1|Page
WGU D385 SOFTWARE SECURITY AND
TESTING —ACTUAL FINAL EXAM PREP
150 QUESTIONS AND CORRECT DETAILED
ANSWERS ALREADY A GRADED WITH
EXPERT FEEDBACK |CURRENTLY
TESTING |NEW AND REVISED
1. Which security objective of the CIA triad ensures that authorized
users can access systems and data when needed?
A. Confidentiality
B. Availability
C. Integrity
D. Accountability
Integrity protects correctness; availability ensures authorized
access when needed.
2. STRIDE is a threat-modeling mnemonic. Which threat does the
“R” represent?
A. Repudiation
B. Repudiation
C. Reliability
D. Replay
STRIDE stands for Spoofing, Tampering, Repudiation,
Information Disclosure, Denial of Service, Elevation of Privilege.
3. What is the main purpose of input validation on server-side code?
A. Improve UI responsiveness
B. Prevent malformed or malicious data from being processed
C. Speed up database queries
D. Reduce memory usage
Server-side validation stops attacks such as injection even if
client-side checks are bypassed.
,2|Page
4. Which technique is most effective at preventing SQL injection
vulnerabilities?
A. Escaping output only
B. Using parameterized/prepared statements
C. Relying on client-side validation
D. Obfuscating SQL strings
Parameterized queries separate code from data, preventing user
input from being executed as SQL.
5. During continuous integration, which process helps detect
regressions early?
A. Manual exploratory testing weekly
B. Automated unit and integration test execution on each
commit
C. Waiting until a milestone to test
D. Only running smoke tests monthly
CI with automated tests provides fast feedback on introduced
defects.
6. Which password storage practice is considered secure?
A. Plaintext storage
B. Base64 encoding
C. Hashing with a unique salt and a slow KDF (e.g., bcrypt,
Argon2)
D. Symmetric encryption without key protection
Salted, slow hashes resist rainbow-table attacks and slow brute-
force attempts.
7. What does DAST (dynamic application security testing) primarily
analyze?
A. Source code without execution
B. An application while it is running
C. Project documentation
D. Repository history
DAST tests a running application to find runtime vulnerabilities
from an attacker’s perspective.
8. Which of the following is a common indicator of a buffer overflow
vulnerability?
,3|Page
A. Excessive database indexing
B. Unbounded copy of user-supplied input into a fixed-size
buffer
C. Use of HTTPS
D. Excessive logging
Overwriting adjacent memory due to unbounded copies leads to
buffer overflow issues.
9. Which testing method focuses on whether the software meets the
customer’s needs?
A. Unit testing
B. Integration testing
C. User acceptance testing (UAT)
D. Static analysis
UAT verifies that the system satisfies business requirements and
user expectations.
10. What is the best defense against Cross-Site Scripting (XSS)
in web applications?
A. Storing user data in session only
B. Properly escape or sanitize output according to context and
use CSP
C. Use long passwords
D. Disable all JavaScript globally
Contextual output encoding and Content Security Policy (CSP)
reduce XSS risk.
11. In threat modeling, what is the main benefit of using STRIDE
or similar frameworks?
A. To document UI design
B. To systematically identify categories of threats and guide
mitigations
C. To replace testing entirely
D. To define legal compliance only
Structured threat models help teams find and prioritize threats
early.
12. Which measure is most appropriate to mitigate the effects of
a successful server compromise?
, 4|Page
A. Keep default credentials
B. Enforce least privilege and network segmentation
C. Disable logging to hide traces
D. Permit administrative access to all users
Least privilege and segmentation limit attacker lateral movement
and blast radius.
13. What is a primary benefit of performing code reviews?
A. Slower release cycles
B. Early detection of logic and security issues by peers
C. Eliminates need for testing
D. Hides defects in comments
Peer review often catches mistakes static tools miss and spreads
knowledge.
14. Which of the following best describes fuzz testing?
A. Manual specification testing
B. Feeding random/malformed inputs to software to uncover
crashes or undefined behavior
C. Performance benchmarking
D. Input sanitization routine
Fuzzing reveals input-handling vulnerabilities and rare crash
conditions.
15. Which HTTP header helps mitigate clickjacking attacks by
preventing framing?
A. Content-Type
B. Transfer-Encoding
C. X-Frame-Options (or CSP frame-ancestors)
D. Cache-Control
X-Frame-Options or equivalent CSP directives block framing of
content by other sites.
16. In security logging, why is it important to avoid logging
sensitive data (like passwords)?
A. Logs are rarely used
B. It increases performance
C. Logs may be exposed; storing sensitive data creates a high-
value target
WGU D385 SOFTWARE SECURITY AND
TESTING —ACTUAL FINAL EXAM PREP
150 QUESTIONS AND CORRECT DETAILED
ANSWERS ALREADY A GRADED WITH
EXPERT FEEDBACK |CURRENTLY
TESTING |NEW AND REVISED
1. Which security objective of the CIA triad ensures that authorized
users can access systems and data when needed?
A. Confidentiality
B. Availability
C. Integrity
D. Accountability
Integrity protects correctness; availability ensures authorized
access when needed.
2. STRIDE is a threat-modeling mnemonic. Which threat does the
“R” represent?
A. Repudiation
B. Repudiation
C. Reliability
D. Replay
STRIDE stands for Spoofing, Tampering, Repudiation,
Information Disclosure, Denial of Service, Elevation of Privilege.
3. What is the main purpose of input validation on server-side code?
A. Improve UI responsiveness
B. Prevent malformed or malicious data from being processed
C. Speed up database queries
D. Reduce memory usage
Server-side validation stops attacks such as injection even if
client-side checks are bypassed.
,2|Page
4. Which technique is most effective at preventing SQL injection
vulnerabilities?
A. Escaping output only
B. Using parameterized/prepared statements
C. Relying on client-side validation
D. Obfuscating SQL strings
Parameterized queries separate code from data, preventing user
input from being executed as SQL.
5. During continuous integration, which process helps detect
regressions early?
A. Manual exploratory testing weekly
B. Automated unit and integration test execution on each
commit
C. Waiting until a milestone to test
D. Only running smoke tests monthly
CI with automated tests provides fast feedback on introduced
defects.
6. Which password storage practice is considered secure?
A. Plaintext storage
B. Base64 encoding
C. Hashing with a unique salt and a slow KDF (e.g., bcrypt,
Argon2)
D. Symmetric encryption without key protection
Salted, slow hashes resist rainbow-table attacks and slow brute-
force attempts.
7. What does DAST (dynamic application security testing) primarily
analyze?
A. Source code without execution
B. An application while it is running
C. Project documentation
D. Repository history
DAST tests a running application to find runtime vulnerabilities
from an attacker’s perspective.
8. Which of the following is a common indicator of a buffer overflow
vulnerability?
,3|Page
A. Excessive database indexing
B. Unbounded copy of user-supplied input into a fixed-size
buffer
C. Use of HTTPS
D. Excessive logging
Overwriting adjacent memory due to unbounded copies leads to
buffer overflow issues.
9. Which testing method focuses on whether the software meets the
customer’s needs?
A. Unit testing
B. Integration testing
C. User acceptance testing (UAT)
D. Static analysis
UAT verifies that the system satisfies business requirements and
user expectations.
10. What is the best defense against Cross-Site Scripting (XSS)
in web applications?
A. Storing user data in session only
B. Properly escape or sanitize output according to context and
use CSP
C. Use long passwords
D. Disable all JavaScript globally
Contextual output encoding and Content Security Policy (CSP)
reduce XSS risk.
11. In threat modeling, what is the main benefit of using STRIDE
or similar frameworks?
A. To document UI design
B. To systematically identify categories of threats and guide
mitigations
C. To replace testing entirely
D. To define legal compliance only
Structured threat models help teams find and prioritize threats
early.
12. Which measure is most appropriate to mitigate the effects of
a successful server compromise?
, 4|Page
A. Keep default credentials
B. Enforce least privilege and network segmentation
C. Disable logging to hide traces
D. Permit administrative access to all users
Least privilege and segmentation limit attacker lateral movement
and blast radius.
13. What is a primary benefit of performing code reviews?
A. Slower release cycles
B. Early detection of logic and security issues by peers
C. Eliminates need for testing
D. Hides defects in comments
Peer review often catches mistakes static tools miss and spreads
knowledge.
14. Which of the following best describes fuzz testing?
A. Manual specification testing
B. Feeding random/malformed inputs to software to uncover
crashes or undefined behavior
C. Performance benchmarking
D. Input sanitization routine
Fuzzing reveals input-handling vulnerabilities and rare crash
conditions.
15. Which HTTP header helps mitigate clickjacking attacks by
preventing framing?
A. Content-Type
B. Transfer-Encoding
C. X-Frame-Options (or CSP frame-ancestors)
D. Cache-Control
X-Frame-Options or equivalent CSP directives block framing of
content by other sites.
16. In security logging, why is it important to avoid logging
sensitive data (like passwords)?
A. Logs are rarely used
B. It increases performance
C. Logs may be exposed; storing sensitive data creates a high-
value target
