WGU D385 Task 1 Performance
Assessment Guide Software Security &
Testing Python Logging, Assertions,
Static Code Analysis & Testing 2026 |
WGU D385 Task 1 Performance Assessment Guide |
Comprehensive Examination
WGU D385 Task 1 Performance Assessment Guide Software
Security & Testing Python Logging, Assertions, Static Code
Analysis & Testing 2026 actual exam preparation document
INTRODUCTION
This document is an important and very helpful preparation
resource for WGU D385 Task 1 Performance Assessment Guide
Software Security & Testing Python Logging, Assertions, Static
Code Analysis & Testing 2026. Every item uses a focused exam
stem, four response options, a keyed response, and a clear
rationale, making it easier to understand the subject, spot
distractors, and build real exam confidence.
Page 1
, Question 1
A logging configuration uses logging.basicConfig(format='%(asctime)s
%(levelname)s %(message)s') and logs a user-supplied username directly. An
attacker sets the username to a string containing a newline followed by a
forged log entry. Which mitigation most directly prevents log injection while
preserving structured auditability?
A. Set the logging level to WARNING to reduce the attack surface.
B. Use a JSON formatter that serializes the message field and escapes
control characters.
C. Wrap the log call in a try/except to catch injection exceptions.
D. Encode the username with base64 before logging.
Correct Answer: B - Use a JSON formatter that serializes the
message field and escapes control characters.
RATIONALE
Structured JSON logging serializes and escapes newlines/control
characters, neutralizing forged entries while keeping fields queryable.
Level changes and exception handling do not sanitize content, and
base64 obscures but does not structurally separate attacker-controlled
data from log metadata.
Question 2
A developer writes: assert user.is_admin, 'denied' to guard a privileged
function, then deploys with PYTHONOPTIMIZE=1. Which statement best
characterizes the resulting security posture?
A. The assertion still raises AssertionError because the message is
present.
B. The assertion is stripped, so the guard never executes and the function
becomes unconditionally accessible.
C. The assertion is converted to a warning but execution continues.
D. PYTHONOPTIMIZE only affects docstrings, so the assertion is
Page 2
, unaffected.
Correct Answer: B - The assertion is stripped, so the guard never
executes and the function becomes unconditionally accessible.
RATIONALE
Under -O/PYTHONOPTIMIZE, the compiler removes assert
statements entirely, eliminating the guard and its message. Assertions
must never enforce security; explicit if/raise or authorization
decorators are required. The other options misstate optimization
semantics.
Question 3
Bandit reports B301 (pickle) on a function that deserializes data from a trusted
internal queue, but the queue is fed by a webhook that accepts unauthenticated
JSON. Which action best reflects correct triage?
A. Suppress B301 with # nosec because the queue is internal.
B. Treat the finding as a true positive and replace pickle with a safe
format (e.g., JSON) plus schema validation.
C. Downgrade severity to LOW because the queue is internal.
D. Add a try/except around pickle.loads to catch malicious payloads.
Correct Answer: B - Treat the finding as a true positive and
replace pickle with a safe format (e.g., JSON) plus schema
validation.
RATIONALE
Taint flows from an unauthenticated webhook through the queue to
pickle.loads, making the finding a true positive with potential RCE.
Suppression or severity downgrade ignores the taint path, and
try/except cannot prevent code execution during deserialization.
Page 3
, Question 4
A test suite achieves 100% line coverage yet misses a bug where a function
returns None for empty input. Which testing technique would most likely
expose this defect?
A. Increasing line coverage to 100% on all branches.
B. Adding property-based tests that assert invariants across generated
inputs, including empty sequences.
C. Running the suite under pytest -x to stop on first failure.
D. Adding more assertions inside the function under test.
Correct Answer: B - Adding property-based tests that assert
invariants across generated inputs, including empty sequences.
RATIONALE
Line coverage does not guarantee oracle quality or input diversity;
property-based testing generates edge cases like empty inputs and
checks invariants, exposing the None return. Branch coverage may
still miss it, -x only changes failure handling, and internal assertions
do not create external test oracles.
Question 5
A Semgrep rule flags f"SELECT * FROM users WHERE name = '{name}'"
but the codebase uses a custom ORM that parameterizes queries before
execution. What is the most rigorous next step?
A. Disable the rule globally to reduce false positives.
B. Verify the ORM's parameterization path with a taint-mode Semgrep
rule and adjust the rule's sanitizer configuration.
C. Convert all queries to string concatenation to satisfy the rule.
D. Add # nosemgrep to every flagged line.
Correct Answer: B - Verify the ORM's parameterization path
with a taint-mode Semgrep rule and adjust the rule's sanitizer
configuration.
Page 4
Assessment Guide Software Security &
Testing Python Logging, Assertions,
Static Code Analysis & Testing 2026 |
WGU D385 Task 1 Performance Assessment Guide |
Comprehensive Examination
WGU D385 Task 1 Performance Assessment Guide Software
Security & Testing Python Logging, Assertions, Static Code
Analysis & Testing 2026 actual exam preparation document
INTRODUCTION
This document is an important and very helpful preparation
resource for WGU D385 Task 1 Performance Assessment Guide
Software Security & Testing Python Logging, Assertions, Static
Code Analysis & Testing 2026. Every item uses a focused exam
stem, four response options, a keyed response, and a clear
rationale, making it easier to understand the subject, spot
distractors, and build real exam confidence.
Page 1
, Question 1
A logging configuration uses logging.basicConfig(format='%(asctime)s
%(levelname)s %(message)s') and logs a user-supplied username directly. An
attacker sets the username to a string containing a newline followed by a
forged log entry. Which mitigation most directly prevents log injection while
preserving structured auditability?
A. Set the logging level to WARNING to reduce the attack surface.
B. Use a JSON formatter that serializes the message field and escapes
control characters.
C. Wrap the log call in a try/except to catch injection exceptions.
D. Encode the username with base64 before logging.
Correct Answer: B - Use a JSON formatter that serializes the
message field and escapes control characters.
RATIONALE
Structured JSON logging serializes and escapes newlines/control
characters, neutralizing forged entries while keeping fields queryable.
Level changes and exception handling do not sanitize content, and
base64 obscures but does not structurally separate attacker-controlled
data from log metadata.
Question 2
A developer writes: assert user.is_admin, 'denied' to guard a privileged
function, then deploys with PYTHONOPTIMIZE=1. Which statement best
characterizes the resulting security posture?
A. The assertion still raises AssertionError because the message is
present.
B. The assertion is stripped, so the guard never executes and the function
becomes unconditionally accessible.
C. The assertion is converted to a warning but execution continues.
D. PYTHONOPTIMIZE only affects docstrings, so the assertion is
Page 2
, unaffected.
Correct Answer: B - The assertion is stripped, so the guard never
executes and the function becomes unconditionally accessible.
RATIONALE
Under -O/PYTHONOPTIMIZE, the compiler removes assert
statements entirely, eliminating the guard and its message. Assertions
must never enforce security; explicit if/raise or authorization
decorators are required. The other options misstate optimization
semantics.
Question 3
Bandit reports B301 (pickle) on a function that deserializes data from a trusted
internal queue, but the queue is fed by a webhook that accepts unauthenticated
JSON. Which action best reflects correct triage?
A. Suppress B301 with # nosec because the queue is internal.
B. Treat the finding as a true positive and replace pickle with a safe
format (e.g., JSON) plus schema validation.
C. Downgrade severity to LOW because the queue is internal.
D. Add a try/except around pickle.loads to catch malicious payloads.
Correct Answer: B - Treat the finding as a true positive and
replace pickle with a safe format (e.g., JSON) plus schema
validation.
RATIONALE
Taint flows from an unauthenticated webhook through the queue to
pickle.loads, making the finding a true positive with potential RCE.
Suppression or severity downgrade ignores the taint path, and
try/except cannot prevent code execution during deserialization.
Page 3
, Question 4
A test suite achieves 100% line coverage yet misses a bug where a function
returns None for empty input. Which testing technique would most likely
expose this defect?
A. Increasing line coverage to 100% on all branches.
B. Adding property-based tests that assert invariants across generated
inputs, including empty sequences.
C. Running the suite under pytest -x to stop on first failure.
D. Adding more assertions inside the function under test.
Correct Answer: B - Adding property-based tests that assert
invariants across generated inputs, including empty sequences.
RATIONALE
Line coverage does not guarantee oracle quality or input diversity;
property-based testing generates edge cases like empty inputs and
checks invariants, exposing the None return. Branch coverage may
still miss it, -x only changes failure handling, and internal assertions
do not create external test oracles.
Question 5
A Semgrep rule flags f"SELECT * FROM users WHERE name = '{name}'"
but the codebase uses a custom ORM that parameterizes queries before
execution. What is the most rigorous next step?
A. Disable the rule globally to reduce false positives.
B. Verify the ORM's parameterization path with a taint-mode Semgrep
rule and adjust the rule's sanitizer configuration.
C. Convert all queries to string concatenation to satisfy the rule.
D. Add # nosemgrep to every flagged line.
Correct Answer: B - Verify the ORM's parameterization path
with a taint-mode Semgrep rule and adjust the rule's sanitizer
configuration.
Page 4
