D385 V2 | Software Security and Testing | Independent Master Guide | August 2026
WGU D385 V2
Software Security and Testing
MASTER STUDY GUIDE
Task 1 + Task 2 Performance Assessment Preparation
August 2026 Updated | V2 PA Version | Pass-Ready Independent Guide
What this guide is
An original, independent preparation resource built from WGU's public August 2026 course description, current
Python/pytest/Flask/OWASP guidance, and recent learner reports about the V2 performance assessments. It does
not reproduce WGU's private rubric and does not guarantee an evaluator decision.
Coverage Included
Static analysis, logging, defensive coding, pytest, log
Task 1 analysis, debugging/security explanations, evidence and
submission QA
Selected general/API vulnerability remediation, before/after
Task 2 evidence, pytest validation, mitigation report, API
hardening, traffic encryption
Original Python/Flask/SQLite examples and secure coding
Code
patterns
Screenshot design, test-output guidance, submission
Evidence
packaging and return-risk checklist
Research status: 29 August 2026
Independent study resource - verify every requirement in your current WGU portal | Page 1
, D385 V2 | Software Security and Testing | Independent Master Guide | August 2026
1. Alignment, Version Status, and How to Use This Guide
1.1 What WGU publicly confirms
WGU's August 2026 Institutional Catalog describes D385 - Software Security and Testing as a course that
prepares learners to recognize software security vulnerabilities, plan interventions, and develop and test
those interventions. The public description specifically names web security, permissions and identity
security, debugging, log-file analysis, API security, and encryption/cryptography concepts.
Assessment version
Recent learner reports from April through August 2026 consistently describe D385 V2 as a two-task Performance
Assessment course. Treat your current WGU task page and rubric as the authoritative source if wording, file names,
screenshot counts, or submission packaging differ.
1.2 Official scope vs. learner-reported rubric behavior
Evidence tier Use in this guide Confidence rule
Authoritative for public course
WGU public catalog Course competencies and topic scope
description
Technical best practices and code
Python / pytest / Flask / OWASP docs Authoritative technical references
behavior
Task sequencing, screenshot patterns,
Useful but unofficial; verify in your
Recent V2 learner reports common return causes, packaging
portal
observations
1.3 Best way to use the guide
1. Open the current Task 1 or Task 2 rubric beside this guide. Work criterion-by-criterion rather than
completing every TODO comment in the starter files.
2. Save the starter files outside the ZIP before editing. Keep an untouched backup so you can recover
original code if needed.
3. Capture evidence immediately after each criterion works. Do not wait until the end and try to recreate
proof.
4. Use original code and explanations. Replace every placeholder, student-ID token, filename, and
screenshot example with your own task artifacts.
5. Run tests after every meaningful change and save all files before packaging the final submission.
2. Course Concept Map - What D385 Is Testing
Domain What competence looks like Typical evidence
Recognize defects without executing
Static analysis the program and distinguish code- Analysis paragraph + identified issues
quality findings from security findings
Reject malformed input, handle
Defensive coding expected exceptions, preserve Code + tests + runtime behavior
application stability
Record useful events without leaking
Logging and debugging Log file + report explanation
secrets; interpret abnormal events
Independent study resource - verify every requirement in your current WGU portal | Page 2
, D385 V2 | Software Security and Testing | Independent Master Guide | August 2026
Create focused tests that prove a
Security testing pytest code + PASS output
mitigation works
Validate authentication/authorization
API security and inputs at endpoints; use safe data Before/after code + tests + rationale
access
Explain an appropriate method for Accurate written explanation, typically
Cryptography in transit
securing application traffic TLS/HTTPS
2.1 The security reasoning loop
6. Find the defect or weakness.
7. Explain why it matters.
8. Implement the narrowest appropriate mitigation.
9. Test both valid and invalid behavior.
10. Record evidence that the behavior changed.
11. Explain residual risk and real-world best practice.
High-value distinction
A linter such as Flake8 can surface syntax/style/code-quality problems, while dedicated security static-analysis tools
can detect additional security patterns. Do not describe every Flake8 warning as a security vulnerability. Explain
the actual risk of each selected issue.
Independent study resource - verify every requirement in your current WGU portal | Page 3
WGU D385 V2
Software Security and Testing
MASTER STUDY GUIDE
Task 1 + Task 2 Performance Assessment Preparation
August 2026 Updated | V2 PA Version | Pass-Ready Independent Guide
What this guide is
An original, independent preparation resource built from WGU's public August 2026 course description, current
Python/pytest/Flask/OWASP guidance, and recent learner reports about the V2 performance assessments. It does
not reproduce WGU's private rubric and does not guarantee an evaluator decision.
Coverage Included
Static analysis, logging, defensive coding, pytest, log
Task 1 analysis, debugging/security explanations, evidence and
submission QA
Selected general/API vulnerability remediation, before/after
Task 2 evidence, pytest validation, mitigation report, API
hardening, traffic encryption
Original Python/Flask/SQLite examples and secure coding
Code
patterns
Screenshot design, test-output guidance, submission
Evidence
packaging and return-risk checklist
Research status: 29 August 2026
Independent study resource - verify every requirement in your current WGU portal | Page 1
, D385 V2 | Software Security and Testing | Independent Master Guide | August 2026
1. Alignment, Version Status, and How to Use This Guide
1.1 What WGU publicly confirms
WGU's August 2026 Institutional Catalog describes D385 - Software Security and Testing as a course that
prepares learners to recognize software security vulnerabilities, plan interventions, and develop and test
those interventions. The public description specifically names web security, permissions and identity
security, debugging, log-file analysis, API security, and encryption/cryptography concepts.
Assessment version
Recent learner reports from April through August 2026 consistently describe D385 V2 as a two-task Performance
Assessment course. Treat your current WGU task page and rubric as the authoritative source if wording, file names,
screenshot counts, or submission packaging differ.
1.2 Official scope vs. learner-reported rubric behavior
Evidence tier Use in this guide Confidence rule
Authoritative for public course
WGU public catalog Course competencies and topic scope
description
Technical best practices and code
Python / pytest / Flask / OWASP docs Authoritative technical references
behavior
Task sequencing, screenshot patterns,
Useful but unofficial; verify in your
Recent V2 learner reports common return causes, packaging
portal
observations
1.3 Best way to use the guide
1. Open the current Task 1 or Task 2 rubric beside this guide. Work criterion-by-criterion rather than
completing every TODO comment in the starter files.
2. Save the starter files outside the ZIP before editing. Keep an untouched backup so you can recover
original code if needed.
3. Capture evidence immediately after each criterion works. Do not wait until the end and try to recreate
proof.
4. Use original code and explanations. Replace every placeholder, student-ID token, filename, and
screenshot example with your own task artifacts.
5. Run tests after every meaningful change and save all files before packaging the final submission.
2. Course Concept Map - What D385 Is Testing
Domain What competence looks like Typical evidence
Recognize defects without executing
Static analysis the program and distinguish code- Analysis paragraph + identified issues
quality findings from security findings
Reject malformed input, handle
Defensive coding expected exceptions, preserve Code + tests + runtime behavior
application stability
Record useful events without leaking
Logging and debugging Log file + report explanation
secrets; interpret abnormal events
Independent study resource - verify every requirement in your current WGU portal | Page 2
, D385 V2 | Software Security and Testing | Independent Master Guide | August 2026
Create focused tests that prove a
Security testing pytest code + PASS output
mitigation works
Validate authentication/authorization
API security and inputs at endpoints; use safe data Before/after code + tests + rationale
access
Explain an appropriate method for Accurate written explanation, typically
Cryptography in transit
securing application traffic TLS/HTTPS
2.1 The security reasoning loop
6. Find the defect or weakness.
7. Explain why it matters.
8. Implement the narrowest appropriate mitigation.
9. Test both valid and invalid behavior.
10. Record evidence that the behavior changed.
11. Explain residual risk and real-world best practice.
High-value distinction
A linter such as Flake8 can surface syntax/style/code-quality problems, while dedicated security static-analysis tools
can detect additional security patterns. Do not describe every Flake8 warning as a security vulnerability. Explain
the actual risk of each selected issue.
Independent study resource - verify every requirement in your current WGU portal | Page 3
