WGU D385 CYBERSECURITY CONCEPTS PRE-ASSESSMENT
2026/2027 | A+ EXAM PREPARATION GUIDE | HIGH-YIELD
QUESTIONS & CORRECT ANSWERS | KEY CYBERSECURITY TOPICS
| LATEST UPDATE
1. What is the minimum length requirement for a password according to
common security practices?
12 characters
6 characters
8 characters
10 characters
2. If a web application is experiencing log injection attacks, what coding
practice should be prioritized to enhance security?
Using complex passwords for all user accounts.
Implementing strict input validation for all user inputs.
Increasing the size of log files to accommodate more data.
Disabling logging to prevent attackers from accessing logs.
3. If a web application is vulnerable to SQL injection, what immediate action
should a developer take to mitigate this risk?
Use client-side validation only.
Implement input validation and use prepared statements.
Disable all user input fields.
Increase password complexity requirements.
4. What permissions should be granted to Admins according to the provided
question?
, Execute only
Read only
Write only
Read, Write, and Execute
5. What is the name of the protocol that is known for caching tokens after
acquisition?
OAuth
FTP
SSL
HTTP
6. When creating a new user, an administrator must submit the following fields
to an API endpoint: Name, Email Address, Password, IsAdmin. What is the
best way to ensure the API is protected against privilege escalation?
Remove IsAdmin from the endpoint
Encrypt the incoming request
Implement resource and field-level access control
Ensure incoming requests are rate limited
7. Which of the following cross-site scripting attacks occurs when an attacker
injects executable code within an HTTP response?
Reflected XSS
DOM-based XSS
Stored XSS
,8. In a scenario where a web application is experiencing a denial-of-service
attack, how could implementing a 'Token Bucket' algorithm help mitigate the
issue?
By encrypting all incoming requests to secure data.
By validating all user inputs to eliminate vulnerabilities.
By storing user session data securely to prevent unauthorized access.
By limiting the number of requests a user can make in a given time
frame, thus preventing overload.
9. The user submits the following request to an API endpoint that requires a
header: Import requests. URL = 'https://api.github.com/invalid'. Try:
Request_response = requests.get(url). If the response was successful, no
Exception will be raised. Request_response.raise_for_status(). Except
Exception as err: Print('Other error occurred: {err}'). Else: Print('Success!').
Which response code will the user most likely be presented with?
200 - 'OK'
401 - 'Unauthorized'
404 - 'Not found'
400 - 'Bad request'
10. What is the primary technique employed in a SQL injection attack?
Manipulating SQL queries
Validating user input
Using prepared statements
Encrypting passwords
, 11. A security analyst has noticed a vulnerability in which an attacker took over
multiple users' accounts. Which vulnerability did the security analyst
encounter?
API mass assignment
Broken function level authorization
Broken access control
Privilege escalation
12. The MOST important difference between hashing and encryption is that
hashing:
is the same at the sending and receiving end.
is irreversible.
output is the same length as the original message.
is concerned with integrity and security.
13. Which HTML5 code fragment shows a way to validate numeric input as
having a value from 1 to 100, inclusive?
<input type="num" min="1" max="100">
<input type="number" min="1" max="100">
<input type="positive" limit="100"
<input type="number" low="1" high="100">
14. Describe how input validation helps in defending against log injection
attacks.
Input validation ensures that only properly formatted data is
accepted, preventing malicious input from being logged.
2026/2027 | A+ EXAM PREPARATION GUIDE | HIGH-YIELD
QUESTIONS & CORRECT ANSWERS | KEY CYBERSECURITY TOPICS
| LATEST UPDATE
1. What is the minimum length requirement for a password according to
common security practices?
12 characters
6 characters
8 characters
10 characters
2. If a web application is experiencing log injection attacks, what coding
practice should be prioritized to enhance security?
Using complex passwords for all user accounts.
Implementing strict input validation for all user inputs.
Increasing the size of log files to accommodate more data.
Disabling logging to prevent attackers from accessing logs.
3. If a web application is vulnerable to SQL injection, what immediate action
should a developer take to mitigate this risk?
Use client-side validation only.
Implement input validation and use prepared statements.
Disable all user input fields.
Increase password complexity requirements.
4. What permissions should be granted to Admins according to the provided
question?
, Execute only
Read only
Write only
Read, Write, and Execute
5. What is the name of the protocol that is known for caching tokens after
acquisition?
OAuth
FTP
SSL
HTTP
6. When creating a new user, an administrator must submit the following fields
to an API endpoint: Name, Email Address, Password, IsAdmin. What is the
best way to ensure the API is protected against privilege escalation?
Remove IsAdmin from the endpoint
Encrypt the incoming request
Implement resource and field-level access control
Ensure incoming requests are rate limited
7. Which of the following cross-site scripting attacks occurs when an attacker
injects executable code within an HTTP response?
Reflected XSS
DOM-based XSS
Stored XSS
,8. In a scenario where a web application is experiencing a denial-of-service
attack, how could implementing a 'Token Bucket' algorithm help mitigate the
issue?
By encrypting all incoming requests to secure data.
By validating all user inputs to eliminate vulnerabilities.
By storing user session data securely to prevent unauthorized access.
By limiting the number of requests a user can make in a given time
frame, thus preventing overload.
9. The user submits the following request to an API endpoint that requires a
header: Import requests. URL = 'https://api.github.com/invalid'. Try:
Request_response = requests.get(url). If the response was successful, no
Exception will be raised. Request_response.raise_for_status(). Except
Exception as err: Print('Other error occurred: {err}'). Else: Print('Success!').
Which response code will the user most likely be presented with?
200 - 'OK'
401 - 'Unauthorized'
404 - 'Not found'
400 - 'Bad request'
10. What is the primary technique employed in a SQL injection attack?
Manipulating SQL queries
Validating user input
Using prepared statements
Encrypting passwords
, 11. A security analyst has noticed a vulnerability in which an attacker took over
multiple users' accounts. Which vulnerability did the security analyst
encounter?
API mass assignment
Broken function level authorization
Broken access control
Privilege escalation
12. The MOST important difference between hashing and encryption is that
hashing:
is the same at the sending and receiving end.
is irreversible.
output is the same length as the original message.
is concerned with integrity and security.
13. Which HTML5 code fragment shows a way to validate numeric input as
having a value from 1 to 100, inclusive?
<input type="num" min="1" max="100">
<input type="number" min="1" max="100">
<input type="positive" limit="100"
<input type="number" low="1" high="100">
14. Describe how input validation helps in defending against log injection
attacks.
Input validation ensures that only properly formatted data is
accepted, preventing malicious input from being logged.
