WGU D385 Task 2 Secure Coding and API
Security Exam UPDATED ACTUAL
QUESTIONS AND CORRECT ANSWERS
CLASS: Where does Task 2 sit in D385? - CORRECT ANSWER Second of two ZHN1
performance tasks: Secure Coding and Secure API Implementation - remediate the starter API, prove
fixes with pytest, and write a Security Mitigation Report. Competencies: 4102.1.1 evaluate logs,
4102.1.2 develop mitigations, 4102.1.3 configure REST API authentication
CLASS: The Task 2 scenario in one line - CORRECT ANSWER Internal Construction
Equipment Rental API (v2.2.0, endpoints under /api/v1/) is suffering unauthorized access attempts,
suspicious input patterns, and failing authorization logic - you are the developer securing it
CLASS: What goes in the final Task 2 submission? - CORRECT ANSWER ONE zip
containing the written report (Word docx) plus the modified Python script and the test script - the
starter tells you to save your fixed app as app_solution.py
CLASS: The evidence files provided with the starter - CORRECT ANSWER app_student.py
(vulnerable code), task_2_flake8_report.txt (general vulns for Section A), task_2_bandit_report.txt
(API vulns for Section B), network_security_log.txt (attack evidence), penetration_test_report.json
(fill-in template)
CLASS: Security principles the task intro names - CORRECT ANSWER Least privilege,
defense in depth, encryption, API keys, and OAuth - be ready to explain how each protects modern
APIs
CLASS: Course textbook to cite in the report - CORRECT ANSWER Full Stack Python
Security by Dennis Byrne - hashing/salting, TLS, and attack chapters map directly to D1-D4
CLASS: The two submission gates before evaluation - CORRECT ANSWER WGU similarity
checker (wait for the report and review it) and Grammarly for Education (submission cannot pass
without professional communication passing)
RUBRIC: Section A pattern (A1-A3) - CORRECT ANSWER Pick 2 GENERAL
vulnerabilities from the flake8 report. A1 screenshot the insecure code WITH line numbers, A2
, implement a secure replacement using industry practice, A3 comment out the original code so it no
longer executes - never delete it
RUBRIC: Section B pattern (B1-B3) - CORRECT ANSWER Same three-step evidence for 2
API security vulnerabilities sourced from the bandit report: insecure screenshot with line numbers,
secure replacement, original commented out
RUBRIC: Section C requirements (C1-C5) - CORRECT ANSWER C1 pytest functions named
test_*, C2 assert in every test, C3 all tests pass, C4 descriptive print() lines explaining each outcome
for the console screenshot, C5 four passing-test screenshots: 2 general + 2 API
RUBRIC: Section D report structure (D1-D4) - CORRECT ANSWER D1 two mitigation
strategies for EACH of the 4 remediated vulnerabilities, D2 two input validation techniques, D3 two
exception handling improvements, D4 one encryption method securing application traffic
RUBRIC: Why comment out instead of delete? - CORRECT ANSWER The evaluator must see
before-and-after in the same file - proof you found the exact lines, replaced them securely, and
disabled the old path; secure replacements must not introduce new vulnerabilities
RUBRIC: The four scaffold test names in test_run.py - CORRECT ANSWER
test_general_vuln_1_hardcoded_secrets_remediated,
test_general_vuln_2_plaintext_passwords_remediated, test_api_vuln_1_authentication_required,
test_api_vuln_2_authorization_enforced
RUBRIC: Expected status codes in the two API tests - CORRECT ANSWER Unauthenticated
GET /api/v1/rentals should return 401 Unauthorized; a regular user's Bearer key hitting
/api/v1/admin/users should return 403 Forbidden
RUBRIC: How the test file wires up - CORRECT ANSWER from app_solution import app
and USERS_DB, a fixture sets app.config TESTING and yields app.test_client(), run with pytest
test_run.py -v
CODE: Lines 79-84 - vulnerability and fix - CORRECT ANSWER Hardcoded secret_key, API
key, DB user and DB password. Fix (already implemented in your file): os.environ.get for each with
secrets.token_hex(32) as the generated fallback, originals commented out
Security Exam UPDATED ACTUAL
QUESTIONS AND CORRECT ANSWERS
CLASS: Where does Task 2 sit in D385? - CORRECT ANSWER Second of two ZHN1
performance tasks: Secure Coding and Secure API Implementation - remediate the starter API, prove
fixes with pytest, and write a Security Mitigation Report. Competencies: 4102.1.1 evaluate logs,
4102.1.2 develop mitigations, 4102.1.3 configure REST API authentication
CLASS: The Task 2 scenario in one line - CORRECT ANSWER Internal Construction
Equipment Rental API (v2.2.0, endpoints under /api/v1/) is suffering unauthorized access attempts,
suspicious input patterns, and failing authorization logic - you are the developer securing it
CLASS: What goes in the final Task 2 submission? - CORRECT ANSWER ONE zip
containing the written report (Word docx) plus the modified Python script and the test script - the
starter tells you to save your fixed app as app_solution.py
CLASS: The evidence files provided with the starter - CORRECT ANSWER app_student.py
(vulnerable code), task_2_flake8_report.txt (general vulns for Section A), task_2_bandit_report.txt
(API vulns for Section B), network_security_log.txt (attack evidence), penetration_test_report.json
(fill-in template)
CLASS: Security principles the task intro names - CORRECT ANSWER Least privilege,
defense in depth, encryption, API keys, and OAuth - be ready to explain how each protects modern
APIs
CLASS: Course textbook to cite in the report - CORRECT ANSWER Full Stack Python
Security by Dennis Byrne - hashing/salting, TLS, and attack chapters map directly to D1-D4
CLASS: The two submission gates before evaluation - CORRECT ANSWER WGU similarity
checker (wait for the report and review it) and Grammarly for Education (submission cannot pass
without professional communication passing)
RUBRIC: Section A pattern (A1-A3) - CORRECT ANSWER Pick 2 GENERAL
vulnerabilities from the flake8 report. A1 screenshot the insecure code WITH line numbers, A2
, implement a secure replacement using industry practice, A3 comment out the original code so it no
longer executes - never delete it
RUBRIC: Section B pattern (B1-B3) - CORRECT ANSWER Same three-step evidence for 2
API security vulnerabilities sourced from the bandit report: insecure screenshot with line numbers,
secure replacement, original commented out
RUBRIC: Section C requirements (C1-C5) - CORRECT ANSWER C1 pytest functions named
test_*, C2 assert in every test, C3 all tests pass, C4 descriptive print() lines explaining each outcome
for the console screenshot, C5 four passing-test screenshots: 2 general + 2 API
RUBRIC: Section D report structure (D1-D4) - CORRECT ANSWER D1 two mitigation
strategies for EACH of the 4 remediated vulnerabilities, D2 two input validation techniques, D3 two
exception handling improvements, D4 one encryption method securing application traffic
RUBRIC: Why comment out instead of delete? - CORRECT ANSWER The evaluator must see
before-and-after in the same file - proof you found the exact lines, replaced them securely, and
disabled the old path; secure replacements must not introduce new vulnerabilities
RUBRIC: The four scaffold test names in test_run.py - CORRECT ANSWER
test_general_vuln_1_hardcoded_secrets_remediated,
test_general_vuln_2_plaintext_passwords_remediated, test_api_vuln_1_authentication_required,
test_api_vuln_2_authorization_enforced
RUBRIC: Expected status codes in the two API tests - CORRECT ANSWER Unauthenticated
GET /api/v1/rentals should return 401 Unauthorized; a regular user's Bearer key hitting
/api/v1/admin/users should return 403 Forbidden
RUBRIC: How the test file wires up - CORRECT ANSWER from app_solution import app
and USERS_DB, a fixture sets app.config TESTING and yields app.test_client(), run with pytest
test_run.py -v
CODE: Lines 79-84 - vulnerability and fix - CORRECT ANSWER Hardcoded secret_key, API
key, DB user and DB password. Fix (already implemented in your file): os.environ.get for each with
secrets.token_hex(32) as the generated fallback, originals commented out
