WGU D385 V2 SOFTWARE SECURITY
AND TESTING MASTER STUDY GUIDE
EXAM
1. When integrating security into the Software Development Life Cycle (SDLC), which
approach focuses on identifying security flaws early by moving testing to the initial stages of
development?
A. Shift-Right testing
B. Regression testing
C. Waterfall validation
D. Shift-Left testing
Answer: D
Conceptual Explanation: Shift-left testing emphasizes performing security activities as
early as possible in the development process to reduce remediation costs and complexity.
2. Which type of security testing tool is known for having a low false-positive rate because it
monitors an application’s execution and has access to its internal state?
A. SAST
,B. DAST
C. SCA
D. IAST
Answer: D
Conceptual Explanation: Interactive Application Security Testing (IAST) combines
elements of SAST and DAST, monitoring code execution to provide high accuracy.
3. To prevent SQL injection, which of the following is considered the most effective defense
mechanism?
A. Blacklisting common SQL keywords
B. Using parameterized queries and prepared statements
C. Client-side input validation
D. Escaping all single quotes in the input string
Answer: B
Conceptual Explanation: Parameterized queries ensure that the database treats user
input strictly as data, not executable code, effectively neutralizing injection attempts.
4. In the context of API security, what does the acronym BOLA stand for?
A. Broken Object Level Authorization
B. Binary Object Link Access
, C. Basic Online Login Authentication
D. Backend Operation Limit Alert
Answer: A
Conceptual Explanation: Broken Object Level Authorization (BOLA) occurs when an
application does not properly validate that a user has permission to access a specific object
ID.
5. Which Cross-Site Scripting (XSS) variant involves the malicious script being permanently
stored on the target server, such as in a database or comment field?
A. Reflected XSS
B. Stored XSS
C. DOM-based XSS
D. Blind XSS
Answer: B
Conceptual Explanation: Stored XSS occurs when a malicious script is saved on the server
and served to every user who views the affected page.
6. Which mechanism is used to prevent Cross-Site Request Forgery (CSRF) by ensuring that
the browser only sends cookies for requests originating from the same site?
A. HttpOnly attribute
B. Secure attribute
AND TESTING MASTER STUDY GUIDE
EXAM
1. When integrating security into the Software Development Life Cycle (SDLC), which
approach focuses on identifying security flaws early by moving testing to the initial stages of
development?
A. Shift-Right testing
B. Regression testing
C. Waterfall validation
D. Shift-Left testing
Answer: D
Conceptual Explanation: Shift-left testing emphasizes performing security activities as
early as possible in the development process to reduce remediation costs and complexity.
2. Which type of security testing tool is known for having a low false-positive rate because it
monitors an application’s execution and has access to its internal state?
A. SAST
,B. DAST
C. SCA
D. IAST
Answer: D
Conceptual Explanation: Interactive Application Security Testing (IAST) combines
elements of SAST and DAST, monitoring code execution to provide high accuracy.
3. To prevent SQL injection, which of the following is considered the most effective defense
mechanism?
A. Blacklisting common SQL keywords
B. Using parameterized queries and prepared statements
C. Client-side input validation
D. Escaping all single quotes in the input string
Answer: B
Conceptual Explanation: Parameterized queries ensure that the database treats user
input strictly as data, not executable code, effectively neutralizing injection attempts.
4. In the context of API security, what does the acronym BOLA stand for?
A. Broken Object Level Authorization
B. Binary Object Link Access
, C. Basic Online Login Authentication
D. Backend Operation Limit Alert
Answer: A
Conceptual Explanation: Broken Object Level Authorization (BOLA) occurs when an
application does not properly validate that a user has permission to access a specific object
ID.
5. Which Cross-Site Scripting (XSS) variant involves the malicious script being permanently
stored on the target server, such as in a database or comment field?
A. Reflected XSS
B. Stored XSS
C. DOM-based XSS
D. Blind XSS
Answer: B
Conceptual Explanation: Stored XSS occurs when a malicious script is saved on the server
and served to every user who views the affected page.
6. Which mechanism is used to prevent Cross-Site Request Forgery (CSRF) by ensuring that
the browser only sends cookies for requests originating from the same site?
A. HttpOnly attribute
B. Secure attribute
