WGU D385 SOFTWARE SECURITY AND
TESTING PRE ASSESSMENT ACTUAL
QUESTIONS AND CORRECT ANSWERS
◉ CLASS: The Task 2 scenario in one line
Answer: Internal Construction Equipment Rental API (v2.2.0,
endpoints under /api/v1/) is suffering unauthorized access
attempts, suspicious input patterns, and failing authorization logic -
you are the developer securing it
◉ CLASS: What goes in the final Task 2 submission?
Answer: ONE zip containing the written report (Word docx) plus the
modified Python script and the test script - the starter tells you to
save your fixed app as app_solution.py
◉ CLASS: The evidence files provided with the starter
Answer: app_student.py (vulnerable code), task_2_flake8_report.txt
(general vulns for Section A), task_2_bandit_report.txt (API vulns for
Section B), network_security_log.txt (attack evidence),
penetration_test_report.json (fill-in template)
◉ CLASS: Security principles the task intro names
, Answer: Least privilege, defense in depth, encryption, API keys, and
OAuth - be ready to explain how each protects modern APIs
◉ CLASS: Course textbook to cite in the report
Answer: Full Stack Python Security by Dennis Byrne -
hashing/salting, TLS, and attack chapters map directly to D1-D4
◉ CLASS: The two submission gates before evaluation
Answer: WGU similarity checker (wait for the report and review it)
and Grammarly for Education (submission cannot pass without
professional communication passing)
◉ RUBRIC: Section A pattern (A1-A3)
Answer: Pick 2 GENERAL vulnerabilities from the flake8 report. A1
screenshot the insecure code WITH line numbers, A2 implement a
secure replacement using industry practice, A3 comment out the
original code so it no longer executes - never delete it
◉ RUBRIC: Section B pattern (B1-B3)
Answer: Same three-step evidence for 2 API security vulnerabilities
sourced from the bandit report: insecure screenshot with line
numbers, secure replacement, original commented out
◉ RUBRIC: Section C requirements (C1-C5)
TESTING PRE ASSESSMENT ACTUAL
QUESTIONS AND CORRECT ANSWERS
◉ CLASS: The Task 2 scenario in one line
Answer: Internal Construction Equipment Rental API (v2.2.0,
endpoints under /api/v1/) is suffering unauthorized access
attempts, suspicious input patterns, and failing authorization logic -
you are the developer securing it
◉ CLASS: What goes in the final Task 2 submission?
Answer: ONE zip containing the written report (Word docx) plus the
modified Python script and the test script - the starter tells you to
save your fixed app as app_solution.py
◉ CLASS: The evidence files provided with the starter
Answer: app_student.py (vulnerable code), task_2_flake8_report.txt
(general vulns for Section A), task_2_bandit_report.txt (API vulns for
Section B), network_security_log.txt (attack evidence),
penetration_test_report.json (fill-in template)
◉ CLASS: Security principles the task intro names
, Answer: Least privilege, defense in depth, encryption, API keys, and
OAuth - be ready to explain how each protects modern APIs
◉ CLASS: Course textbook to cite in the report
Answer: Full Stack Python Security by Dennis Byrne -
hashing/salting, TLS, and attack chapters map directly to D1-D4
◉ CLASS: The two submission gates before evaluation
Answer: WGU similarity checker (wait for the report and review it)
and Grammarly for Education (submission cannot pass without
professional communication passing)
◉ RUBRIC: Section A pattern (A1-A3)
Answer: Pick 2 GENERAL vulnerabilities from the flake8 report. A1
screenshot the insecure code WITH line numbers, A2 implement a
secure replacement using industry practice, A3 comment out the
original code so it no longer executes - never delete it
◉ RUBRIC: Section B pattern (B1-B3)
Answer: Same three-step evidence for 2 API security vulnerabilities
sourced from the bandit report: insecure screenshot with line
numbers, secure replacement, original commented out
◉ RUBRIC: Section C requirements (C1-C5)
