WGU D385 QUESTIONS WITH VERIFIED ANSWERS
What is the primary defense against log injection attacks? - Answers - Sanitize
outbound log messages
An attacker exploits a cross-site scripting vulnerability. What is the attacker able to do? -
Answers - Access the user's data
Which Python function is prone to a potential code injection attack? - Answers - eval()
What are two common defensive coding techniques? - Answers - Check functional and
preconditions and postconditions
Which package is meant for internal use by Python for regression testing? - Answers -
test
A security analyst has noticed a vulnerability in which an attacker took over multiple
users' accounts. Which vulnerability did the security analyst encounter? - Answers -
Broken access control
When creating a new user, an administrator must submit the following fields to an API
endpoint:
Name
Email Address
Password
IsAdmin
What is the best way to ensure the API is protected against privilege escalation? -
Answers - Implement resource and field-level access control
Which method is used for a SQL injection attack? - Answers - Exploiting query
parameters
What does cross-origin resource sharing (CORS) allow users to do? - Answers -
Override same starting policy for specific resources
Which protocol caches a token after it has been acquired? - Answers - MSAL
Which response method, when sent a request, returns information about the server's
response and is delivered back to the console? - Answers - response.content
What is the primary defense against log injection attacks? - Answers - Sanitize
outbound log messages
An attacker exploits a cross-site scripting vulnerability. What is the attacker able to do? -
Answers - Access the user's data
Which Python function is prone to a potential code injection attack? - Answers - eval()
What are two common defensive coding techniques? - Answers - Check functional and
preconditions and postconditions
Which package is meant for internal use by Python for regression testing? - Answers -
test
A security analyst has noticed a vulnerability in which an attacker took over multiple
users' accounts. Which vulnerability did the security analyst encounter? - Answers -
Broken access control
When creating a new user, an administrator must submit the following fields to an API
endpoint:
Name
Email Address
Password
IsAdmin
What is the best way to ensure the API is protected against privilege escalation? -
Answers - Implement resource and field-level access control
Which method is used for a SQL injection attack? - Answers - Exploiting query
parameters
What does cross-origin resource sharing (CORS) allow users to do? - Answers -
Override same starting policy for specific resources
Which protocol caches a token after it has been acquired? - Answers - MSAL
Which response method, when sent a request, returns information about the server's
response and is delivered back to the console? - Answers - response.content
