WGU D385 Task 1 Performance Assessment |
Software Security and Testing, Static Analysis,
Python Logging & Unit Tests | Complete Report |
2026 Updated.
WGU D385 V2 Software Security and Testing - Complete Practice Exam
180 Questions with Detailed Explanations
Section 1: Software Security Fundamentals
Question 1
What best defines the primary goal of software security?
A) To increase software performance and speed
B) To eliminate all software bugs and errors
C) To protect software from unauthorized access, modification, and destruction
D) To reduce the cost of software development
Answer: C
Explanation: Software security focuses on protecting applications and data from
threats, including unauthorized access, data breaches, and exploitation. While
performance and cost are considerations, the primary goal is protection against
security threats .
Question 2
What is the Common Vulnerability Scoring System (CVSS) used for?
,A) To assign a severity score to software vulnerabilities on a scale of 0.0 to 10.0
B) To classify software bugs by their impact on performance
C) To determine the cost of fixing a vulnerability
D) To rank software developers by their security skills
Answer: A
Explanation: CVSS is a standardized framework for rating the severity of software
vulnerabilities. Scores range from 0.0 to 10.0, with LOW (0.1-3.9), MEDIUM (4.0-
6.9), HIGH (7.0-8.9), and CRITICAL (9.0-10.0) categories .
Question 3
Which of the following is considered a non-functional requirement in software
testing?
A) User login functionality
B) Payment processing functionality
C) System response time
D) User registration form
Answer: C
Explanation: Non-functional requirements define system performance, scalability,
security, and usability rather than specific features. System response time is a
performance-related non-functional requirement .
Question 4
Which type of testing verifies that individual components of software operate
correctly?
A) Integration testing
B) Unit testing
C) System testing
D) Acceptance testing
,Answer: B
Explanation: Unit testing focuses on verifying the functionality of individual
modules or components in isolation. Integration testing verifies interactions
between components, system testing validates the complete system, and
acceptance testing ensures the system meets business requirements .
Question 5
What is the main difference between static and dynamic testing?
A) Static testing runs the code to detect runtime errors
B) Static testing analyzes code without execution; dynamic testing requires
execution
C) Dynamic testing only verifies documentation
D) Static testing cannot find logical errors
Answer: B
Explanation: Static testing inspects code or documents without running the
program, while dynamic testing involves executing the code to observe behavior.
Static analysis can find issues like hardcoded credentials before runtime .
Question 6
What security principle ensures that users can only access resources they are
authorized to use?
A) Authentication
B) Authorization
C) Confidentiality
D) Non-repudiation
Answer: B
, Explanation: Authorization controls what authenticated users are allowed to do
within a system. Authentication verifies identity, while authorization determines
what actions or resources that identity can access .
Question 7
Which algorithm uses different keys for encryption and decryption?
A) Symmetric encryption
B) Keyed hashing
C) Asymmetric encryption
D) Digital signatures
Answer: C
Explanation: Asymmetric encryption (public-key cryptography) uses different keys
for encryption and decryption. The public key encrypts, and the private key
decrypts. This solves the key distribution problem inherent in symmetric encryption
.
Question 8
Which security practice is most effective for preventing SQL injection attacks?
A) Using plaintext passwords
B) Storing sensitive data in cookies
C) Parameterizing SQL queries
D) Disabling firewalls
Answer: C
Explanation: Parameterized queries separate code from user input, preventing SQL
injection attacks. This is the most effective defense because it ensures user input is
treated as data, not executable code .
Software Security and Testing, Static Analysis,
Python Logging & Unit Tests | Complete Report |
2026 Updated.
WGU D385 V2 Software Security and Testing - Complete Practice Exam
180 Questions with Detailed Explanations
Section 1: Software Security Fundamentals
Question 1
What best defines the primary goal of software security?
A) To increase software performance and speed
B) To eliminate all software bugs and errors
C) To protect software from unauthorized access, modification, and destruction
D) To reduce the cost of software development
Answer: C
Explanation: Software security focuses on protecting applications and data from
threats, including unauthorized access, data breaches, and exploitation. While
performance and cost are considerations, the primary goal is protection against
security threats .
Question 2
What is the Common Vulnerability Scoring System (CVSS) used for?
,A) To assign a severity score to software vulnerabilities on a scale of 0.0 to 10.0
B) To classify software bugs by their impact on performance
C) To determine the cost of fixing a vulnerability
D) To rank software developers by their security skills
Answer: A
Explanation: CVSS is a standardized framework for rating the severity of software
vulnerabilities. Scores range from 0.0 to 10.0, with LOW (0.1-3.9), MEDIUM (4.0-
6.9), HIGH (7.0-8.9), and CRITICAL (9.0-10.0) categories .
Question 3
Which of the following is considered a non-functional requirement in software
testing?
A) User login functionality
B) Payment processing functionality
C) System response time
D) User registration form
Answer: C
Explanation: Non-functional requirements define system performance, scalability,
security, and usability rather than specific features. System response time is a
performance-related non-functional requirement .
Question 4
Which type of testing verifies that individual components of software operate
correctly?
A) Integration testing
B) Unit testing
C) System testing
D) Acceptance testing
,Answer: B
Explanation: Unit testing focuses on verifying the functionality of individual
modules or components in isolation. Integration testing verifies interactions
between components, system testing validates the complete system, and
acceptance testing ensures the system meets business requirements .
Question 5
What is the main difference between static and dynamic testing?
A) Static testing runs the code to detect runtime errors
B) Static testing analyzes code without execution; dynamic testing requires
execution
C) Dynamic testing only verifies documentation
D) Static testing cannot find logical errors
Answer: B
Explanation: Static testing inspects code or documents without running the
program, while dynamic testing involves executing the code to observe behavior.
Static analysis can find issues like hardcoded credentials before runtime .
Question 6
What security principle ensures that users can only access resources they are
authorized to use?
A) Authentication
B) Authorization
C) Confidentiality
D) Non-repudiation
Answer: B
, Explanation: Authorization controls what authenticated users are allowed to do
within a system. Authentication verifies identity, while authorization determines
what actions or resources that identity can access .
Question 7
Which algorithm uses different keys for encryption and decryption?
A) Symmetric encryption
B) Keyed hashing
C) Asymmetric encryption
D) Digital signatures
Answer: C
Explanation: Asymmetric encryption (public-key cryptography) uses different keys
for encryption and decryption. The public key encrypts, and the private key
decrypts. This solves the key distribution problem inherent in symmetric encryption
.
Question 8
Which security practice is most effective for preventing SQL injection attacks?
A) Using plaintext passwords
B) Storing sensitive data in cookies
C) Parameterizing SQL queries
D) Disabling firewalls
Answer: C
Explanation: Parameterized queries separate code from user input, preventing SQL
injection attacks. This is the most effective defense because it ensures user input is
treated as data, not executable code .
