D385 Software Security and Testing
UPDATED ACTUAL Questions and
CORRECT Answers
Sanitize outbound log messages - CORRECT ANSWER -What is the primary defense
against log injection attacks?
Access the user's data - CORRECT ANSWER -An attacker exploits a cross-site scripting
vulnerability. What is the attacker able to do?
eval() - CORRECT ANSWER -Which Python function is prone to a potential code
injection attack?
Check functional preconditions and postconditions - CORRECT ANSWER -What are two
common defensive coding techniques?
test - CORRECT ANSWER -Which package is meant for internal use by Python for
regression testing?
type() - CORRECT ANSWER -Which Python function is used for input validation?
Broken access control - CORRECT ANSWER -A security analyst has noticed a
vulnerability in which an attacker took over multiple users' accounts. Which vulnerability did the
security analyst encounter?
Implement resource and field-level access control - CORRECT ANSWER -When creating
a new user, an administrator must submit the following fields to an API endpoint:
Name
Email Address
,Password
IsAdmin
What is the best way to ensure the API is protected against privilege escalation?
Exploiting query parameters - CORRECT ANSWER -Which method is used for a SQL
injection attack?
response.content - CORRECT ANSWER -Which response method, when sent a request,
returns information about the server's response and is delivered back to the console?
Override same starting policy for specific resources - CORRECT ANSWER -What does
cross-origin resource sharing (CORS) allow users to do?
MSAL - CORRECT ANSWER -Which protocol caches a token after it has been acquired?
200 - CORRECT ANSWER -OK - Your request was successful
201 - CORRECT ANSWER -CREATED - Your request was accepted, and the resource
was created
400 - CORRECT ANSWER -BAD REQUEST - Your request is either wrong or missing
information
401 - CORRECT ANSWER -UNAUTHORIZED - Your request requires additional
permissions
403 - CORRECT ANSWER -FORBIDDEN - website can be reached, but more
permissions needed before accessing further
, 404 - CORRECT ANSWER -NOT FOUND - The requested resource does not exist
405 - CORRECT ANSWER -METHOD NOT ALLOWED - The endpoint does not allow
for that specific HTTP method
500 - CORRECT ANSWER -INTERNAL SERVER ERROR - Your request was not
expected and probably broke something on the server side
Content-Type (header) - CORRECT ANSWER -What type of content the server will
respond with
Accept (header) - CORRECT ANSWER -What type of content the client can accept
Server (header) - CORRECT ANSWER -What software the server is using to
communicate with the client
User-Agent (header) - CORRECT ANSWER -What software the client is using to
communicate with the server
Authentication (header) - CORRECT ANSWER -Who's calling the API and what
credentials they have
validate() - CORRECT ANSWER -Which Python function is used to protect against log
injection attacks?
Cross Site Scripting (XSS) - CORRECT ANSWER -A user masquerades as other users,
what type of attack was used?
SQL Injection - CORRECT ANSWER -Exploiting query parameters is an example of
what attack?
UPDATED ACTUAL Questions and
CORRECT Answers
Sanitize outbound log messages - CORRECT ANSWER -What is the primary defense
against log injection attacks?
Access the user's data - CORRECT ANSWER -An attacker exploits a cross-site scripting
vulnerability. What is the attacker able to do?
eval() - CORRECT ANSWER -Which Python function is prone to a potential code
injection attack?
Check functional preconditions and postconditions - CORRECT ANSWER -What are two
common defensive coding techniques?
test - CORRECT ANSWER -Which package is meant for internal use by Python for
regression testing?
type() - CORRECT ANSWER -Which Python function is used for input validation?
Broken access control - CORRECT ANSWER -A security analyst has noticed a
vulnerability in which an attacker took over multiple users' accounts. Which vulnerability did the
security analyst encounter?
Implement resource and field-level access control - CORRECT ANSWER -When creating
a new user, an administrator must submit the following fields to an API endpoint:
Name
Email Address
,Password
IsAdmin
What is the best way to ensure the API is protected against privilege escalation?
Exploiting query parameters - CORRECT ANSWER -Which method is used for a SQL
injection attack?
response.content - CORRECT ANSWER -Which response method, when sent a request,
returns information about the server's response and is delivered back to the console?
Override same starting policy for specific resources - CORRECT ANSWER -What does
cross-origin resource sharing (CORS) allow users to do?
MSAL - CORRECT ANSWER -Which protocol caches a token after it has been acquired?
200 - CORRECT ANSWER -OK - Your request was successful
201 - CORRECT ANSWER -CREATED - Your request was accepted, and the resource
was created
400 - CORRECT ANSWER -BAD REQUEST - Your request is either wrong or missing
information
401 - CORRECT ANSWER -UNAUTHORIZED - Your request requires additional
permissions
403 - CORRECT ANSWER -FORBIDDEN - website can be reached, but more
permissions needed before accessing further
, 404 - CORRECT ANSWER -NOT FOUND - The requested resource does not exist
405 - CORRECT ANSWER -METHOD NOT ALLOWED - The endpoint does not allow
for that specific HTTP method
500 - CORRECT ANSWER -INTERNAL SERVER ERROR - Your request was not
expected and probably broke something on the server side
Content-Type (header) - CORRECT ANSWER -What type of content the server will
respond with
Accept (header) - CORRECT ANSWER -What type of content the client can accept
Server (header) - CORRECT ANSWER -What software the server is using to
communicate with the client
User-Agent (header) - CORRECT ANSWER -What software the client is using to
communicate with the server
Authentication (header) - CORRECT ANSWER -Who's calling the API and what
credentials they have
validate() - CORRECT ANSWER -Which Python function is used to protect against log
injection attacks?
Cross Site Scripting (XSS) - CORRECT ANSWER -A user masquerades as other users,
what type of attack was used?
SQL Injection - CORRECT ANSWER -Exploiting query parameters is an example of
what attack?
