WGU D385 Software Security And Testing - Questions
With Accurate Solutions (A+)
What is the primary defense against log injection attacks? Correct Answer -
Sanitize outbound log messages
An attacker exploits a cross-site scripting vulnerability. What is the attacker
able to do? Correct Answer - Access the user's data
Which Python function is prone to a potential code injection attack? Correct
Answer - eval()
What are two common defensive coding techniques? Correct Answer -
Check functional preconditions and postconditions
Which package is meant for internal use by Python for regression testing?
Correct Answer - test
Which Python function is used for input validation? Correct Answer -
type()
A security analyst has noticed a vulnerability in which an attacker took over
multiple users' accounts. Which vulnerability did the security analyst
encounter? Correct Answer - Broken access control
When creating a new user, an administrator must submit the following fields
to an API endpoint:
Name
Email Address
Password
IsAdmin
What is the best way to ensure the API is protected against privilege
escalation? Correct Answer - Implement resource and field-level access
control
, Which method is used for a SQL injection attack? Correct Answer -
Exploiting query parameters
Which response method, when sent a request, returns information about the
server's response and is delivered back to the console? Correct Answer -
response.content
What does cross-origin resource sharing (CORS) allow users to do? Correct
Answer - Override same starting policy for specific resources
Which protocol caches a token after it has been acquired? Correct Answer -
MSAL
OK - Your request was successful Correct Answer - 200
CREATED - Your request was accepted, and the resource was created
Correct Answer - 201
BAD REQUEST - Your request is either wrong or missing information
Correct Answer - 400
UNAUTHORIZED - Your request requires additional permissions Correct
Answer - 401
FORBIDDEN - website can be reached, but more permissions needed before
accessing further Correct Answer - 403
NOT FOUND - The requested resource does not exist Correct Answer - 404
METHOD NOT ALLOWED - The endpoint does not allow for that specific HTTP
method Correct Answer - 405
INTERNAL SERVER ERROR - Your request was not expected and probably
broke something on the server side Correct Answer - 500
What type of content the server will respond with Correct Answer -
Content-Type (header)
With Accurate Solutions (A+)
What is the primary defense against log injection attacks? Correct Answer -
Sanitize outbound log messages
An attacker exploits a cross-site scripting vulnerability. What is the attacker
able to do? Correct Answer - Access the user's data
Which Python function is prone to a potential code injection attack? Correct
Answer - eval()
What are two common defensive coding techniques? Correct Answer -
Check functional preconditions and postconditions
Which package is meant for internal use by Python for regression testing?
Correct Answer - test
Which Python function is used for input validation? Correct Answer -
type()
A security analyst has noticed a vulnerability in which an attacker took over
multiple users' accounts. Which vulnerability did the security analyst
encounter? Correct Answer - Broken access control
When creating a new user, an administrator must submit the following fields
to an API endpoint:
Name
Email Address
Password
IsAdmin
What is the best way to ensure the API is protected against privilege
escalation? Correct Answer - Implement resource and field-level access
control
, Which method is used for a SQL injection attack? Correct Answer -
Exploiting query parameters
Which response method, when sent a request, returns information about the
server's response and is delivered back to the console? Correct Answer -
response.content
What does cross-origin resource sharing (CORS) allow users to do? Correct
Answer - Override same starting policy for specific resources
Which protocol caches a token after it has been acquired? Correct Answer -
MSAL
OK - Your request was successful Correct Answer - 200
CREATED - Your request was accepted, and the resource was created
Correct Answer - 201
BAD REQUEST - Your request is either wrong or missing information
Correct Answer - 400
UNAUTHORIZED - Your request requires additional permissions Correct
Answer - 401
FORBIDDEN - website can be reached, but more permissions needed before
accessing further Correct Answer - 403
NOT FOUND - The requested resource does not exist Correct Answer - 404
METHOD NOT ALLOWED - The endpoint does not allow for that specific HTTP
method Correct Answer - 405
INTERNAL SERVER ERROR - Your request was not expected and probably
broke something on the server side Correct Answer - 500
What type of content the server will respond with Correct Answer -
Content-Type (header)
