WGU D385 V2 SOFTWARE SECURITY AND TESTING
MASTER STUDY GUIDE | TASK 1 & TASK 2 PA PREP,
SECURE CODING, TESTING, APIS, LOGGING &
VULNERABILITY REMEDIATION | 2026 UPDATED
This comprehensive master study guide is meticulously designed for candidates preparing for the
Western Governors University (WGU) D385 V2 Software Security and Testing Objective
Assessment and Performance Assessment (PA). Aligned with the 2026 curriculum, this document
serves as a definitive study guide and exam review, featuring 100 super-advanced questions that
mirror the complexity and rigor of the actual certification examination. It covers both theoretical
foundations and practical applications, including secure coding practices, API security, logging
and error handling, vulnerability remediation, the OWASP Top 10, SQL injection, Cross-Site
Scripting (XSS), Cross-Origin Resource Sharing (CORS), OAuth, Python debugging, and the
Common Vulnerability Scoring System (CVSS). Each question is accompanied by a detailed,
verified solution to ensure 100% correct answers and a deep, integrated understanding of
software security and testing principles, guaranteeing distinction-level preparation for this
critical IT credential.
Table of Contents
1. Course Overview: D385 V2 – Software Security and Testing
2. Task 1: Logging, Error Handling, and Testing a Flask Application
3. Task 2: Secure Coding and Secure API Implementation
*4. Secure Coding Practices and the OWASP Top 10*
5. SQL Injection: Prevention and Remediation
6. Cross-Site Scripting (XSS) and Cross-Origin Resource Sharing (CORS)
7. API Security: Authentication, Authorization, and OAuth
8. Logging, Monitoring, and Log Injection Prevention
9. Vulnerability Assessment, CVSS Scoring, and Remediation
10. Python Debugging and Unit Testing (Pytest)
11. Threat Modeling and Risk Assessment
12. Objective Assessment (OA) and Pre-Assessment (PA) Strategies
,Question 1
In the D385 V2 Performance Assessment, what is the primary objective of Task 1?
A) To remediate a starter API and prove fixes with pytest
B) To add logging, error handling, assertions, and passing unit tests to the equipment rental Flask
app
C) To configure REST API authentication using OAuth 2.0
D) To write a comprehensive Security Mitigation Report
Correct Answer: B
Task 1 focuses on enhancing a Flask application by implementing proper logging, error
handling, and assertions to ensure the application passes unit tests. Task 2 involves secure
coding and API implementation, including remediation and reporting.
Question 2
In the D385 V2 Performance Assessment, what is the primary objective of Task 2?
A) To add logging and error handling to a Flask application
B) To remediate the starter API, prove fixes with pytest, and write a Security Mitigation Report
C) To configure a database connection for the equipment rental app
D) To design a user interface for the application
Correct Answer: B
Task 2 requires students to remediate a vulnerable starter API, demonstrate fixes using pytest,
and document the vulnerabilities and mitigations in a Security Mitigation Report. This task
assesses secure coding and secure API implementation skills.
Question 3
Which of the following best defines the primary goal of software security?
A) To increase software performance and speed
B) To eliminate all software bugs and errors
C) To protect software from unauthorized access, modification, and destruction
D) To reduce the cost of software development
,Correct Answer: C
The primary goal of software security is to protect the confidentiality, integrity, and availability
of software and its data. Performance (A) and cost reduction (D) are secondary considerations,
and eliminating all bugs (B) is unrealistic.
Question 4
In threat modeling, what is the first step in identifying potential security risks?
A) Determining the impact of a security breach
B) Decomposing the application to understand its components and data flows
C) Identifying existing security controls
D) Brainstorming potential vulnerabilities
Correct Answer: B
The first step in threat modeling is to decompose the application, which involves understanding
its architecture, data flows, and trust boundaries. This foundational step is necessary before
identifying vulnerabilities or assessing impact.
Question 5
What is the primary defense against log injection attacks?
A) Encrypting all log files
B) Sanitizing outbound log messages
C) Restricting access to log files
D) Using a centralized logging server
Correct Answer: B
The primary defense against log injection attacks is to sanitize or validate all data before it is
written to logs. This prevents attackers from injecting malicious characters or commands into
log entries. Encryption (A) and access control (C) are important but do not prevent the injection
itself.
, Question 6
Which of the following is a secure coding practice for preventing SQL injection?
A) Using string concatenation to build SQL queries
B) Validating and sanitizing all user inputs
C) Storing database credentials in the source code
D) Disabling all error messages
Correct Answer: B
Validating and sanitizing all user inputs is a critical secure coding practice to prevent SQL
injection. Parameterized queries or prepared statements are the most effective defense. String
concatenation (A) is dangerous, and storing credentials in code (C) is a security risk.
Question 7
What is the Common Vulnerability Scoring System (CVSS) used for?
A) To assign a severity score to software vulnerabilities on a scale of 0.0 to 10.0
B) To classify software bugs by their impact on performance
C) To determine the cost of fixing a vulnerability
D) To rank software developers by their security skills
Correct Answer: A
CVSS is a standardized framework for rating the severity of software vulnerabilities. Scores
range from 0.0 to 10.0, with LOW (0.1-3.9), MEDIUM (4.0-6.9), HIGH (7.0-8.9), and CRITICAL
(9.0-10.0) categories.
Question 8
Which of the following is a key principle of secure coding?
A) Input validation
B) Output encoding
C) Parameterized queries
D) All of the above
MASTER STUDY GUIDE | TASK 1 & TASK 2 PA PREP,
SECURE CODING, TESTING, APIS, LOGGING &
VULNERABILITY REMEDIATION | 2026 UPDATED
This comprehensive master study guide is meticulously designed for candidates preparing for the
Western Governors University (WGU) D385 V2 Software Security and Testing Objective
Assessment and Performance Assessment (PA). Aligned with the 2026 curriculum, this document
serves as a definitive study guide and exam review, featuring 100 super-advanced questions that
mirror the complexity and rigor of the actual certification examination. It covers both theoretical
foundations and practical applications, including secure coding practices, API security, logging
and error handling, vulnerability remediation, the OWASP Top 10, SQL injection, Cross-Site
Scripting (XSS), Cross-Origin Resource Sharing (CORS), OAuth, Python debugging, and the
Common Vulnerability Scoring System (CVSS). Each question is accompanied by a detailed,
verified solution to ensure 100% correct answers and a deep, integrated understanding of
software security and testing principles, guaranteeing distinction-level preparation for this
critical IT credential.
Table of Contents
1. Course Overview: D385 V2 – Software Security and Testing
2. Task 1: Logging, Error Handling, and Testing a Flask Application
3. Task 2: Secure Coding and Secure API Implementation
*4. Secure Coding Practices and the OWASP Top 10*
5. SQL Injection: Prevention and Remediation
6. Cross-Site Scripting (XSS) and Cross-Origin Resource Sharing (CORS)
7. API Security: Authentication, Authorization, and OAuth
8. Logging, Monitoring, and Log Injection Prevention
9. Vulnerability Assessment, CVSS Scoring, and Remediation
10. Python Debugging and Unit Testing (Pytest)
11. Threat Modeling and Risk Assessment
12. Objective Assessment (OA) and Pre-Assessment (PA) Strategies
,Question 1
In the D385 V2 Performance Assessment, what is the primary objective of Task 1?
A) To remediate a starter API and prove fixes with pytest
B) To add logging, error handling, assertions, and passing unit tests to the equipment rental Flask
app
C) To configure REST API authentication using OAuth 2.0
D) To write a comprehensive Security Mitigation Report
Correct Answer: B
Task 1 focuses on enhancing a Flask application by implementing proper logging, error
handling, and assertions to ensure the application passes unit tests. Task 2 involves secure
coding and API implementation, including remediation and reporting.
Question 2
In the D385 V2 Performance Assessment, what is the primary objective of Task 2?
A) To add logging and error handling to a Flask application
B) To remediate the starter API, prove fixes with pytest, and write a Security Mitigation Report
C) To configure a database connection for the equipment rental app
D) To design a user interface for the application
Correct Answer: B
Task 2 requires students to remediate a vulnerable starter API, demonstrate fixes using pytest,
and document the vulnerabilities and mitigations in a Security Mitigation Report. This task
assesses secure coding and secure API implementation skills.
Question 3
Which of the following best defines the primary goal of software security?
A) To increase software performance and speed
B) To eliminate all software bugs and errors
C) To protect software from unauthorized access, modification, and destruction
D) To reduce the cost of software development
,Correct Answer: C
The primary goal of software security is to protect the confidentiality, integrity, and availability
of software and its data. Performance (A) and cost reduction (D) are secondary considerations,
and eliminating all bugs (B) is unrealistic.
Question 4
In threat modeling, what is the first step in identifying potential security risks?
A) Determining the impact of a security breach
B) Decomposing the application to understand its components and data flows
C) Identifying existing security controls
D) Brainstorming potential vulnerabilities
Correct Answer: B
The first step in threat modeling is to decompose the application, which involves understanding
its architecture, data flows, and trust boundaries. This foundational step is necessary before
identifying vulnerabilities or assessing impact.
Question 5
What is the primary defense against log injection attacks?
A) Encrypting all log files
B) Sanitizing outbound log messages
C) Restricting access to log files
D) Using a centralized logging server
Correct Answer: B
The primary defense against log injection attacks is to sanitize or validate all data before it is
written to logs. This prevents attackers from injecting malicious characters or commands into
log entries. Encryption (A) and access control (C) are important but do not prevent the injection
itself.
, Question 6
Which of the following is a secure coding practice for preventing SQL injection?
A) Using string concatenation to build SQL queries
B) Validating and sanitizing all user inputs
C) Storing database credentials in the source code
D) Disabling all error messages
Correct Answer: B
Validating and sanitizing all user inputs is a critical secure coding practice to prevent SQL
injection. Parameterized queries or prepared statements are the most effective defense. String
concatenation (A) is dangerous, and storing credentials in code (C) is a security risk.
Question 7
What is the Common Vulnerability Scoring System (CVSS) used for?
A) To assign a severity score to software vulnerabilities on a scale of 0.0 to 10.0
B) To classify software bugs by their impact on performance
C) To determine the cost of fixing a vulnerability
D) To rank software developers by their security skills
Correct Answer: A
CVSS is a standardized framework for rating the severity of software vulnerabilities. Scores
range from 0.0 to 10.0, with LOW (0.1-3.9), MEDIUM (4.0-6.9), HIGH (7.0-8.9), and CRITICAL
(9.0-10.0) categories.
Question 8
Which of the following is a key principle of secure coding?
A) Input validation
B) Output encoding
C) Parameterized queries
D) All of the above
