WGU D385 V2 SOFTWARE SECURITY
AND TESTING MASTER FINAL EXAM
QUESTIONS AND ANSWERS
1. Which of the following describes a vulnerability where an attacker manipulates the
internal logic of a web application to access unauthorized data records by changing a unique
identifier?
A. Cross-Site Request Forgery (CSRF)
B. Cross-Site Scripting (XSS)
C. Server-Side Request Forgery (SSRF)
D. Insecure Direct Object Reference (IDOR)
Answer: D
Conceptual Explanation: IDOR occurs when an application provides direct access to
objects based on user-supplied input, allowing attackers to bypass authorization by
changing IDs in URLs or parameters.
,2. In the context of secure software development, what is the primary purpose of ‘Input
Validation’?
A. To ensure data is formatted correctly for display in the UI
B. To improve the performance of database queries
C. To compress data before it is stored in the cloud
D. To ensure that only properly formed data enters the system workflow
Answer: D
Conceptual Explanation: Input validation is a core security control that ensures data
received by an application matches expected formats, types, and lengths, preventing
malicious data from triggering vulnerabilities.
3. Which testing methodology involves analyzing the source code without executing the
program?
A. Dynamic Application Security Testing (DAST)
B. Fuzz Testing
C. Regression Testing
D. Static Application Security Testing (SAST)
Answer: D
Conceptual Explanation: SAST (Static Analysis) examines source code, byte code, or
binaries for security vulnerabilities without running the code.
, 4. What is the most effective way to prevent SQL Injection vulnerabilities in a modern web
application?
A. Using client-side JavaScript filters
B. Implementing Web Application Firewalls (WAF) exclusively
C. Encoding all output in HTML entities
D. Using parameterized queries or prepared statements
Answer: D
Conceptual Explanation: Parameterized queries ensure that the database treats user
input as data rather than executable code, neutralizing SQL injection attempts.
5. A developer is implementing a logging system. Which of the following should be EXCLUDED
from logs to ensure security and compliance?
A. Session IDs and full credit card numbers
B. Timestamp of the event
C. The User-Agent string of the browser
D. Error codes returned by the server
Answer: A
Conceptual Explanation: Sensitive Personal Identifiable Information (PII) and credentials
like session IDs or credit card numbers should never be logged to prevent data exposure in
case of a log breach.
AND TESTING MASTER FINAL EXAM
QUESTIONS AND ANSWERS
1. Which of the following describes a vulnerability where an attacker manipulates the
internal logic of a web application to access unauthorized data records by changing a unique
identifier?
A. Cross-Site Request Forgery (CSRF)
B. Cross-Site Scripting (XSS)
C. Server-Side Request Forgery (SSRF)
D. Insecure Direct Object Reference (IDOR)
Answer: D
Conceptual Explanation: IDOR occurs when an application provides direct access to
objects based on user-supplied input, allowing attackers to bypass authorization by
changing IDs in URLs or parameters.
,2. In the context of secure software development, what is the primary purpose of ‘Input
Validation’?
A. To ensure data is formatted correctly for display in the UI
B. To improve the performance of database queries
C. To compress data before it is stored in the cloud
D. To ensure that only properly formed data enters the system workflow
Answer: D
Conceptual Explanation: Input validation is a core security control that ensures data
received by an application matches expected formats, types, and lengths, preventing
malicious data from triggering vulnerabilities.
3. Which testing methodology involves analyzing the source code without executing the
program?
A. Dynamic Application Security Testing (DAST)
B. Fuzz Testing
C. Regression Testing
D. Static Application Security Testing (SAST)
Answer: D
Conceptual Explanation: SAST (Static Analysis) examines source code, byte code, or
binaries for security vulnerabilities without running the code.
, 4. What is the most effective way to prevent SQL Injection vulnerabilities in a modern web
application?
A. Using client-side JavaScript filters
B. Implementing Web Application Firewalls (WAF) exclusively
C. Encoding all output in HTML entities
D. Using parameterized queries or prepared statements
Answer: D
Conceptual Explanation: Parameterized queries ensure that the database treats user
input as data rather than executable code, neutralizing SQL injection attempts.
5. A developer is implementing a logging system. Which of the following should be EXCLUDED
from logs to ensure security and compliance?
A. Session IDs and full credit card numbers
B. Timestamp of the event
C. The User-Agent string of the browser
D. Error codes returned by the server
Answer: A
Conceptual Explanation: Sensitive Personal Identifiable Information (PII) and credentials
like session IDs or credit card numbers should never be logged to prevent data exposure in
case of a log breach.
