D385 - Software Security and Testing
Software Security and Testing (WGU - D385)
Exam Study Questions and Answers 100%
Correct 2025-2026
HTTP status code 403 -Correct Answers ✔-Forbidden - Client lacks necessary
permissions
HTTP status code 405 -Correct Answers ✔-Method Not Allowed - Endpoint does
not support the HTTP method
HTTP status code 404 -Correct Answers ✔-Not Found - The requested resource
does not exist
User-Agent header -Correct Answers ✔-Specifies what software the client is using
to communicate with the server
Authentication header -Correct Answers ✔-Specifies the credentials of the user
calling the API
Denial of Service -Correct Answers ✔-An attack that involves an overload of
requests to degrade system performance
Code Injection -Correct Answers ✔-An attack that allows an attacker to insert
malicious code into a program
HSTS headers absence -Correct Answers ✔-Indicates a vulnerability to Man-in-
the-Middle Attack
Accept header -Correct Answers ✔-Specifies the content type the client can accept
Content-Type header -Correct Answers ✔-Specifies the type of content the server
will respond with
D385 - Software Security and Testing
, D385 - Software Security and Testing
HTTP status code 400 -Correct Answers ✔-Bad Request - Invalid syntax or
formatting
Regression Testing -Correct Answers ✔-A software testing method that uses old
test cases to verify the impact of recent changes
Timing of regression testing -Correct Answers ✔-Should be conducted after code
changes are implemented
Cross-Site Scripting -Correct Answers ✔-An attack that involves executing
malicious scripts on a victim's browser
Log injection -Correct Answers ✔-Allows an attacker to inject commands that a
parser can execute
OAuth -Correct Answers ✔-A protocol that commonly uses tokens to authenticate
users and caches them for reuse
Server header -Correct Answers ✔-Specifies the software the server is using
response.content -Correct Answers ✔-Returns the raw binary content of the HTTP
response as bytes
Type and Range Check -Correct Answers ✔-Input validation that checks data
types and value ranges
Defense against log injection attacks -Correct Answers ✔-Sanitize outbound log
messages
Cross-Site Scripting vulnerability -Correct Answers ✔-Allows an attacker to
access the user's data
D385 - Software Security and Testing
Software Security and Testing (WGU - D385)
Exam Study Questions and Answers 100%
Correct 2025-2026
HTTP status code 403 -Correct Answers ✔-Forbidden - Client lacks necessary
permissions
HTTP status code 405 -Correct Answers ✔-Method Not Allowed - Endpoint does
not support the HTTP method
HTTP status code 404 -Correct Answers ✔-Not Found - The requested resource
does not exist
User-Agent header -Correct Answers ✔-Specifies what software the client is using
to communicate with the server
Authentication header -Correct Answers ✔-Specifies the credentials of the user
calling the API
Denial of Service -Correct Answers ✔-An attack that involves an overload of
requests to degrade system performance
Code Injection -Correct Answers ✔-An attack that allows an attacker to insert
malicious code into a program
HSTS headers absence -Correct Answers ✔-Indicates a vulnerability to Man-in-
the-Middle Attack
Accept header -Correct Answers ✔-Specifies the content type the client can accept
Content-Type header -Correct Answers ✔-Specifies the type of content the server
will respond with
D385 - Software Security and Testing
, D385 - Software Security and Testing
HTTP status code 400 -Correct Answers ✔-Bad Request - Invalid syntax or
formatting
Regression Testing -Correct Answers ✔-A software testing method that uses old
test cases to verify the impact of recent changes
Timing of regression testing -Correct Answers ✔-Should be conducted after code
changes are implemented
Cross-Site Scripting -Correct Answers ✔-An attack that involves executing
malicious scripts on a victim's browser
Log injection -Correct Answers ✔-Allows an attacker to inject commands that a
parser can execute
OAuth -Correct Answers ✔-A protocol that commonly uses tokens to authenticate
users and caches them for reuse
Server header -Correct Answers ✔-Specifies the software the server is using
response.content -Correct Answers ✔-Returns the raw binary content of the HTTP
response as bytes
Type and Range Check -Correct Answers ✔-Input validation that checks data
types and value ranges
Defense against log injection attacks -Correct Answers ✔-Sanitize outbound log
messages
Cross-Site Scripting vulnerability -Correct Answers ✔-Allows an attacker to
access the user's data
D385 - Software Security and Testing
