’ header to ‘none’ in the JWT header
Answer: A
Conceptual Explanation: The security of a JWT relies on the integrity of its signature. If
the key is weak or leaked, an attacker can forge tokens. Setting ‘alg’ to ‘none’ is a major
vulnerability.
6. An application logs all user activities, including failed login attempts. Which of the
following is a security risk associated with logging?
A. Logging the time of the event
B. Logging the user’s IP address
AND TESTING MASTER EXAM
QUESTIONS AND ANSWERS
1. Which technique is most effective at preventing SQL Injection when handling user-provided
data in a database query?
A. Implementing client-side input length validation
B. Blacklisting common SQL keywords like SELECT and DROP
C. Using prepared statements with parameterized queries
D. Escaping all single quotes in the input string
Answer: C
Conceptual Explanation: Prepared statements ensure that the database treats the user
input as data, not as executable code, which is the primary defense against SQL injection.
2. In the context of Cross-Site Scripting (XSS), what is the primary purpose of context-aware
output encoding?
A. To ensure data is interpreted as text rather than code by the browser
B. To encrypt the data before it is stored in the database
,C. To validate that the input contains only alphanumeric characters
D. To compress the response to improve loading times
Answer: A
Conceptual Explanation: Context-aware encoding converts potentially dangerous
characters into their safe HTML, JavaScript, or CSS equivalents, preventing the browser
from executing them.
3. A developer is implementing an API and wants to prevent Cross-Site Request Forgery
(CSRF). Which mechanism is considered a modern best practice for stateless REST APIs?
A. Checking the User-Agent header for every request
B. Implementing Double Submit Cookies or custom headers like X-Requested-With
C. Using a hidden form field for the session ID
D. Increasing the session timeout duration
Answer: B
Conceptual Explanation: Since REST APIs are often stateless, using custom headers or
double submit cookies helps ensure the request originated from a trusted client.
4. Which type of security testing involves analyzing the application’s source code without
executing the program?
A. Dynamic Application Security Testing (DAST)
B. Interactive Application Security Testing (IAST)
, C. Penetration Testing
D. Static Application Security Testing (SAST)
Answer: D
Conceptual Explanation: SAST (Static Analysis) examines code, byte code, or binaries for
security vulnerabilities without running the application.
5. When securing a JSON Web Token (JWT), which of the following practices is most critical to
prevent token forgery?
A. Using a strong, secret key with the HS256 algorithm or an RSA private key
B. Storing the JWT in the browser’s local storage
C. Reducing the size of the payload to improve performance
D. Setting the ‘alg’ header to ‘none’ in the JWT header
Answer: A
Conceptual Explanation: The security of a JWT relies on the integrity of its signature. If
the key is weak or leaked, an attacker can forge tokens. Setting ‘alg’ to ‘none’ is a major
vulnerability.
6. An application logs all user activities, including failed login attempts. Which of the
following is a security risk associated with logging?
A. Logging the time of the event
B. Logging the user’s IP address
