WGU D385 SOFTWARE SECURITY AND
TESTING PRE ASSESSMENT EXAM REVIEW
QUESTIONS AND CORRECT ANSWERS
◉ COURSE: The three course competencies.
Answer: 4102.1.1 Evaluates application and network logs; 4102.1.2
Develops mitigation solutions for vulnerabilities; 4102.1.3
Configures security authentication for REST APIs
◉ COURSE: Task 1 vs Task 2 in one line each.
Answer: Task 1: add logging, error handling, assertions, and passing
unit tests to the equipment rental app. Task 2: remediate 2 general +
2 API vulnerabilities, write 4 tests proving it, and report on
mitigation/validation/exceptions/encryption
◉ COURSE: Course textbook.
Answer: Full Stack Python Security by Dennis Byrne (cryptography,
TLS, attack resistance) - cite it in reports
◉ COURSE: SAST vs DAST.
Answer: SAST analyzes source code without running it (Bandit,
flake8); DAST probes the running application from outside
(penetration testing)
,◉ COURSE: CIA triad.
Answer: Confidentiality (only authorized access), Integrity (data
unaltered), Availability (accessible when needed) - every vuln maps
to breaking at least one
◉ COURSE: Least privilege.
Answer: Every user/process gets only the minimum access needed;
in Task 2 the USERS_DB roles (admin/user/guest) exist to enforce it
on endpoints
◉ COURSE: Defense in depth.
Answer: Multiple overlapping controls so one failure doesn't equal
compromise, e.g. input validation + parameterized queries + least-
privilege DB account
◉ COURSE: OWASP Top 10.
Answer: The Open Worldwide Application Security Project's ranked
list of the most critical web app risks (injection, broken access
control, crypto failures, etc.) - the industry vocabulary for Task 2
vuln categories
◉ COURSE: CWE vs CVE.
, Answer: CWE = category of weakness in code (CWE-259 hardcoded
password); CVE = a specific disclosed vulnerability in a specific
product
◉ COURSE: Secure SDLC / shift-left.
Answer: Building security in during development (static analysis,
unit tests, code review) instead of bolting it on after release - the
premise of both tasks
◉ TASK 1: What does Task 1 require overall?.
Answer: B1 correct log file capturing time/level/event/action; B2
try/except handling 2 runtime errors (1 ERROR + 1 WARNING log);
B3 two assertions each proven by an INFO entry; B4 screenshot of
app running; B5 screenshots of 4 unique passing tests
◉ TASK 1: Log file name and configuration.
Answer: Troubleshooting_009963434.log, format %(asctime)s -
%(levelname)s - %(message)s, INFO level, one logging.basicConfig
at module top; messages follow EVENT: [event] | ACTION: [action]
◉ TASK 1: The two handled runtime errors and their levels.
Answer: KeyError (unknown equipment_type) logged ERROR;
ValueError/TypeError (bad or missing days) logged WARNING -
both in the /rent try/except
TESTING PRE ASSESSMENT EXAM REVIEW
QUESTIONS AND CORRECT ANSWERS
◉ COURSE: The three course competencies.
Answer: 4102.1.1 Evaluates application and network logs; 4102.1.2
Develops mitigation solutions for vulnerabilities; 4102.1.3
Configures security authentication for REST APIs
◉ COURSE: Task 1 vs Task 2 in one line each.
Answer: Task 1: add logging, error handling, assertions, and passing
unit tests to the equipment rental app. Task 2: remediate 2 general +
2 API vulnerabilities, write 4 tests proving it, and report on
mitigation/validation/exceptions/encryption
◉ COURSE: Course textbook.
Answer: Full Stack Python Security by Dennis Byrne (cryptography,
TLS, attack resistance) - cite it in reports
◉ COURSE: SAST vs DAST.
Answer: SAST analyzes source code without running it (Bandit,
flake8); DAST probes the running application from outside
(penetration testing)
,◉ COURSE: CIA triad.
Answer: Confidentiality (only authorized access), Integrity (data
unaltered), Availability (accessible when needed) - every vuln maps
to breaking at least one
◉ COURSE: Least privilege.
Answer: Every user/process gets only the minimum access needed;
in Task 2 the USERS_DB roles (admin/user/guest) exist to enforce it
on endpoints
◉ COURSE: Defense in depth.
Answer: Multiple overlapping controls so one failure doesn't equal
compromise, e.g. input validation + parameterized queries + least-
privilege DB account
◉ COURSE: OWASP Top 10.
Answer: The Open Worldwide Application Security Project's ranked
list of the most critical web app risks (injection, broken access
control, crypto failures, etc.) - the industry vocabulary for Task 2
vuln categories
◉ COURSE: CWE vs CVE.
, Answer: CWE = category of weakness in code (CWE-259 hardcoded
password); CVE = a specific disclosed vulnerability in a specific
product
◉ COURSE: Secure SDLC / shift-left.
Answer: Building security in during development (static analysis,
unit tests, code review) instead of bolting it on after release - the
premise of both tasks
◉ TASK 1: What does Task 1 require overall?.
Answer: B1 correct log file capturing time/level/event/action; B2
try/except handling 2 runtime errors (1 ERROR + 1 WARNING log);
B3 two assertions each proven by an INFO entry; B4 screenshot of
app running; B5 screenshots of 4 unique passing tests
◉ TASK 1: Log file name and configuration.
Answer: Troubleshooting_009963434.log, format %(asctime)s -
%(levelname)s - %(message)s, INFO level, one logging.basicConfig
at module top; messages follow EVENT: [event] | ACTION: [action]
◉ TASK 1: The two handled runtime errors and their levels.
Answer: KeyError (unknown equipment_type) logged ERROR;
ValueError/TypeError (bad or missing days) logged WARNING -
both in the /rent try/except
