WGU D385 V2 SOFTWARE SECURITY
AND TESTING MASTER EXAM PREP
QUESTIONS AND ANSWERS
1. Which testing methodology focuses on analyzing code without executing the program to
identify potential security vulnerabilities early in the SDLC?
A. Dynamic Application Security Testing (DAST)
B. Regression Testing
C. Interactive Application Security Testing (IAST)
D. Static Application Security Testing (SAST)
Answer: D
Conceptual Explanation: SAST involves examining source code, byte code, or binaries
without execution, making it highly effective for early bug detection.
2. When remediating a SQL Injection vulnerability, which approach is considered the most
effective defense-in-depth strategy?
A. Using client-side input validation only
B. Using parameterized queries or prepared statements
,C. Escaping all special characters in the input string
D. Blacklisting common SQL keywords like DROP or SELECT
Answer: B
Conceptual Explanation: Parameterized queries ensure the database treats input as data
rather than executable code, providing a robust defense against injection.
3. A developer is implementing an API that requires high security for sensitive transactions.
Which authentication mechanism is most suitable for delegating access without sharing
credentials?
A. Basic Authentication
B. API Keys
C. Digest Authentication
D. OAuth 2.0
Answer: D
Conceptual Explanation: OAuth 2.0 is the industry standard for secure delegation,
allowing third-party applications to access resources without exposing user passwords.
4. In the context of secure logging, what is a primary risk of logging raw user input directly?
A. Log Injection and Cross-Site Scripting (XSS)
B. Reduced system performance
C. Increased storage costs
, D. Violation of the Single Responsibility Principle
Answer: A
Conceptual Explanation: Logging raw input can lead to log injection, where an attacker
inserts false log entries or scripts that execute when an admin views the logs via a web
interface.
5. Which type of security testing is most effective at discovering memory leaks and buffer
overflows by providing semi-random data to the application?
A. Unit Testing
B. Penetration Testing
C. Fuzz Testing (Fuzzing)
D. Compliance Auditing
Answer: C
Conceptual Explanation: Fuzzing involves sending malformed or random data to inputs to
trigger crashes, memory leaks, or unexpected behaviors that indicate vulnerabilities.
6. What is the primary difference between IAST and DAST?
A. IAST runs during the development phase, while DAST runs only in production.
B. IAST uses instrumentation within the application to monitor execution, while DAST tests
from the outside.
C. DAST requires source code access, while IAST does not.
AND TESTING MASTER EXAM PREP
QUESTIONS AND ANSWERS
1. Which testing methodology focuses on analyzing code without executing the program to
identify potential security vulnerabilities early in the SDLC?
A. Dynamic Application Security Testing (DAST)
B. Regression Testing
C. Interactive Application Security Testing (IAST)
D. Static Application Security Testing (SAST)
Answer: D
Conceptual Explanation: SAST involves examining source code, byte code, or binaries
without execution, making it highly effective for early bug detection.
2. When remediating a SQL Injection vulnerability, which approach is considered the most
effective defense-in-depth strategy?
A. Using client-side input validation only
B. Using parameterized queries or prepared statements
,C. Escaping all special characters in the input string
D. Blacklisting common SQL keywords like DROP or SELECT
Answer: B
Conceptual Explanation: Parameterized queries ensure the database treats input as data
rather than executable code, providing a robust defense against injection.
3. A developer is implementing an API that requires high security for sensitive transactions.
Which authentication mechanism is most suitable for delegating access without sharing
credentials?
A. Basic Authentication
B. API Keys
C. Digest Authentication
D. OAuth 2.0
Answer: D
Conceptual Explanation: OAuth 2.0 is the industry standard for secure delegation,
allowing third-party applications to access resources without exposing user passwords.
4. In the context of secure logging, what is a primary risk of logging raw user input directly?
A. Log Injection and Cross-Site Scripting (XSS)
B. Reduced system performance
C. Increased storage costs
, D. Violation of the Single Responsibility Principle
Answer: A
Conceptual Explanation: Logging raw input can lead to log injection, where an attacker
inserts false log entries or scripts that execute when an admin views the logs via a web
interface.
5. Which type of security testing is most effective at discovering memory leaks and buffer
overflows by providing semi-random data to the application?
A. Unit Testing
B. Penetration Testing
C. Fuzz Testing (Fuzzing)
D. Compliance Auditing
Answer: C
Conceptual Explanation: Fuzzing involves sending malformed or random data to inputs to
trigger crashes, memory leaks, or unexpected behaviors that indicate vulnerabilities.
6. What is the primary difference between IAST and DAST?
A. IAST runs during the development phase, while DAST runs only in production.
B. IAST uses instrumentation within the application to monitor execution, while DAST tests
from the outside.
C. DAST requires source code access, while IAST does not.
