WGU D385 SOFTWARE SECURITY AND TESTING - FULL
COURS BANK UPDATED ACTUAL QUESTIONS AND
CORRECT ANSWERS
Question:
1. COURSE: What is D385 and how is it assessed?
Answer:
Software Security and Testing (BSCSIA). One performance assessment (ZHN1) with two tasks, no
objective exam: Task 1 = logging/testing a Flask app, Task 2 = secure coding and secure API
implementation
Question:
2. COURSE: The three course competencies
Answer:
4102.1.1 Evaluates application and network logs; 4102.1.2 Develops mitigation solutions for
vulnerabilities; 4102.1.3 Configures security authentication for REST APIs
Question:
3. COURSE: Task 1 vs Task 2 in one line each
Answer:
Task 1: add logging, error handling, assertions, and passing unit tests to the equipment rental app. Task 2:
remediate 2 general + 2 API vulnerabilities, write 4 tests proving it, and report on
mitigation/validation/exceptions/encryption
Question:
4. COURSE: Course textbook
Answer:
Full Stack Python Security by Dennis Byrne (cryptography, TLS, attack resistance)
- cite it in reports
Question:
5. COURSE: SAST vs DAST
Answer:
SAST analyzes source code without running it (Bandit, flake8); DAST probes the running application
from outside (penetration testing)
Question:
6. COURSE: CIA triad
Answer:
Confidentiality (only authorized access), Integrity (data unaltered), Availability (accessible when needed) -
every vuln maps to breaking at least one
Question:
7. COURSE: Least privilege
, Answer:
Every user/process gets only the minimum access needed; in Task 2 the USERS_DB roles
(admin/user/guest) exist to enforce it on endpoints
Question:
8. COURSE: Defense in depth
Answer:
Multiple overlapping controls so one failure doesn't equal compromise, e.g. input validation +
parameterized queries + least-privilege DB account
Question:
9. COURSE: OWASP Top 10
Answer:
The Open Worldwide Application Security Project's ranked list of the most critical web app risks
(injection, broken access control, crypto failures, etc.) - the industry vocabulary for Task 2 vuln categories
Question:
10. COURSE: CWE vs CVE
Answer:
CWE = category of weakness in code (CWE-259 hardcoded password); CVE = a specific disclosed
vulnerability in a specific product
Question:
11. COURSE: Secure SDLC / shift-left
Answer:
Building security in during development (static analysis, unit tests, code review) instead of bolting it on
after release - the premise of both tasks
Question:
12. TASK 1: What does Task 1 require overall?
Answer:
B1 correct log file capturing time/level/event/action; B2 try/except handling 2 runtime errors (1 ERROR +
1 WARNING log); B3 two assertions each proven by an INFO entry; B4 screenshot of app running; B5
screenshots of 4 unique passing tests
Question:
13. TASK 1: Log file name and configuration
Answer:
Troubleshooting_009963434.log, format %(asctime)s - %(levelname)s - %(message)s, INFO level, one
logging.basicConfig at module top; messages follow EVENT: [event] | ACTION: [action]
Question:
14. TASK 1: The two handled runtime errors and their levels
Answer:
KeyError (unknown equipment_type) logged ERROR; ValueError/TypeError (bad or missing days)
logged WARNING - both in the /rent try/except
COURS BANK UPDATED ACTUAL QUESTIONS AND
CORRECT ANSWERS
Question:
1. COURSE: What is D385 and how is it assessed?
Answer:
Software Security and Testing (BSCSIA). One performance assessment (ZHN1) with two tasks, no
objective exam: Task 1 = logging/testing a Flask app, Task 2 = secure coding and secure API
implementation
Question:
2. COURSE: The three course competencies
Answer:
4102.1.1 Evaluates application and network logs; 4102.1.2 Develops mitigation solutions for
vulnerabilities; 4102.1.3 Configures security authentication for REST APIs
Question:
3. COURSE: Task 1 vs Task 2 in one line each
Answer:
Task 1: add logging, error handling, assertions, and passing unit tests to the equipment rental app. Task 2:
remediate 2 general + 2 API vulnerabilities, write 4 tests proving it, and report on
mitigation/validation/exceptions/encryption
Question:
4. COURSE: Course textbook
Answer:
Full Stack Python Security by Dennis Byrne (cryptography, TLS, attack resistance)
- cite it in reports
Question:
5. COURSE: SAST vs DAST
Answer:
SAST analyzes source code without running it (Bandit, flake8); DAST probes the running application
from outside (penetration testing)
Question:
6. COURSE: CIA triad
Answer:
Confidentiality (only authorized access), Integrity (data unaltered), Availability (accessible when needed) -
every vuln maps to breaking at least one
Question:
7. COURSE: Least privilege
, Answer:
Every user/process gets only the minimum access needed; in Task 2 the USERS_DB roles
(admin/user/guest) exist to enforce it on endpoints
Question:
8. COURSE: Defense in depth
Answer:
Multiple overlapping controls so one failure doesn't equal compromise, e.g. input validation +
parameterized queries + least-privilege DB account
Question:
9. COURSE: OWASP Top 10
Answer:
The Open Worldwide Application Security Project's ranked list of the most critical web app risks
(injection, broken access control, crypto failures, etc.) - the industry vocabulary for Task 2 vuln categories
Question:
10. COURSE: CWE vs CVE
Answer:
CWE = category of weakness in code (CWE-259 hardcoded password); CVE = a specific disclosed
vulnerability in a specific product
Question:
11. COURSE: Secure SDLC / shift-left
Answer:
Building security in during development (static analysis, unit tests, code review) instead of bolting it on
after release - the premise of both tasks
Question:
12. TASK 1: What does Task 1 require overall?
Answer:
B1 correct log file capturing time/level/event/action; B2 try/except handling 2 runtime errors (1 ERROR +
1 WARNING log); B3 two assertions each proven by an INFO entry; B4 screenshot of app running; B5
screenshots of 4 unique passing tests
Question:
13. TASK 1: Log file name and configuration
Answer:
Troubleshooting_009963434.log, format %(asctime)s - %(levelname)s - %(message)s, INFO level, one
logging.basicConfig at module top; messages follow EVENT: [event] | ACTION: [action]
Question:
14. TASK 1: The two handled runtime errors and their levels
Answer:
KeyError (unknown equipment_type) logged ERROR; ValueError/TypeError (bad or missing days)
logged WARNING - both in the /rent try/except
