WGU D522 | Task 1 | 2026 Research-Aligned Independent Guide
WGU D522 (WEN1)
TASK 1 PERFORMANCE ASSESSMENT
Incident Response & DNS Remediation
Python Automation • GitLab • Device Inventory • DNS Verification • Stakeholder Email •
Helpdesk API • Service Recovery • Evidence & Submission
2026 Updated | Research-aligned to the current PA workflow available in July-September
2026
IMPORTANT ALIGNMENT NOTE
This is an independently written instructional resource, not an official WGU answer key and not a substitute for
the live task page. WGU can change the lab, templates, endpoints, branch rules, and rubric. Use the current WGU
task page, supporting documents, and lab side panel as the controlling source. All screenshots, branch history,
service results, device values, API responses, and email evidence must come from the learner's own assigned lab.
Purpose: replace the earlier audit-only draft with a complete, practical, current Task 1 learning and execution
guide.
Independent study resource | Verify against the live WGU task page | Page 1
, WGU D522 | Task 1 | 2026 Research-Aligned Independent Guide
1. Why the Earlier Version Earned a 3-Star Outcome
The earlier 23-page PDF was technically detailed in a narrow area, but it was aligned to only part of the current
Task 1 workflow. The central problem was not writing quality; it was scope accuracy. Recent 2026 evidence
indicates that the PA version of D522 Task 1 is an incident-response and remediation workflow, not merely a
read-only inventory and DNS audit.
Earlier PDF behavior Why it is a problem now Correction in this rewrite
Called itself a “complete” guide while A buyer expects the product to map to the This guide maps the full A-F workflow and
stating the official rubric and lab files current task, not ask them to reconstruct labels what must be verified in the live
were not available. the rubric themselves. portal.
Focused on inventory, ping, SSH, Current Task 1 evidence also includes Adds dedicated C, D, and E sections with
resolvectl, logging, and a read-only audit. stakeholder alerting, helpdesk ticket code architecture, evidence expectations,
creation, DNS service restoration, and troubleshooting.
endpoint DNS correction, and a resolution
notification.
Explicitly disabled remediation and Current Task 1 sources show remediation Adds separate service-status, service-
warned not to restart services unless the is a required part of the incident scenario. restart, and affected-device DNS-
task required it. correction workflows.
No stakeholder email section and no These are independent graded Adds SMTP/MailHog workflow and HTTP
ticket/API section. deliverables in current Task 1 sources. API ticket workflow, with lab values kept
configurable.
Screenshot boxes were placeholders, and A guide full of empty boxes can feel Replaces empty “insert screenshot” boxes
the validation matrix was unfinished. incomplete even when the intent is with precise capture instructions,
ethical. expected evidence, and a final checklist.
Assumed an SSH/Paramiko path for all Recent students report lab-specific access Uses an adapter approach: follow the lab-
device access. patterns, including localhost/console-port provided access method and support
Telnet and SSH. A rigid transport either Telnet-console or SSH where
assumption can break otherwise good appropriate.
code.
Screenshot guidance said date/time Current Task 1 mirrors and student Makes visible date/time an explicit
“where available.” revision reports indicate date/time is evidence rule.
mandatory in submitted screenshots.
MOST IMPORTANT CORRECTION
The earlier document treats remediation as optional. Current 2026 Task 1 evidence instead shows an end-to-end
incident workflow: discover/verify -> notify -> create tickets -> restore DNS service -> correct affected devices ->
notify resolution. That scope mismatch is the most serious content error.
2. Research Basis and Confidence
The public WGU catalog confirms D522 is Python for IT Automation and describes it as applying Python and
programming logic to IT tasks and secure, resilient systems. The public catalog does not expose the internal PA
rubric. For the current Task 1 structure, this rewrite cross-checks a publicly indexed Task 1 mirror with recent
July-September 2026 student reports. Because those internal instructions can change, any lab-specific address,
template, token, service name, port, command, branch name, or endpoint must be verified in the live course.
Independent study resource | Verify against the live WGU task page | Page 2
, WGU D522 | Task 1 | 2026 Research-Aligned Independent Guide
Source type What it supports Confidence / limitation
WGU 2026 Institutional Catalog Course identity and official course High for course scope; it does not publish
description. PA rubric details.
Current Task 1 public mirror (WEN1) A-F workflow: GitLab, network list, Strong corroborating evidence, but not an
status/DNS verification, alert email, ticket official WGU-hosted task page.
API, DNS service recovery, endpoint
correction, resolution email, citations.
Recent WGU student reports, Jul-Sep 2026 PA conversion, GitLab workflow, Useful practical corroboration; student
timestamped screenshots, B2 DNS reports can contain individual lab
verification, MailHog/helpdesk issues, differences.
service restart/remediation, branch
submission details.
Python documentation CSV, subprocess, SMTP, and telnetlib High for Python behavior; lab
version behavior. compatibility still depends on WGU
environment.
3. Current Task 1 Workflow at a Glance
Area Goal What the learner should produce
A - GitLab / repository Work in the assigned project/branch and Working branch URL, repository contents,
preserve version history. commit history evidence, repository
archive per live instructions.
B1 - Device list Read the provided network-device CSV Functional script + printed device-name
with Python. list + screenshot.
B2 - Status & DNS verification Determine device availability and inspect Functional script + printed device
live DNS configuration. status/DNS results + screenshot.
C1 - Incident alert Notify stakeholders about compromised Functional email script + sent-message
devices using the supplied email template. evidence.
C2 - Ticket creation Create helpdesk/web-service ticket entries Functional API script + successful
for relevant devices/issues. response evidence.
D1-D3 - DNS service recovery Connect to internal DNS server, show Scripts and timestamped terminal
service down, restart it, and verify service evidence showing the full transition.
up.
D4 - Endpoint correction Correct DNS settings on each affected Functional remediation script + per-
device and verify the result. device evidence.
E - Resolution notice Send resolution communication with Functional email script + sent-message
affected-device identification. evidence.
F - Sources Cite any borrowed/paraphrased material. In-text citations and references where
applicable.
Do not turn this guide into fabricated evidence
A strong commercial guide should show the learner how to generate authentic evidence. Do not provide fake
GitLab histories, fake terminal screenshots, fake MailHog messages, fake API responses, or invented lab values.
Those items are student- and session-specific.
Independent study resource | Verify against the live WGU task page | Page 3
WGU D522 (WEN1)
TASK 1 PERFORMANCE ASSESSMENT
Incident Response & DNS Remediation
Python Automation • GitLab • Device Inventory • DNS Verification • Stakeholder Email •
Helpdesk API • Service Recovery • Evidence & Submission
2026 Updated | Research-aligned to the current PA workflow available in July-September
2026
IMPORTANT ALIGNMENT NOTE
This is an independently written instructional resource, not an official WGU answer key and not a substitute for
the live task page. WGU can change the lab, templates, endpoints, branch rules, and rubric. Use the current WGU
task page, supporting documents, and lab side panel as the controlling source. All screenshots, branch history,
service results, device values, API responses, and email evidence must come from the learner's own assigned lab.
Purpose: replace the earlier audit-only draft with a complete, practical, current Task 1 learning and execution
guide.
Independent study resource | Verify against the live WGU task page | Page 1
, WGU D522 | Task 1 | 2026 Research-Aligned Independent Guide
1. Why the Earlier Version Earned a 3-Star Outcome
The earlier 23-page PDF was technically detailed in a narrow area, but it was aligned to only part of the current
Task 1 workflow. The central problem was not writing quality; it was scope accuracy. Recent 2026 evidence
indicates that the PA version of D522 Task 1 is an incident-response and remediation workflow, not merely a
read-only inventory and DNS audit.
Earlier PDF behavior Why it is a problem now Correction in this rewrite
Called itself a “complete” guide while A buyer expects the product to map to the This guide maps the full A-F workflow and
stating the official rubric and lab files current task, not ask them to reconstruct labels what must be verified in the live
were not available. the rubric themselves. portal.
Focused on inventory, ping, SSH, Current Task 1 evidence also includes Adds dedicated C, D, and E sections with
resolvectl, logging, and a read-only audit. stakeholder alerting, helpdesk ticket code architecture, evidence expectations,
creation, DNS service restoration, and troubleshooting.
endpoint DNS correction, and a resolution
notification.
Explicitly disabled remediation and Current Task 1 sources show remediation Adds separate service-status, service-
warned not to restart services unless the is a required part of the incident scenario. restart, and affected-device DNS-
task required it. correction workflows.
No stakeholder email section and no These are independent graded Adds SMTP/MailHog workflow and HTTP
ticket/API section. deliverables in current Task 1 sources. API ticket workflow, with lab values kept
configurable.
Screenshot boxes were placeholders, and A guide full of empty boxes can feel Replaces empty “insert screenshot” boxes
the validation matrix was unfinished. incomplete even when the intent is with precise capture instructions,
ethical. expected evidence, and a final checklist.
Assumed an SSH/Paramiko path for all Recent students report lab-specific access Uses an adapter approach: follow the lab-
device access. patterns, including localhost/console-port provided access method and support
Telnet and SSH. A rigid transport either Telnet-console or SSH where
assumption can break otherwise good appropriate.
code.
Screenshot guidance said date/time Current Task 1 mirrors and student Makes visible date/time an explicit
“where available.” revision reports indicate date/time is evidence rule.
mandatory in submitted screenshots.
MOST IMPORTANT CORRECTION
The earlier document treats remediation as optional. Current 2026 Task 1 evidence instead shows an end-to-end
incident workflow: discover/verify -> notify -> create tickets -> restore DNS service -> correct affected devices ->
notify resolution. That scope mismatch is the most serious content error.
2. Research Basis and Confidence
The public WGU catalog confirms D522 is Python for IT Automation and describes it as applying Python and
programming logic to IT tasks and secure, resilient systems. The public catalog does not expose the internal PA
rubric. For the current Task 1 structure, this rewrite cross-checks a publicly indexed Task 1 mirror with recent
July-September 2026 student reports. Because those internal instructions can change, any lab-specific address,
template, token, service name, port, command, branch name, or endpoint must be verified in the live course.
Independent study resource | Verify against the live WGU task page | Page 2
, WGU D522 | Task 1 | 2026 Research-Aligned Independent Guide
Source type What it supports Confidence / limitation
WGU 2026 Institutional Catalog Course identity and official course High for course scope; it does not publish
description. PA rubric details.
Current Task 1 public mirror (WEN1) A-F workflow: GitLab, network list, Strong corroborating evidence, but not an
status/DNS verification, alert email, ticket official WGU-hosted task page.
API, DNS service recovery, endpoint
correction, resolution email, citations.
Recent WGU student reports, Jul-Sep 2026 PA conversion, GitLab workflow, Useful practical corroboration; student
timestamped screenshots, B2 DNS reports can contain individual lab
verification, MailHog/helpdesk issues, differences.
service restart/remediation, branch
submission details.
Python documentation CSV, subprocess, SMTP, and telnetlib High for Python behavior; lab
version behavior. compatibility still depends on WGU
environment.
3. Current Task 1 Workflow at a Glance
Area Goal What the learner should produce
A - GitLab / repository Work in the assigned project/branch and Working branch URL, repository contents,
preserve version history. commit history evidence, repository
archive per live instructions.
B1 - Device list Read the provided network-device CSV Functional script + printed device-name
with Python. list + screenshot.
B2 - Status & DNS verification Determine device availability and inspect Functional script + printed device
live DNS configuration. status/DNS results + screenshot.
C1 - Incident alert Notify stakeholders about compromised Functional email script + sent-message
devices using the supplied email template. evidence.
C2 - Ticket creation Create helpdesk/web-service ticket entries Functional API script + successful
for relevant devices/issues. response evidence.
D1-D3 - DNS service recovery Connect to internal DNS server, show Scripts and timestamped terminal
service down, restart it, and verify service evidence showing the full transition.
up.
D4 - Endpoint correction Correct DNS settings on each affected Functional remediation script + per-
device and verify the result. device evidence.
E - Resolution notice Send resolution communication with Functional email script + sent-message
affected-device identification. evidence.
F - Sources Cite any borrowed/paraphrased material. In-text citations and references where
applicable.
Do not turn this guide into fabricated evidence
A strong commercial guide should show the learner how to generate authentic evidence. Do not provide fake
GitLab histories, fake terminal screenshots, fake MailHog messages, fake API responses, or invented lab values.
Those items are student- and session-specific.
Independent study resource | Verify against the live WGU task page | Page 3
