Software Security and Testing (WGU - D385)
UPDATED ACTUAL Questions and
CORRECT Answers
HTTP status code 403 - CORRECT ANSWER -Forbidden - Client lacks necessary
permissions
HTTP status code 405 - CORRECT ANSWER -Method Not Allowed - Endpoint does not
support the HTTP method
HTTP status code 404 - CORRECT ANSWER -Not Found - The requested resource does
not exist
User-Agent header - CORRECT ANSWER -Specifies what software the client is using to
communicate with the server
Authentication header - CORRECT ANSWER -Specifies the credentials of the user
calling the API
Denial of Service - CORRECT ANSWER -An attack that involves an overload of requests
to degrade system performance
Code Injection - CORRECT ANSWER -An attack that allows an attacker to insert
malicious code into a program
HSTS headers absence - CORRECT ANSWER -Indicates a vulnerability to Man-in-the-
Middle Attack
Accept header - CORRECT ANSWER -Specifies the content type the client can accept
, Content-Type header - CORRECT ANSWER -Specifies the type of content the server will
respond with
HTTP status code 400 - CORRECT ANSWER -Bad Request - Invalid syntax or
formatting
Regression Testing - CORRECT ANSWER -A software testing method that uses old test
cases to verify the impact of recent changes
Timing of regression testing - CORRECT ANSWER -Should be conducted after code
changes are implemented
Cross-Site Scripting - CORRECT ANSWER -An attack that involves executing malicious
scripts on a victim's browser
Log injection - CORRECT ANSWER -Allows an attacker to inject commands that a
parser can execute
OAuth - CORRECT ANSWER -A protocol that commonly uses tokens to authenticate
users and caches them for reuse
Server header - CORRECT ANSWER -Specifies the software the server is using
response.content - CORRECT ANSWER -Returns the raw binary content of the HTTP
response as bytes
Type and Range Check - CORRECT ANSWER -Input validation that checks data types
and value ranges
Defense against log injection attacks - CORRECT ANSWER -Sanitize outbound log
messages
UPDATED ACTUAL Questions and
CORRECT Answers
HTTP status code 403 - CORRECT ANSWER -Forbidden - Client lacks necessary
permissions
HTTP status code 405 - CORRECT ANSWER -Method Not Allowed - Endpoint does not
support the HTTP method
HTTP status code 404 - CORRECT ANSWER -Not Found - The requested resource does
not exist
User-Agent header - CORRECT ANSWER -Specifies what software the client is using to
communicate with the server
Authentication header - CORRECT ANSWER -Specifies the credentials of the user
calling the API
Denial of Service - CORRECT ANSWER -An attack that involves an overload of requests
to degrade system performance
Code Injection - CORRECT ANSWER -An attack that allows an attacker to insert
malicious code into a program
HSTS headers absence - CORRECT ANSWER -Indicates a vulnerability to Man-in-the-
Middle Attack
Accept header - CORRECT ANSWER -Specifies the content type the client can accept
, Content-Type header - CORRECT ANSWER -Specifies the type of content the server will
respond with
HTTP status code 400 - CORRECT ANSWER -Bad Request - Invalid syntax or
formatting
Regression Testing - CORRECT ANSWER -A software testing method that uses old test
cases to verify the impact of recent changes
Timing of regression testing - CORRECT ANSWER -Should be conducted after code
changes are implemented
Cross-Site Scripting - CORRECT ANSWER -An attack that involves executing malicious
scripts on a victim's browser
Log injection - CORRECT ANSWER -Allows an attacker to inject commands that a
parser can execute
OAuth - CORRECT ANSWER -A protocol that commonly uses tokens to authenticate
users and caches them for reuse
Server header - CORRECT ANSWER -Specifies the software the server is using
response.content - CORRECT ANSWER -Returns the raw binary content of the HTTP
response as bytes
Type and Range Check - CORRECT ANSWER -Input validation that checks data types
and value ranges
Defense against log injection attacks - CORRECT ANSWER -Sanitize outbound log
messages
