1|Page
WGU D385 GENERAL SECURITY
VULNERABILITIES & SECURE
REMEDIATION LAB [QUESTIONS 1–100]
| 2026/2027 ORIGINAL PRACTICE
QUESTIONS | DETAILED RATIONALES |
INSTANT STUDY GUIDE
INTRODUCTION
The WGU D385 General Security Vulnerabilities and Secure Remediation Lab practice bank is
designed for learners developing practical cybersecurity skills in vulnerability identification,
secure coding, Python remediation, and security-scenario analysis. It is intended for students
preparing for security-focused coursework and laboratory assessments who want to strengthen
their ability to recognize weaknesses, select appropriate fixes, and explain why a remediation
improves security.
The questions emphasize application-level problem-solving rather than simple memorization.
Scenarios cover common software vulnerabilities, input validation, injection attacks,
authentication and authorization, cryptographic practices, secrets management, exception
handling, logging, dependency risks, and secure Python programming. Each question provides
four answer options and a rationale explaining the best answer and the weaknesses of the
alternatives.
Use this bank alongside your course materials, laboratory instructions, and official assessment
guidance. Work through each scenario before checking the answer, then practice implementing
and testing the proposed fix in a safe development environment. The goal is to build transferable
security reasoning: identify the root cause, choose a proportionate remediation, preserve intended
functionality, and verify that the vulnerability is no longer exploitable. These are original study
questions, not a reproduction of an official WGU assessment or a guarantee of a particular exam
result.
CONTENT AREA OVERVIEW
The distribution below is a suggested practice blueprint, not a verified official WGU weighting.
Practice
Content area Questions Key topics
weight
Vulnerability identification and Attack surfaces, impact, likelihood,
1–12 12%
risk analysis root-cause analysis
,2|Page
Python input validation and SQL injection, command injection,
13–28 16%
injection prevention parsing, allowlists
Authentication, authorization, Least privilege, access checks,
29–40 12%
and session security password handling, sessions
Cryptography and secrets Hashing, encryption, key storage,
41–50 10%
management random tokens
Secure error handling, logging, Information disclosure, audit logs,
51–60 10%
and data protection sensitive data
File, path, and operating-system Path traversal, permissions,
61–70 10%
security symlinks, subprocesses
Dependencies, configuration, and Patching, unsafe defaults,
71–80 10%
deployment environment configuration
Remediation testing and secure Regression tests, negative tests, code
81–90 10%
development review, verification
Combining controls, prioritization,
Integrated security scenarios 91–100 10%
incident response
QUESTIONS 1–100
Vulnerability identification and risk analysis
Q1: A Python web service accepts a customer ID from a request and uses it to retrieve a
customer record. A security review finds that a user can change the ID and retrieve another
customer's information. Which remediation most directly addresses the underlying vulnerability?
A) Hide the customer ID field in the user interface.
B) Enforce server-side authorization for the requested customer record on every request.
C) Replace sequential customer IDs with random-looking identifiers without changing access
checks.
D) Add the requesting user's IP address to the application log.
Rationale: B is correct because the server must verify that the authenticated user is authorized to
access the specific record. This addresses the broken object-level authorization that permits
cross-customer access. A is incorrect because client-side controls can be bypassed by crafting
requests directly. C is incorrect because unpredictable identifiers can reduce guessing but do not
replace authorization; leaked or discovered identifiers could still be used. D is incorrect because
logging may support detection and investigation but does not prevent unauthorized access.
Q2: A vulnerability scanner reports that an internet-facing application uses an outdated library
with a publicly documented vulnerability. The affected component processes unauthenticated
requests, and a working exploit is publicly available. What should the security team do first?
,3|Page
A) Wait until the next annual security review to avoid disrupting production.
B) Disable all application logging to improve performance during remediation.
C) Assess exposure and business impact promptly, apply an approved mitigation or patch,
and verify the fix.
D) Close the finding because a scanner report alone cannot prove exploitation.
Rationale: C is correct because a remotely reachable component with a known exploitable
weakness warrants prompt triage and remediation. The team should consider exposure, impact,
compensating controls, and testing before deploying a fix. A is incorrect because the delay
leaves a potentially exploitable attack surface exposed. B is incorrect because disabling logs
reduces visibility and does not address the vulnerable library. D is incorrect because confirmed
exploitation is not required for a valid vulnerability finding; the report should be assessed, not
automatically dismissed.
Q3: A Python function accepts a filename from a user and passes it to a file-reading routine.
Which observation most strongly indicates a path-traversal vulnerability?
A) The function uses UTF-8 to decode file contents.
B) The function catches FileNotFoundError.
C) The function records the filename in a debug log.
D) The function permits paths such as ../../private/credentials.txt to escape the
intended directory.
Rationale: D is correct because traversal sequences can cause an application to access files
outside its permitted directory. A concerns character encoding, B concerns handling a missing
file, and C concerns observability; none inherently prevents traversal. A secure design resolves
the requested path, verifies that it remains inside the approved directory, and uses appropriate
file permissions. Validation should also account for platform-specific path rules and symbolic
links where relevant.
Q4: A team rates two vulnerabilities. One affects an internal reporting tool with restricted access
and limited impact; the other affects a public API that exposes sensitive records without
authentication. Which factor should most strongly influence prioritization?
A) Which finding has the longest technical description.
B) Which vulnerability was discovered most recently.
C) The combination of exploitability, exposure, potential impact, and existing mitigations.
, 4|Page
D) Which remediation requires the fewest lines of code, regardless of risk.
Rationale: C is correct because prioritization should reflect realistic attack conditions and
consequences, including data sensitivity and exposure. A and B are not reliable indicators of
severity. D may be relevant when comparing implementation choices, but remediation effort
alone cannot determine which vulnerability poses the greatest risk. Teams should also consider
exploit activity, regulatory obligations, and the time required to implement a safe fix.
Q5: A code reviewer finds this Python code:
if username:
return get_account(username)
The endpoint requires a signed-in user to view their own account. What important control is
missing?
A) A check that username is a string with at least one character.
B) Authentication and authorization checks that establish the caller's identity and
permission to access the account.
C) A conversion of username to uppercase.
D) A print() statement that shows the account being requested.
Rationale: B is correct because a nonempty username does not prove who is making the request
or whether that person may access the account. A is insufficient even if implemented, because
input validation is not authorization. C changes formatting and could introduce account-
matching problems. D adds no meaningful security control and could disclose information. A
safer design derives the account identity from the authenticated principal when possible and
verifies permissions on the server.
Q6: A security report identifies a vulnerability in a development-only script that is not deployed
to production. The script has access to production credentials stored on the developer's machine.
How should the team evaluate the finding?
A) Ignore it because development scripts are never security-sensitive.
B) Classify it as harmless because it is not reachable over the public internet.
C) Evaluate the script's execution context, credential access, users, and realistic attack
paths before deciding on severity and remediation.
D) Delete all developer accounts immediately without investigating.
Rationale: C is correct because a non-production script can still create risk if it executes with
privileged access or handles production secrets. A and B incorrectly assume that only public
WGU D385 GENERAL SECURITY
VULNERABILITIES & SECURE
REMEDIATION LAB [QUESTIONS 1–100]
| 2026/2027 ORIGINAL PRACTICE
QUESTIONS | DETAILED RATIONALES |
INSTANT STUDY GUIDE
INTRODUCTION
The WGU D385 General Security Vulnerabilities and Secure Remediation Lab practice bank is
designed for learners developing practical cybersecurity skills in vulnerability identification,
secure coding, Python remediation, and security-scenario analysis. It is intended for students
preparing for security-focused coursework and laboratory assessments who want to strengthen
their ability to recognize weaknesses, select appropriate fixes, and explain why a remediation
improves security.
The questions emphasize application-level problem-solving rather than simple memorization.
Scenarios cover common software vulnerabilities, input validation, injection attacks,
authentication and authorization, cryptographic practices, secrets management, exception
handling, logging, dependency risks, and secure Python programming. Each question provides
four answer options and a rationale explaining the best answer and the weaknesses of the
alternatives.
Use this bank alongside your course materials, laboratory instructions, and official assessment
guidance. Work through each scenario before checking the answer, then practice implementing
and testing the proposed fix in a safe development environment. The goal is to build transferable
security reasoning: identify the root cause, choose a proportionate remediation, preserve intended
functionality, and verify that the vulnerability is no longer exploitable. These are original study
questions, not a reproduction of an official WGU assessment or a guarantee of a particular exam
result.
CONTENT AREA OVERVIEW
The distribution below is a suggested practice blueprint, not a verified official WGU weighting.
Practice
Content area Questions Key topics
weight
Vulnerability identification and Attack surfaces, impact, likelihood,
1–12 12%
risk analysis root-cause analysis
,2|Page
Python input validation and SQL injection, command injection,
13–28 16%
injection prevention parsing, allowlists
Authentication, authorization, Least privilege, access checks,
29–40 12%
and session security password handling, sessions
Cryptography and secrets Hashing, encryption, key storage,
41–50 10%
management random tokens
Secure error handling, logging, Information disclosure, audit logs,
51–60 10%
and data protection sensitive data
File, path, and operating-system Path traversal, permissions,
61–70 10%
security symlinks, subprocesses
Dependencies, configuration, and Patching, unsafe defaults,
71–80 10%
deployment environment configuration
Remediation testing and secure Regression tests, negative tests, code
81–90 10%
development review, verification
Combining controls, prioritization,
Integrated security scenarios 91–100 10%
incident response
QUESTIONS 1–100
Vulnerability identification and risk analysis
Q1: A Python web service accepts a customer ID from a request and uses it to retrieve a
customer record. A security review finds that a user can change the ID and retrieve another
customer's information. Which remediation most directly addresses the underlying vulnerability?
A) Hide the customer ID field in the user interface.
B) Enforce server-side authorization for the requested customer record on every request.
C) Replace sequential customer IDs with random-looking identifiers without changing access
checks.
D) Add the requesting user's IP address to the application log.
Rationale: B is correct because the server must verify that the authenticated user is authorized to
access the specific record. This addresses the broken object-level authorization that permits
cross-customer access. A is incorrect because client-side controls can be bypassed by crafting
requests directly. C is incorrect because unpredictable identifiers can reduce guessing but do not
replace authorization; leaked or discovered identifiers could still be used. D is incorrect because
logging may support detection and investigation but does not prevent unauthorized access.
Q2: A vulnerability scanner reports that an internet-facing application uses an outdated library
with a publicly documented vulnerability. The affected component processes unauthenticated
requests, and a working exploit is publicly available. What should the security team do first?
,3|Page
A) Wait until the next annual security review to avoid disrupting production.
B) Disable all application logging to improve performance during remediation.
C) Assess exposure and business impact promptly, apply an approved mitigation or patch,
and verify the fix.
D) Close the finding because a scanner report alone cannot prove exploitation.
Rationale: C is correct because a remotely reachable component with a known exploitable
weakness warrants prompt triage and remediation. The team should consider exposure, impact,
compensating controls, and testing before deploying a fix. A is incorrect because the delay
leaves a potentially exploitable attack surface exposed. B is incorrect because disabling logs
reduces visibility and does not address the vulnerable library. D is incorrect because confirmed
exploitation is not required for a valid vulnerability finding; the report should be assessed, not
automatically dismissed.
Q3: A Python function accepts a filename from a user and passes it to a file-reading routine.
Which observation most strongly indicates a path-traversal vulnerability?
A) The function uses UTF-8 to decode file contents.
B) The function catches FileNotFoundError.
C) The function records the filename in a debug log.
D) The function permits paths such as ../../private/credentials.txt to escape the
intended directory.
Rationale: D is correct because traversal sequences can cause an application to access files
outside its permitted directory. A concerns character encoding, B concerns handling a missing
file, and C concerns observability; none inherently prevents traversal. A secure design resolves
the requested path, verifies that it remains inside the approved directory, and uses appropriate
file permissions. Validation should also account for platform-specific path rules and symbolic
links where relevant.
Q4: A team rates two vulnerabilities. One affects an internal reporting tool with restricted access
and limited impact; the other affects a public API that exposes sensitive records without
authentication. Which factor should most strongly influence prioritization?
A) Which finding has the longest technical description.
B) Which vulnerability was discovered most recently.
C) The combination of exploitability, exposure, potential impact, and existing mitigations.
, 4|Page
D) Which remediation requires the fewest lines of code, regardless of risk.
Rationale: C is correct because prioritization should reflect realistic attack conditions and
consequences, including data sensitivity and exposure. A and B are not reliable indicators of
severity. D may be relevant when comparing implementation choices, but remediation effort
alone cannot determine which vulnerability poses the greatest risk. Teams should also consider
exploit activity, regulatory obligations, and the time required to implement a safe fix.
Q5: A code reviewer finds this Python code:
if username:
return get_account(username)
The endpoint requires a signed-in user to view their own account. What important control is
missing?
A) A check that username is a string with at least one character.
B) Authentication and authorization checks that establish the caller's identity and
permission to access the account.
C) A conversion of username to uppercase.
D) A print() statement that shows the account being requested.
Rationale: B is correct because a nonempty username does not prove who is making the request
or whether that person may access the account. A is insufficient even if implemented, because
input validation is not authorization. C changes formatting and could introduce account-
matching problems. D adds no meaningful security control and could disclose information. A
safer design derives the account identity from the authenticated principal when possible and
verifies permissions on the server.
Q6: A security report identifies a vulnerability in a development-only script that is not deployed
to production. The script has access to production credentials stored on the developer's machine.
How should the team evaluate the finding?
A) Ignore it because development scripts are never security-sensitive.
B) Classify it as harmless because it is not reachable over the public internet.
C) Evaluate the script's execution context, credential access, users, and realistic attack
paths before deciding on severity and remediation.
D) Delete all developer accounts immediately without investigating.
Rationale: C is correct because a non-production script can still create risk if it executes with
privileged access or handles production secrets. A and B incorrectly assume that only public
