WGU D385 OBJECTIVE ASSESSMENT AND PRE -
ASSESSMENT NEWEST 2026 TEST BANK| D385
SOFTWARE SECURITY AND TESTING OA & PA WITH
COMPLETE 200 REAL EXAM QUESTIONS AND
CORRECT VERIFIED ANSWERS/ ALREADY GRADED
A+ (MOST RECENT!!)
What are two common defensive coding techniques?
A. Check functional preconditions and postconditions
B. Encrypt passwords and email submissions
C. Adjust length and encoding of messages
D. Develop code with exceptions to find errors - Correct Answer -A.
Check functional preconditions and postconditions
A security analyst has noticed a vulnerability in which an attacker took
over multiple users' accounts. Which vulnerability did the security
analyst encounter?
A. Broken access control
B. Broken function level authorization
C. API mass assignment
D. Privilege escalation - Correct Answer -A. Broken access control
When creating a new user, an administrator must submit the following
fields to an API endpoint:
pg. 1
,Name
Email Address
Password
IsAdmin
What is the best way to ensure the API is protected against privilege
escalation?
A. Implement resource and field-level access control
B. Ensure incoming requests are rate limited
C. Remove IsAdmin from the endpoint
D. Encrypt the incoming request - Correct Answer -A. Implement
resource and field-level access control
Which method is used for a SQL injection attack?
A. Exploiting query parameters
B. Passing safe query parameters
C. Using SQL composition
D. Utilizing literal parameters - Correct Answer -A. Exploiting query
parameters
Which protocol caches a token after it has been acquired?
A. MSAL
B. Auth0
pg. 2
,C. LDAP
D. ACL - Correct Answer -A. MSAL
Consider the following API code snippet:
import requests
url = 'https://website.com/'
# Get request
result = requests.get(url)
# Print request
print(result.content.decode())
Which status code will the server return?
A. 403
B. 200
C. 401
D. 400 - Correct Answer -A. 403
Consider the following assertion statement:
def authorizeAdmin(usr):
assert isinstance(usr, list) and usr != [], "No user found"
assert 'admin' in usr, "No admin found."
pg. 3
, print("You are granted full access to the application.")
if __name__ == '__main__':
authorizeAdmin(['user'])
What should be the response after running the code?
A. Authorized User
B. You are granted full access to the application
C. AssertionError: No admin found
D. AssertionError: No user found - Correct Answer -- AssertionError:
No admin found
Which response method, when sent a request, returns information about
the server's response and is delivered back to the console?
A. response.content
B. response.history
C. response.status_code
D. response.get - Correct Answer -A. response.content
import logging
import sys
#log division by zero error to the log, the output is printed to the screen
def divideByZeroError(dividend, divisor):
pg. 4
ASSESSMENT NEWEST 2026 TEST BANK| D385
SOFTWARE SECURITY AND TESTING OA & PA WITH
COMPLETE 200 REAL EXAM QUESTIONS AND
CORRECT VERIFIED ANSWERS/ ALREADY GRADED
A+ (MOST RECENT!!)
What are two common defensive coding techniques?
A. Check functional preconditions and postconditions
B. Encrypt passwords and email submissions
C. Adjust length and encoding of messages
D. Develop code with exceptions to find errors - Correct Answer -A.
Check functional preconditions and postconditions
A security analyst has noticed a vulnerability in which an attacker took
over multiple users' accounts. Which vulnerability did the security
analyst encounter?
A. Broken access control
B. Broken function level authorization
C. API mass assignment
D. Privilege escalation - Correct Answer -A. Broken access control
When creating a new user, an administrator must submit the following
fields to an API endpoint:
pg. 1
,Name
Email Address
Password
IsAdmin
What is the best way to ensure the API is protected against privilege
escalation?
A. Implement resource and field-level access control
B. Ensure incoming requests are rate limited
C. Remove IsAdmin from the endpoint
D. Encrypt the incoming request - Correct Answer -A. Implement
resource and field-level access control
Which method is used for a SQL injection attack?
A. Exploiting query parameters
B. Passing safe query parameters
C. Using SQL composition
D. Utilizing literal parameters - Correct Answer -A. Exploiting query
parameters
Which protocol caches a token after it has been acquired?
A. MSAL
B. Auth0
pg. 2
,C. LDAP
D. ACL - Correct Answer -A. MSAL
Consider the following API code snippet:
import requests
url = 'https://website.com/'
# Get request
result = requests.get(url)
# Print request
print(result.content.decode())
Which status code will the server return?
A. 403
B. 200
C. 401
D. 400 - Correct Answer -A. 403
Consider the following assertion statement:
def authorizeAdmin(usr):
assert isinstance(usr, list) and usr != [], "No user found"
assert 'admin' in usr, "No admin found."
pg. 3
, print("You are granted full access to the application.")
if __name__ == '__main__':
authorizeAdmin(['user'])
What should be the response after running the code?
A. Authorized User
B. You are granted full access to the application
C. AssertionError: No admin found
D. AssertionError: No user found - Correct Answer -- AssertionError:
No admin found
Which response method, when sent a request, returns information about
the server's response and is delivered back to the console?
A. response.content
B. response.history
C. response.status_code
D. response.get - Correct Answer -A. response.content
import logging
import sys
#log division by zero error to the log, the output is printed to the screen
def divideByZeroError(dividend, divisor):
pg. 4
