2024 D385 SOFTWARE SECURITY AND TESTING / WGU
D385 SOFTWARE SECURITY AND TESTING REAL EXAM
WITH ACTUAL EXAM QUESTIONS AND CORRECT
DETAILED ANSWERS (VERIFIED ANSWERS) NEWEST
UPDATED VERSION LATEST 2024 |ALREADY GRADED A+
(BRAND NEW!!)
Attack Surface - ANSWER: - the sum of all potential entry points
Common examples of attacks that take advantage of systems with insufficient input
validation? - ANSWER: - SQLi
- RCE
- host header attack
- denial of service
Defense in Depth - ANSWER: - each layer of security is dual-purpose
1) resists an attack
2) acts as a backup when other layers fail
Most common symmetric encryption algorithm? - ANSWER: - AES
Most common hashing algorithm? - ANSWER: - SHA-2
Resource sharing protocol for browsers? - ANSWER: - CORS
- Cross-origin resource sharing
CSP - ANSWER: - Content Sharing Policy
- browser-based attack mitigation standard
Security Fundamentals - ANSWER: - Data integrity: has the data changed
- Authentication: who are you?
- Data authentication: who created the data?
- Nonrepudiation: who did what?
- Authorization: what can you do?
- Confidentiality: who can access this?
Python's answer to cryptographic hashing? - ANSWER: - hashlib module
Secure random number generation? - ANSWER: - secrets module
Hash-based message authentication? - ANSWER: - hmac module
Function used to protect passwords? - ANSWER: - argon2-cffi
, Python package for common cryptographic functions? - ANSWER: - cryptography
A safer way to parse XML? - ANSWER: - defusedxml
Web server gateway interface written in Python? - ANSWER: - Gunicorn
Python package manager? - ANSWER: - pipenv
Easy-to-use HTTP library? - ANSWER: - requests
Client-side OAuth 2.0 implementation? - ANSWER: - requests-oauthlib
Django server-side implementation for CORS? - ANSWER: - django-cors-headers
Server-side implementation of CSP? - ANSWER: - django-csp
Server-side OAuth 2.0 implementation? - ANSWER: - DJango Oauth Toollkit
Django Registration Library? - ANSWER: - django-registration
What are the 4 subclasses of SQLi? - ANSWER: - in-band SQLi (classic)
- inferential/blind SQLi
- DBMS SQLi
- Compound SQLi (e.g. Strom Worn)
What is a hash function? - ANSWER: - every hash function has an input and an
output
- the INPUT is called a message
- the OUTPUT is a very large number called a hash value (aka hash, hash code, digest,
and message digest)
- hash values are typically represented as alphanumeric strings
- INPUT is variabled
- OUTPUT is fixed
What are the 3 basic properties of hash functions? - ANSWER: - deterministic
behavior
- fixed-length hash values
- avalanche effect
What is meant by Deterministic Behavior? - ANSWER: - for a given input, a hash
function always produces the same output
- hash function behavior is repeatable, not random
What is the Avalanche Effect? - ANSWER: - small differences between messages
results in large differences between hash values
D385 SOFTWARE SECURITY AND TESTING REAL EXAM
WITH ACTUAL EXAM QUESTIONS AND CORRECT
DETAILED ANSWERS (VERIFIED ANSWERS) NEWEST
UPDATED VERSION LATEST 2024 |ALREADY GRADED A+
(BRAND NEW!!)
Attack Surface - ANSWER: - the sum of all potential entry points
Common examples of attacks that take advantage of systems with insufficient input
validation? - ANSWER: - SQLi
- RCE
- host header attack
- denial of service
Defense in Depth - ANSWER: - each layer of security is dual-purpose
1) resists an attack
2) acts as a backup when other layers fail
Most common symmetric encryption algorithm? - ANSWER: - AES
Most common hashing algorithm? - ANSWER: - SHA-2
Resource sharing protocol for browsers? - ANSWER: - CORS
- Cross-origin resource sharing
CSP - ANSWER: - Content Sharing Policy
- browser-based attack mitigation standard
Security Fundamentals - ANSWER: - Data integrity: has the data changed
- Authentication: who are you?
- Data authentication: who created the data?
- Nonrepudiation: who did what?
- Authorization: what can you do?
- Confidentiality: who can access this?
Python's answer to cryptographic hashing? - ANSWER: - hashlib module
Secure random number generation? - ANSWER: - secrets module
Hash-based message authentication? - ANSWER: - hmac module
Function used to protect passwords? - ANSWER: - argon2-cffi
, Python package for common cryptographic functions? - ANSWER: - cryptography
A safer way to parse XML? - ANSWER: - defusedxml
Web server gateway interface written in Python? - ANSWER: - Gunicorn
Python package manager? - ANSWER: - pipenv
Easy-to-use HTTP library? - ANSWER: - requests
Client-side OAuth 2.0 implementation? - ANSWER: - requests-oauthlib
Django server-side implementation for CORS? - ANSWER: - django-cors-headers
Server-side implementation of CSP? - ANSWER: - django-csp
Server-side OAuth 2.0 implementation? - ANSWER: - DJango Oauth Toollkit
Django Registration Library? - ANSWER: - django-registration
What are the 4 subclasses of SQLi? - ANSWER: - in-band SQLi (classic)
- inferential/blind SQLi
- DBMS SQLi
- Compound SQLi (e.g. Strom Worn)
What is a hash function? - ANSWER: - every hash function has an input and an
output
- the INPUT is called a message
- the OUTPUT is a very large number called a hash value (aka hash, hash code, digest,
and message digest)
- hash values are typically represented as alphanumeric strings
- INPUT is variabled
- OUTPUT is fixed
What are the 3 basic properties of hash functions? - ANSWER: - deterministic
behavior
- fixed-length hash values
- avalanche effect
What is meant by Deterministic Behavior? - ANSWER: - for a given input, a hash
function always produces the same output
- hash function behavior is repeatable, not random
What is the Avalanche Effect? - ANSWER: - small differences between messages
results in large differences between hash values
