WGU D385 V2 SOFTWARE SECURITY
AND TESTING MASTER FINAL EXAM
PREP QUESTIONS AND ANSWERS
1. In Test-Driven Development (TDD), what is the primary purpose of the ‘Refactor’ stage in
the Red-Green-Refactor cycle?
A. To improve code structure and readability without changing behavior
B. To add new functionality while maintaining existing tests
C. To write the minimum amount of code to make a failing test pass
D. To identify which edge cases are not covered by the current test suite
Answer: A
Conceptual Explanation: Refactoring is the process of restructuring existing computer
code—changing the factoring—without changing its external behavior to improve non-
functional attributes of the software.
2. Which of the following is a primary characteristic of Static Application Security Testing
(SAST)?
A. It requires a running instance of the application to identify vulnerabilities
,B. It simulates external attacks to test the application’s defensive posture
C. It focuses on analyzing the source code or binaries without execution
D. It is primarily used to identify configuration issues in the production environment
Answer: C
Conceptual Explanation: SAST is a white-box testing method that examines the
application from the inside out, looking at the code itself for vulnerabilities like SQL
injection or buffer overflows.
3. When implementing input validation to prevent Cross-Site Scripting (XSS), which strategy is
considered the most secure?
A. Blacklisting known dangerous characters like ‘<’ and ‘>’
B. Whitelisting expected characters and using context-aware output encoding
C. Using client-side JavaScript to sanitize all input fields
D. Stripping all HTML tags from the input string before storage
Answer: B
Conceptual Explanation: Whitelisting is safer than blacklisting, and context-aware output
encoding ensures that even if malicious data is stored, it is rendered as text rather than
executable code in the browser.
, 4. An organization is using the CVSS (Common Vulnerability Scoring System). What does the
‘Temporal Score’ represent?
A. The inherent qualities of a vulnerability that do not change over time
B. The impact of the vulnerability on the specific organization’s environment
C. Attributes of the vulnerability that change over time, such as exploit availability
D. The time it takes for a developer to release a patch for the vulnerability
Answer: C
Conceptual Explanation: Temporal metrics measure the current state of exploit
techniques or code availability, the existence of patches, or the degree of confidence in the
vulnerability’s existence.
5. What is the specific purpose of using ‘Mocks’ instead of ‘Stubs’ in unit testing?
A. Mocks are used to verify the behavior and interactions between objects
B. Mocks provide hard-coded data to the system under test
C. Mocks are only used when testing external third-party APIs
D. Mocks improve performance by bypassing the database layer
Answer: A
Conceptual Explanation: While stubs provide canned answers to calls made during the
test, mocks are pre-programmed with expectations which form a specification of the calls
they are expected to receive.
AND TESTING MASTER FINAL EXAM
PREP QUESTIONS AND ANSWERS
1. In Test-Driven Development (TDD), what is the primary purpose of the ‘Refactor’ stage in
the Red-Green-Refactor cycle?
A. To improve code structure and readability without changing behavior
B. To add new functionality while maintaining existing tests
C. To write the minimum amount of code to make a failing test pass
D. To identify which edge cases are not covered by the current test suite
Answer: A
Conceptual Explanation: Refactoring is the process of restructuring existing computer
code—changing the factoring—without changing its external behavior to improve non-
functional attributes of the software.
2. Which of the following is a primary characteristic of Static Application Security Testing
(SAST)?
A. It requires a running instance of the application to identify vulnerabilities
,B. It simulates external attacks to test the application’s defensive posture
C. It focuses on analyzing the source code or binaries without execution
D. It is primarily used to identify configuration issues in the production environment
Answer: C
Conceptual Explanation: SAST is a white-box testing method that examines the
application from the inside out, looking at the code itself for vulnerabilities like SQL
injection or buffer overflows.
3. When implementing input validation to prevent Cross-Site Scripting (XSS), which strategy is
considered the most secure?
A. Blacklisting known dangerous characters like ‘<’ and ‘>’
B. Whitelisting expected characters and using context-aware output encoding
C. Using client-side JavaScript to sanitize all input fields
D. Stripping all HTML tags from the input string before storage
Answer: B
Conceptual Explanation: Whitelisting is safer than blacklisting, and context-aware output
encoding ensures that even if malicious data is stored, it is rendered as text rather than
executable code in the browser.
, 4. An organization is using the CVSS (Common Vulnerability Scoring System). What does the
‘Temporal Score’ represent?
A. The inherent qualities of a vulnerability that do not change over time
B. The impact of the vulnerability on the specific organization’s environment
C. Attributes of the vulnerability that change over time, such as exploit availability
D. The time it takes for a developer to release a patch for the vulnerability
Answer: C
Conceptual Explanation: Temporal metrics measure the current state of exploit
techniques or code availability, the existence of patches, or the degree of confidence in the
vulnerability’s existence.
5. What is the specific purpose of using ‘Mocks’ instead of ‘Stubs’ in unit testing?
A. Mocks are used to verify the behavior and interactions between objects
B. Mocks provide hard-coded data to the system under test
C. Mocks are only used when testing external third-party APIs
D. Mocks improve performance by bypassing the database layer
Answer: A
Conceptual Explanation: While stubs provide canned answers to calls made during the
test, mocks are pre-programmed with expectations which form a specification of the calls
they are expected to receive.
