WGU D385 TASK 1 PERFORMANCE ASSESSMENT | SOFTWARE
SECURITY AND TESTING, STATIC ANALYSIS, PYTHON
LOGGING & UNIT TESTS | COMPLETE REPORT | 2026 UPDATED.
80 Questions with Answers and Detailed Rationales
100 PERCENT GUARANTEED PASS
INSTANT DOWNLOAD ANSWERS INCLUDED
IMPORTANCE OF THIS DOCUMENT
This comprehensive examination preparation guide has been meticulously developed to help you succeed in the
WGU D385 TASK 1 PERFORMANCE ASSESSMENT | SOFTWARE SECURITY AND TESTING, STATIC
ANALYSIS, PYTHON LOGGING & UNIT TESTS | COMPLETE REPORT | 2026 UPDATED.. It contains 80
carefully selected questions that reflect the most current exam content and testing strategies. Each question is
accompanied by a correct answer and a detailed rationale that explains the underlying pathophysiology,
pharmacology, or clinical reasoning.
Self-Assessment – Test your knowledge and Exam Preparation – Familiarize yourself with the
identify areas requiring further question format and content
study areas
Concept Reinforcement – Deepen your Confidence Building – Develop test-taking
understanding through strategies and reduce
evidence-based exam anxiety
rationales
Time Management – Practice answering
questions under simulated
exam conditions
Review Summary 80 Questions
Foundations - Application - WGU D385 TASK 1 Performance Assessment Software Security AND Testing
Static Analysis Python Logging & UNIT Tests Complete Report 2026 Updated WGU D385 TASK 1
Performance Assessment Software Security AND Testing Static Analysis Python Logging & UNIT Tests
Complete Report 2026 Updated University
All answers with rationales
,Table of Contents
Content Area Questions Key Topics
Software Security Testing 1-14 Python, Application, Function, Approach, Logging
Static Analysis 15-28 Python, Logging, Security, Application, Developer
Python Logging 29-42 Python, Static Analysis, Logging, Vulnerability, Function
UNIT Tests 43-56 Python, Security, Input, Logging, Ensure
Secure Coding Practices 57-70 Analysis, Python, Logging, Function, Security
Vulnerability Assessment 71-80 Python, Developer, Logging, Approach, Function
TOTAL 80 All questions include answers and detailed rationales
,Section A - Software Security Testing
Q1.
In a Python unit test suite, you need to verify that a function logs an ERROR when a retry
limit is exceeded. Which approach best ensures the test is isolated and does not depend
on logging configuration?
A. Use assertLogs to capture log records B. Mock logging.getLogger and assert the
and assert on the message. mock's error method was called.
C. Configure a FileHandler and read the log D. Replace the logger with a custom object
file after the test. that records calls.
Correct: A - Use assertLogs to capture log records and assert on the message.
Rationale:assertLogs is the built-in, recommended way to test logging messages within a
test, as it sets up a handler and captures records without affecting global logging
configuration. Mocking the logger or using a file handler can be fragile and couples the test to
implementation details.
Why the other answers are wrong:
B. Mocking the logger only checks that the logging call was made, not the actual message
content or level.
C. Writing to a file introduces I/O dependencies and requires cleanup, making tests slower and
less reliable.
D. Replacing the logger with a custom object is possible but bypasses the standard logging
machinery and may miss integration issues.
Reference: Python Standard Library, unittest - assertLogs
Q2.
During a static analysis review of a Python web application, you encounter a SQL query
built using f-strings with user input. Which class of vulnerability is this and what is the
most effective mitigation?
A. SQL injection; use parameterized queries B. Cross-site scripting; escape all output.
with placeholders.
C. Command injection; validate input D. Path traversal; sanitize the input with
against a whitelist. os.path.basename.
Correct: A - SQL injection; use parameterized queries with placeholders.
Rationale:Embedding user input directly into SQL via f-strings creates SQL injection
vulnerabilities. Parameterized queries (or prepared statements) separate SQL logic from data,
preventing injection.
Page 3
, Section A - Software Security Testing
Why the other answers are wrong:
B. XSS involves injecting client-side scripts into web pages, not SQL queries.
C. Command injection occurs when user input is passed to system commands, not SQL.
D. Path traversal is about file system access, not database queries.
Reference: OWASP Top 10 2021 - A03: Injection
Q3.
In a Python application, you need to configure logging to write to both the console and a
rotating file. Which logging configuration achieves this?
A. Create two handlers (StreamHandler and B. Set up a single handler that logs to a file
RotatingFileHandler) and add both to the and use print statements for console output.
root logger.
C. Use logging.basicConfig to set a file D. Create two loggers, one for console and
name and then add a StreamHandler to the one for file, and log to both manually.
same logger.
Correct: A - Create two handlers (StreamHandler and RotatingFileHandler) and add both to
the root logger.
Rationale:The standard approach is to attach multiple handlers to a logger. StreamHandler
writes to the console, and RotatingFileHandler writes to a file with rotation. Both can be added
to the root logger or a named logger.
Why the other answers are wrong:
B. Using print statements bypasses the logging framework, losing log levels and formatting.
C. basicConfig only configures a single handler; adding another requires manual handler
creation.
D. Using two loggers would require duplicating log calls and does not allow a single logger to
have multiple outputs.
Reference: Python Logging Cookbook - Multiple handlers
Q4.
When performing a static analysis security review, which finding is most likely a false
positive that requires manual verification?
A. A tainted variable reaching a dangerous B. A hardcoded password detected in
sink without sanitization. source code.
C. A potential SQL injection where the input D. An insecure cryptographic algorithm such
is actually sanitized by an ORM. as MD5 being used for password hashing.
Correct: C - A potential SQL injection where the input is actually sanitized by an ORM.
Page 4
SECURITY AND TESTING, STATIC ANALYSIS, PYTHON
LOGGING & UNIT TESTS | COMPLETE REPORT | 2026 UPDATED.
80 Questions with Answers and Detailed Rationales
100 PERCENT GUARANTEED PASS
INSTANT DOWNLOAD ANSWERS INCLUDED
IMPORTANCE OF THIS DOCUMENT
This comprehensive examination preparation guide has been meticulously developed to help you succeed in the
WGU D385 TASK 1 PERFORMANCE ASSESSMENT | SOFTWARE SECURITY AND TESTING, STATIC
ANALYSIS, PYTHON LOGGING & UNIT TESTS | COMPLETE REPORT | 2026 UPDATED.. It contains 80
carefully selected questions that reflect the most current exam content and testing strategies. Each question is
accompanied by a correct answer and a detailed rationale that explains the underlying pathophysiology,
pharmacology, or clinical reasoning.
Self-Assessment – Test your knowledge and Exam Preparation – Familiarize yourself with the
identify areas requiring further question format and content
study areas
Concept Reinforcement – Deepen your Confidence Building – Develop test-taking
understanding through strategies and reduce
evidence-based exam anxiety
rationales
Time Management – Practice answering
questions under simulated
exam conditions
Review Summary 80 Questions
Foundations - Application - WGU D385 TASK 1 Performance Assessment Software Security AND Testing
Static Analysis Python Logging & UNIT Tests Complete Report 2026 Updated WGU D385 TASK 1
Performance Assessment Software Security AND Testing Static Analysis Python Logging & UNIT Tests
Complete Report 2026 Updated University
All answers with rationales
,Table of Contents
Content Area Questions Key Topics
Software Security Testing 1-14 Python, Application, Function, Approach, Logging
Static Analysis 15-28 Python, Logging, Security, Application, Developer
Python Logging 29-42 Python, Static Analysis, Logging, Vulnerability, Function
UNIT Tests 43-56 Python, Security, Input, Logging, Ensure
Secure Coding Practices 57-70 Analysis, Python, Logging, Function, Security
Vulnerability Assessment 71-80 Python, Developer, Logging, Approach, Function
TOTAL 80 All questions include answers and detailed rationales
,Section A - Software Security Testing
Q1.
In a Python unit test suite, you need to verify that a function logs an ERROR when a retry
limit is exceeded. Which approach best ensures the test is isolated and does not depend
on logging configuration?
A. Use assertLogs to capture log records B. Mock logging.getLogger and assert the
and assert on the message. mock's error method was called.
C. Configure a FileHandler and read the log D. Replace the logger with a custom object
file after the test. that records calls.
Correct: A - Use assertLogs to capture log records and assert on the message.
Rationale:assertLogs is the built-in, recommended way to test logging messages within a
test, as it sets up a handler and captures records without affecting global logging
configuration. Mocking the logger or using a file handler can be fragile and couples the test to
implementation details.
Why the other answers are wrong:
B. Mocking the logger only checks that the logging call was made, not the actual message
content or level.
C. Writing to a file introduces I/O dependencies and requires cleanup, making tests slower and
less reliable.
D. Replacing the logger with a custom object is possible but bypasses the standard logging
machinery and may miss integration issues.
Reference: Python Standard Library, unittest - assertLogs
Q2.
During a static analysis review of a Python web application, you encounter a SQL query
built using f-strings with user input. Which class of vulnerability is this and what is the
most effective mitigation?
A. SQL injection; use parameterized queries B. Cross-site scripting; escape all output.
with placeholders.
C. Command injection; validate input D. Path traversal; sanitize the input with
against a whitelist. os.path.basename.
Correct: A - SQL injection; use parameterized queries with placeholders.
Rationale:Embedding user input directly into SQL via f-strings creates SQL injection
vulnerabilities. Parameterized queries (or prepared statements) separate SQL logic from data,
preventing injection.
Page 3
, Section A - Software Security Testing
Why the other answers are wrong:
B. XSS involves injecting client-side scripts into web pages, not SQL queries.
C. Command injection occurs when user input is passed to system commands, not SQL.
D. Path traversal is about file system access, not database queries.
Reference: OWASP Top 10 2021 - A03: Injection
Q3.
In a Python application, you need to configure logging to write to both the console and a
rotating file. Which logging configuration achieves this?
A. Create two handlers (StreamHandler and B. Set up a single handler that logs to a file
RotatingFileHandler) and add both to the and use print statements for console output.
root logger.
C. Use logging.basicConfig to set a file D. Create two loggers, one for console and
name and then add a StreamHandler to the one for file, and log to both manually.
same logger.
Correct: A - Create two handlers (StreamHandler and RotatingFileHandler) and add both to
the root logger.
Rationale:The standard approach is to attach multiple handlers to a logger. StreamHandler
writes to the console, and RotatingFileHandler writes to a file with rotation. Both can be added
to the root logger or a named logger.
Why the other answers are wrong:
B. Using print statements bypasses the logging framework, losing log levels and formatting.
C. basicConfig only configures a single handler; adding another requires manual handler
creation.
D. Using two loggers would require duplicating log calls and does not allow a single logger to
have multiple outputs.
Reference: Python Logging Cookbook - Multiple handlers
Q4.
When performing a static analysis security review, which finding is most likely a false
positive that requires manual verification?
A. A tainted variable reaching a dangerous B. A hardcoded password detected in
sink without sanitization. source code.
C. A potential SQL injection where the input D. An insecure cryptographic algorithm such
is actually sanitized by an ORM. as MD5 being used for password hashing.
Correct: C - A potential SQL injection where the input is actually sanitized by an ORM.
Page 4
