WGU D385 V2 SOFTWARE SECURITY
AND TESTING MASTER EXAM STUDY
GUIDE
1. Which phase of the Software Development Life Cycle (SDLC) is most cost-effective for
identifying and mitigating security flaws?
A. Requirements Analysis
B. Production
C. Testing
D. Deployment
Answer: A
Conceptual Explanation: Identifying security requirements early in the SDLC
(Requirements Analysis) prevents costly rework in later stages.
2. In the context of input validation, which approach is generally considered more secure?
A. Blacklisting known bad characters
B. Relying on client-side validation only
C. Sanitizing inputs using regular expressions after processing
,D. Whitelisting known good patterns
Answer: D
Conceptual Explanation: Whitelisting is more secure because it only allows known good
input, whereas blacklisting often fails to account for new or creative attack vectors.
3. Which technique is the most effective primary defense against SQL Injection?
A. Using stored procedures without parameters
B. Using Prepared Statements (with Parameterized Queries)
C. Implementing Web Application Firewalls (WAF)
D. Escaping all single quotes in user input
Answer: B
Conceptual Explanation: Prepared statements ensure that the database treats user input
as data, not executable code, effectively neutralizing SQL injection.
4. A security analyst is using a tool that analyzes the source code of an application without
executing it. What is this type of testing called?
A. DAST
B. Penetration Testing
C. SAST
D. Fuzzing
, Answer: C
Conceptual Explanation: Static Application Security Testing (SAST) examines the code or
binaries without executing the application.
5. What is the primary purpose of Cross-Origin Resource Sharing (CORS)?
A. To prevent Cross-Site Scripting (XSS)
B. To encrypt data transmitted between the client and server
C. To allow a web page to make requests to a different domain than the one that served it
D. To store session tokens securely in the browser
Answer: C
Conceptual Explanation: CORS is a mechanism that uses additional HTTP headers to tell
browsers to give a web application running at one origin access to selected resources from
a different origin.
6. Which OWASP Top 10 category involves an attacker exploiting a reference to an internal
implementation object, such as a file or database key?
A. Broken Access Control
B. Cryptographic Failures
C. Injection
D. Security Misconfiguration
Answer: A
AND TESTING MASTER EXAM STUDY
GUIDE
1. Which phase of the Software Development Life Cycle (SDLC) is most cost-effective for
identifying and mitigating security flaws?
A. Requirements Analysis
B. Production
C. Testing
D. Deployment
Answer: A
Conceptual Explanation: Identifying security requirements early in the SDLC
(Requirements Analysis) prevents costly rework in later stages.
2. In the context of input validation, which approach is generally considered more secure?
A. Blacklisting known bad characters
B. Relying on client-side validation only
C. Sanitizing inputs using regular expressions after processing
,D. Whitelisting known good patterns
Answer: D
Conceptual Explanation: Whitelisting is more secure because it only allows known good
input, whereas blacklisting often fails to account for new or creative attack vectors.
3. Which technique is the most effective primary defense against SQL Injection?
A. Using stored procedures without parameters
B. Using Prepared Statements (with Parameterized Queries)
C. Implementing Web Application Firewalls (WAF)
D. Escaping all single quotes in user input
Answer: B
Conceptual Explanation: Prepared statements ensure that the database treats user input
as data, not executable code, effectively neutralizing SQL injection.
4. A security analyst is using a tool that analyzes the source code of an application without
executing it. What is this type of testing called?
A. DAST
B. Penetration Testing
C. SAST
D. Fuzzing
, Answer: C
Conceptual Explanation: Static Application Security Testing (SAST) examines the code or
binaries without executing the application.
5. What is the primary purpose of Cross-Origin Resource Sharing (CORS)?
A. To prevent Cross-Site Scripting (XSS)
B. To encrypt data transmitted between the client and server
C. To allow a web page to make requests to a different domain than the one that served it
D. To store session tokens securely in the browser
Answer: C
Conceptual Explanation: CORS is a mechanism that uses additional HTTP headers to tell
browsers to give a web application running at one origin access to selected resources from
a different origin.
6. Which OWASP Top 10 category involves an attacker exploiting a reference to an internal
implementation object, such as a file or database key?
A. Broken Access Control
B. Cryptographic Failures
C. Injection
D. Security Misconfiguration
Answer: A
