WGU D385 V2
Software Security and Testing
Task 2 Performance Assessment Guide
Vulnerability Remediation • API Security • Pytest • Mitigation Report
August 2026 Updated
Important: This is an independent study guide and original exemplar. It is designed to help a learner understand and
satisfy the current D385 V2 Task 2 requirements using their own starter files, code, screenshots, and live WGU rubric. It
is not an official WGU document and cannot guarantee an evaluator decision.
Prepared from current public WGU course scope, August 2026 learner reports, and current secure-coding
references.
D385 V2 Task 2 Performance Assessment Guide | August 2026 | Independent study resource • 1
,Contents
1. August 2026 Alignment & Research Basis
2. Task 2 Scenario and Deliverable Architecture
3. Rubric Map: Sections A-D
4. Secure Remediation Principles You Need
5. Section A - General Security Vulnerabilities
6. Section B - API Security Vulnerabilities
7. Section C - Pytest Validation & Evidence
8. Section D - Security Mitigation Report
9. Original Secure-Coding Exemplars
10. Screenshot & Evidence Engineering
11. Testing Strategy and Test Matrix
12. Common Evaluation Return Risks
13. Submission Packaging and Final QA
14. 25-Point Pass-Readiness Checklist
15. Quick Reference & Sources
D385 V2 Task 2 Performance Assessment Guide | August 2026 | Independent study resource • 2
, 1. August 2026 Alignment & Research Basis
WGU currently describes D385 - Software Security and Testing as a course focused on recognizing
software vulnerabilities, planning interventions, developing and testing those interventions, and working
with web security, permissions/identity, debugging, log analysis, API security, encryption, and
cryptography. The V2 version moved from the older objective-assessment format to a two-task
performance-assessment structure in April 2026.
Source hierarchy: The complete Task 2 rubric and starter application are private course materials. Public sources are
useful for orientation, but the learner's current portal rubric, task files, and course-instructor guidance are the
controlling requirements.
Evidence level What it establishes How this guide uses it
Official public WGU Current D385 course scope and Defines the security/testing subject
competency emphasis matter and avoids outdated OA
framing.
Recent D385 V2 pass reports Task count, submission pattern, Used to build the practical A-D map
section-level workflow, common and evidence checklist; clearly labeled
ambiguities as learner-reported.
OWASP / Python / pytest docs Secure coding and testing best practice Used for technical examples:
parameterized queries, input
validation, bearer-token handling, TLS,
pytest assertions/fixtures.
What changed from old D385 content
Do not prepare for the pre-April 2026 OA as if it were the current assessment.
Task 2 is hands-on: select vulnerabilities, preserve the original insecure code as comments, implement
fixes, test the fixes, capture evidence, and explain mitigation decisions.
The assessment is not asking you to repair every TODO in the starter application. Recent pass reports
consistently advise following the live rubric and solving the required number of items.
The security mitigation report is a written deliverable; screenshot evidence is handled separately
according to the current submission instructions.
2. Task 2 Scenario and Deliverable Architecture
The current V2 learner-reported workflow uses a Python/Flask application with starter code, a static-
analysis/Flake8-style report, a test runner, SQLite-related code, and API endpoints. The learner identifies
and remediates selected security issues, validates the fixes with pytest, and produces a security mitigation
report plus screenshot evidence. Exact filenames and code locations can change; always use the files
supplied in the current course.
D385 V2 Task 2 Performance Assessment Guide | August 2026 | Independent study resource • 3
Software Security and Testing
Task 2 Performance Assessment Guide
Vulnerability Remediation • API Security • Pytest • Mitigation Report
August 2026 Updated
Important: This is an independent study guide and original exemplar. It is designed to help a learner understand and
satisfy the current D385 V2 Task 2 requirements using their own starter files, code, screenshots, and live WGU rubric. It
is not an official WGU document and cannot guarantee an evaluator decision.
Prepared from current public WGU course scope, August 2026 learner reports, and current secure-coding
references.
D385 V2 Task 2 Performance Assessment Guide | August 2026 | Independent study resource • 1
,Contents
1. August 2026 Alignment & Research Basis
2. Task 2 Scenario and Deliverable Architecture
3. Rubric Map: Sections A-D
4. Secure Remediation Principles You Need
5. Section A - General Security Vulnerabilities
6. Section B - API Security Vulnerabilities
7. Section C - Pytest Validation & Evidence
8. Section D - Security Mitigation Report
9. Original Secure-Coding Exemplars
10. Screenshot & Evidence Engineering
11. Testing Strategy and Test Matrix
12. Common Evaluation Return Risks
13. Submission Packaging and Final QA
14. 25-Point Pass-Readiness Checklist
15. Quick Reference & Sources
D385 V2 Task 2 Performance Assessment Guide | August 2026 | Independent study resource • 2
, 1. August 2026 Alignment & Research Basis
WGU currently describes D385 - Software Security and Testing as a course focused on recognizing
software vulnerabilities, planning interventions, developing and testing those interventions, and working
with web security, permissions/identity, debugging, log analysis, API security, encryption, and
cryptography. The V2 version moved from the older objective-assessment format to a two-task
performance-assessment structure in April 2026.
Source hierarchy: The complete Task 2 rubric and starter application are private course materials. Public sources are
useful for orientation, but the learner's current portal rubric, task files, and course-instructor guidance are the
controlling requirements.
Evidence level What it establishes How this guide uses it
Official public WGU Current D385 course scope and Defines the security/testing subject
competency emphasis matter and avoids outdated OA
framing.
Recent D385 V2 pass reports Task count, submission pattern, Used to build the practical A-D map
section-level workflow, common and evidence checklist; clearly labeled
ambiguities as learner-reported.
OWASP / Python / pytest docs Secure coding and testing best practice Used for technical examples:
parameterized queries, input
validation, bearer-token handling, TLS,
pytest assertions/fixtures.
What changed from old D385 content
Do not prepare for the pre-April 2026 OA as if it were the current assessment.
Task 2 is hands-on: select vulnerabilities, preserve the original insecure code as comments, implement
fixes, test the fixes, capture evidence, and explain mitigation decisions.
The assessment is not asking you to repair every TODO in the starter application. Recent pass reports
consistently advise following the live rubric and solving the required number of items.
The security mitigation report is a written deliverable; screenshot evidence is handled separately
according to the current submission instructions.
2. Task 2 Scenario and Deliverable Architecture
The current V2 learner-reported workflow uses a Python/Flask application with starter code, a static-
analysis/Flake8-style report, a test runner, SQLite-related code, and API endpoints. The learner identifies
and remediates selected security issues, validates the fixes with pytest, and produces a security mitigation
report plus screenshot evidence. Exact filenames and code locations can change; always use the files
supplied in the current course.
D385 V2 Task 2 Performance Assessment Guide | August 2026 | Independent study resource • 3
