WGU D385 EXAM 2 2026 ACTUAL PAPER FULL
QUESTIONS AND ANSWERS 100 PERCENT
CORRECT
◉ 403 Forbidden example. Answer: Valid token but user role lacks
permission
◉ 404 Not Found example. Answer: Requesting a resource ID that
does not exist
◉ 405 Method Not Allowed example. Answer: Sending DELETE to a
POST-only endpoint
◉ 500 Internal Server Error example. Answer: Backend exception
raised during request processing
◉ 503 Service Unavailable example. Answer: Server overloaded or
under maintenance
◉ Accept header. Answer: Specifies what content types the client can
accept
,◉ Content-Type header. Answer: Specifies the format of the data
being sent or returned
◉ Authorization header. Answer: Contains credentials such as API
keys or bearer tokens
◉ User-Agent header. Answer: Identifies the client software making
the request
◉ Server header. Answer: Reveals server software and can leak
information
◉ Strict-Transport-Security header. Answer: Forces browsers to use
HTTPS only
◉ SQL Injection. Answer: An attack that manipulates SQL queries
through unsanitized user input
◉ SQL injection vulnerable code. Answer: Using string
concatenation or f-strings in SQL queries
◉ SQL injection secure code. Answer: Using parameterized queries
with placeholders
, ◉ ORM SQL injection risk. Answer: Raw SQL with string
interpolation bypasses ORM protections
◉ Command Injection. Answer: An attack where attacker executes
OS commands via user input
◉ Shell Injection. Answer: A type of injection using shell
metacharacters
◉ eval vulnerability. Answer: eval executes user input as code and
enables code injection
◉ exec vulnerability. Answer: exec executes dynamic code and is
dangerous
◉ os.system vulnerability. Answer: Executes shell commands using
user input
◉ subprocess shell=True risk. Answer: Allows command chaining
and injection
◉ Command injection mitigation. Answer: Use allowlists and avoid
shell execution
QUESTIONS AND ANSWERS 100 PERCENT
CORRECT
◉ 403 Forbidden example. Answer: Valid token but user role lacks
permission
◉ 404 Not Found example. Answer: Requesting a resource ID that
does not exist
◉ 405 Method Not Allowed example. Answer: Sending DELETE to a
POST-only endpoint
◉ 500 Internal Server Error example. Answer: Backend exception
raised during request processing
◉ 503 Service Unavailable example. Answer: Server overloaded or
under maintenance
◉ Accept header. Answer: Specifies what content types the client can
accept
,◉ Content-Type header. Answer: Specifies the format of the data
being sent or returned
◉ Authorization header. Answer: Contains credentials such as API
keys or bearer tokens
◉ User-Agent header. Answer: Identifies the client software making
the request
◉ Server header. Answer: Reveals server software and can leak
information
◉ Strict-Transport-Security header. Answer: Forces browsers to use
HTTPS only
◉ SQL Injection. Answer: An attack that manipulates SQL queries
through unsanitized user input
◉ SQL injection vulnerable code. Answer: Using string
concatenation or f-strings in SQL queries
◉ SQL injection secure code. Answer: Using parameterized queries
with placeholders
, ◉ ORM SQL injection risk. Answer: Raw SQL with string
interpolation bypasses ORM protections
◉ Command Injection. Answer: An attack where attacker executes
OS commands via user input
◉ Shell Injection. Answer: A type of injection using shell
metacharacters
◉ eval vulnerability. Answer: eval executes user input as code and
enables code injection
◉ exec vulnerability. Answer: exec executes dynamic code and is
dangerous
◉ os.system vulnerability. Answer: Executes shell commands using
user input
◉ subprocess shell=True risk. Answer: Allows command chaining
and injection
◉ Command injection mitigation. Answer: Use allowlists and avoid
shell execution
