WGU D385 V2 SOFTWARE SECURITY
AND TESTING MASTER ASSESSMENT
QUESTIONS AND ANSWERS
1. Which testing methodology involves analyzing the application’s source code without
executing the program to identify vulnerabilities like SQL injection or buffer overflows?
A. DAST (Dynamic Application Security Testing)
B. Fuzz Testing
C. SAST (Static Application Security Testing)
D. Regression Testing
Answer: C
Conceptual Explanation: SAST analyzes the source code, bytecode, or binaries at rest.
Unlike DAST, it does not require a running environment and can find issues early in the
SDLC.
2. When implementing defense against SQL Injection, which of the following provides the
most effective primary defense?
A. Black-listing dangerous keywords like DROP or SELECT
,B. Using client-side JavaScript validation
C. Parameterized queries using prepared statements
D. Encrypting the database connection string
Answer: C
Conceptual Explanation: Prepared statements ensure that the database treats user input
as data, not as executable code, which effectively prevents SQL injection.
3. In the context of API security, what is the primary purpose of an API Gateway?
A. To serve as a compiler for RESTful services
B. To perform unit testing on backend database schemas
C. To store long-term user passwords in a plaintext format
D. To act as a reverse proxy that handles authentication, rate limiting, and routing
Answer: D
Conceptual Explanation: An API Gateway centralizes security policies like authentication,
logging, and rate limiting, protecting the backend services from direct exposure.
4. Which type of XSS attack occurs when a malicious script is permanently stored on a target
server, such as in a database or comment field?
A. Reflected XSS
B. DOM-based XSS
, C. Stored XSS
D. Self-XSS
Answer: C
Conceptual Explanation: Stored (or Persistent) XSS is the most dangerous because the
script is saved on the server and served to every user who visits the affected page.
5. What is the main goal of Fuzz Testing (Fuzzing)?
A. To verify that the user interface meets accessibility standards
B. To measure the performance of an application under heavy load
C. To ensure that all code paths are covered by unit tests
D. To provide random, malformed, or unexpected input to a program to find crashes or
memory leaks
Answer: D
Conceptual Explanation: Fuzzing is a negative testing technique used to discover
software defects and security vulnerabilities by sending semi-random data to the
application.
6. Which HTTP header can be used to prevent a web application from being embedded in an
iframe, thereby mitigating Clickjacking attacks?
A. Strict-Transport-Security
B. X-Frame-Options
AND TESTING MASTER ASSESSMENT
QUESTIONS AND ANSWERS
1. Which testing methodology involves analyzing the application’s source code without
executing the program to identify vulnerabilities like SQL injection or buffer overflows?
A. DAST (Dynamic Application Security Testing)
B. Fuzz Testing
C. SAST (Static Application Security Testing)
D. Regression Testing
Answer: C
Conceptual Explanation: SAST analyzes the source code, bytecode, or binaries at rest.
Unlike DAST, it does not require a running environment and can find issues early in the
SDLC.
2. When implementing defense against SQL Injection, which of the following provides the
most effective primary defense?
A. Black-listing dangerous keywords like DROP or SELECT
,B. Using client-side JavaScript validation
C. Parameterized queries using prepared statements
D. Encrypting the database connection string
Answer: C
Conceptual Explanation: Prepared statements ensure that the database treats user input
as data, not as executable code, which effectively prevents SQL injection.
3. In the context of API security, what is the primary purpose of an API Gateway?
A. To serve as a compiler for RESTful services
B. To perform unit testing on backend database schemas
C. To store long-term user passwords in a plaintext format
D. To act as a reverse proxy that handles authentication, rate limiting, and routing
Answer: D
Conceptual Explanation: An API Gateway centralizes security policies like authentication,
logging, and rate limiting, protecting the backend services from direct exposure.
4. Which type of XSS attack occurs when a malicious script is permanently stored on a target
server, such as in a database or comment field?
A. Reflected XSS
B. DOM-based XSS
, C. Stored XSS
D. Self-XSS
Answer: C
Conceptual Explanation: Stored (or Persistent) XSS is the most dangerous because the
script is saved on the server and served to every user who visits the affected page.
5. What is the main goal of Fuzz Testing (Fuzzing)?
A. To verify that the user interface meets accessibility standards
B. To measure the performance of an application under heavy load
C. To ensure that all code paths are covered by unit tests
D. To provide random, malformed, or unexpected input to a program to find crashes or
memory leaks
Answer: D
Conceptual Explanation: Fuzzing is a negative testing technique used to discover
software defects and security vulnerabilities by sending semi-random data to the
application.
6. Which HTTP header can be used to prevent a web application from being embedded in an
iframe, thereby mitigating Clickjacking attacks?
A. Strict-Transport-Security
B. X-Frame-Options
