D385 V2 | Software Security and Testing | Task 1 PA Guide | August 2026
WGU D385 V2
Software Security and Testing
TASK 1 PERFORMANCE ASSESSMENT GUIDE
Static Code Analysis | Python Logging | Defensive Coding | Testing | Log
Analysis
August 2026 Updated | V2 PA Version | Pass-Ready Independent Exemplar
What this PDF is
An original, detailed Task 1 preparation guide built from WGU's public August 2026 course
description, current Python/OWASP guidance, and recent learner reports about the V2 PA. It does
not reproduce WGU's private rubric or starter code, and it cannot guarantee an evaluator decision.
Use the exact rubric and starter files in your portal as the controlling source.
Coverage Included
Rubric map A1-A3, B1-B5, C1-C4, evidence and submission QA
Scenario alignment Original parallel equipment-rental example reflecting current public
learner descriptions
Code Logging, try/except, assertions, validation, Flask-style patterns, pytest
Evidence Screenshot plan, log analysis, test traceability, return-risk checklist
Research status: 31 August 2026
Independent study resource - verify every requirement in your current WGU portal | Page 1
, D385 V2 | Software Security and Testing | Task 1 PA Guide | August 2026
1. Current D385 V2 Context and Task 1 Scope
WGU's current August 2026 catalog describes D385 - Software Security and Testing as a course focused on
recognizing software vulnerabilities, planning interventions, developing and testing those interventions,
and applying concepts in web security, permissions and identity security, debugging, log-file analysis, API
security, encryption, and cryptography. The catalog does not publish the private Performance Assessment
rubric.
Recent V2 learner reports consistently describe two Performance Assessment tasks. Task 1 is the defensive-
coding and evidence task: analyze source-code issues, implement logging and targeted defensive controls in
a small local Python web application, run the application, prove test behavior, analyze generated log
abnormalities, and explain the security value of the changes.
Authority rule
Where public learner reports conflict with your current WGU portal, the portal wins. In particular,
use the exact filenames, starter-code comments, required screenshot counts, and upload structure
shown in your current Task 1 instructions.
1.1 Scenario alignment used in this guide
Current public learner descriptions characterize the Task 1 starter as a locally run Python/Flask-style
equipment-rental application. Inputs include values such as a username, an equipment selection, and a
rental duration. The starter project also contains tests and comments that point to required defensive-
coding locations. This guide uses an original parallel application so the security reasoning is concrete
without reproducing proprietary WGU source code.
Scenario element How to reason about it
Equipment choice Usually selected from a finite server-side set. An unknown value can indicate
request tampering, stale client state, or a crafted request.
Rental duration Free-text or form input that must be converted to an integer and checked for a
sensible positive range.
Username / identity input Untrusted text that should be checked before business logic and must never be
blindly trusted because the browser supplied it.
Local web application Lets the evaluator observe browser behavior, terminal output, test output, and
the troubleshooting log together.
1.2 What “pass-ready” means
Every rubric row has a clearly labeled section in the report.
Every code requirement has a visible implementation and a corresponding verification method.
Every screenshot is authentic, readable, and proves exactly one or more named rubric criteria.
The written explanation describes what happened, why the code is safer, and what the evidence proves.
The ZIP and report are opened after packaging to confirm the final saved code is actually present.
Independent study resource - verify every requirement in your current WGU portal | Page 2
, D385 V2 | Software Security and Testing | Task 1 PA Guide | August 2026
Figure 1. Evidence-driven Task 1 workflow.
Independent study resource - verify every requirement in your current WGU portal | Page 3
WGU D385 V2
Software Security and Testing
TASK 1 PERFORMANCE ASSESSMENT GUIDE
Static Code Analysis | Python Logging | Defensive Coding | Testing | Log
Analysis
August 2026 Updated | V2 PA Version | Pass-Ready Independent Exemplar
What this PDF is
An original, detailed Task 1 preparation guide built from WGU's public August 2026 course
description, current Python/OWASP guidance, and recent learner reports about the V2 PA. It does
not reproduce WGU's private rubric or starter code, and it cannot guarantee an evaluator decision.
Use the exact rubric and starter files in your portal as the controlling source.
Coverage Included
Rubric map A1-A3, B1-B5, C1-C4, evidence and submission QA
Scenario alignment Original parallel equipment-rental example reflecting current public
learner descriptions
Code Logging, try/except, assertions, validation, Flask-style patterns, pytest
Evidence Screenshot plan, log analysis, test traceability, return-risk checklist
Research status: 31 August 2026
Independent study resource - verify every requirement in your current WGU portal | Page 1
, D385 V2 | Software Security and Testing | Task 1 PA Guide | August 2026
1. Current D385 V2 Context and Task 1 Scope
WGU's current August 2026 catalog describes D385 - Software Security and Testing as a course focused on
recognizing software vulnerabilities, planning interventions, developing and testing those interventions,
and applying concepts in web security, permissions and identity security, debugging, log-file analysis, API
security, encryption, and cryptography. The catalog does not publish the private Performance Assessment
rubric.
Recent V2 learner reports consistently describe two Performance Assessment tasks. Task 1 is the defensive-
coding and evidence task: analyze source-code issues, implement logging and targeted defensive controls in
a small local Python web application, run the application, prove test behavior, analyze generated log
abnormalities, and explain the security value of the changes.
Authority rule
Where public learner reports conflict with your current WGU portal, the portal wins. In particular,
use the exact filenames, starter-code comments, required screenshot counts, and upload structure
shown in your current Task 1 instructions.
1.1 Scenario alignment used in this guide
Current public learner descriptions characterize the Task 1 starter as a locally run Python/Flask-style
equipment-rental application. Inputs include values such as a username, an equipment selection, and a
rental duration. The starter project also contains tests and comments that point to required defensive-
coding locations. This guide uses an original parallel application so the security reasoning is concrete
without reproducing proprietary WGU source code.
Scenario element How to reason about it
Equipment choice Usually selected from a finite server-side set. An unknown value can indicate
request tampering, stale client state, or a crafted request.
Rental duration Free-text or form input that must be converted to an integer and checked for a
sensible positive range.
Username / identity input Untrusted text that should be checked before business logic and must never be
blindly trusted because the browser supplied it.
Local web application Lets the evaluator observe browser behavior, terminal output, test output, and
the troubleshooting log together.
1.2 What “pass-ready” means
Every rubric row has a clearly labeled section in the report.
Every code requirement has a visible implementation and a corresponding verification method.
Every screenshot is authentic, readable, and proves exactly one or more named rubric criteria.
The written explanation describes what happened, why the code is safer, and what the evidence proves.
The ZIP and report are opened after packaging to confirm the final saved code is actually present.
Independent study resource - verify every requirement in your current WGU portal | Page 2
, D385 V2 | Software Security and Testing | Task 1 PA Guide | August 2026
Figure 1. Evidence-driven Task 1 workflow.
Independent study resource - verify every requirement in your current WGU portal | Page 3
