WGU D385 Software Security & Testing
API Security & Endpoint Vulnerability Practice
Lab
REST APIs, Authentication, Authorization, Pytest & Remediation | 2026 | 2027
Institution Western Governors University (WGU)
Course D385 - Software Security & Testing
Lab Title API Security & Endpoint Vulnerability Practice Lab
Academic Year
Total Questions 40 (4 sections x 10)
Cognitive Mix 30% recall | 50% application | 20% analysis
Question Style 75% scenario-based | 25% direct
Aligned Standards OWASP API Security Top 10 (2023), OAuth2/OIDC, JWT (RFC 7519)
Document Type Practice Lab Workbook + Exemplar + Grading Rubric
Total Points 100 (2.5 pts per question)
Scope. This workbook provides a hands-on, scenario-driven practice lab for identifying
vulnerable REST API endpoints, writing Pytest scripts to verify vulnerabilities, and selecting the
correct secure remediation. It integrates the latest OWASP API Security Top 10 guidelines,
modern API gateway configurations, and 2026/2027 updates including AI-driven API fuzzing,
GraphQL security, zero-trust API gateways, and automated DevSecOps pipeline integration.
How to use. Attempt all 40 questions before consulting Part 2 (Exemplar) or Part 3 (Grading
Rubric). Each rationale explains the exact vulnerability mechanism, the secure Pythonic fix,
and why distractors represent insecure code, broken tests, or flawed API designs.
WGU D385 | 2026 | 2027
, WGU D385 | API Security & Endpoint Vulnerability Practice Lab | 2026 Practice Lab Workbook
Table of Contents
Part Content Page Reference
Cover Title page and lab metadata 1
Part 1 40-Question Practice Lab Workbook (Q1-Q40) 3
Section 1: REST API Architecture & OWASP API Top 10 (Q1-Q10) 3
Section 2: Authentication, Authorization & Identity (Q11-Q20) 7
Section 3: Pytest Automation & Vulnerability Verification (Q21-Q30) 10
Section 4: Secure Remediation & 2026 Updates (Q31-Q40) 13
Part 2 Complete Solution (Exemplar Answer Key) 16
Part 3 Grading Rubric & Solution Key 18
Page 2
, WGU D385 | API Security & Endpoint Vulnerability Practice Lab | 2026 Practice Lab Workbook
Part 1: Practice Lab Workbook (40 Questions)
Instructions: Select the single best answer (A-D) for each question. Each question is worth 2.5
points. Mark your answers on a separate sheet before verifying with Part 2 (Exemplar) and Part
3 (Grading Rubric).
Section 1: REST API Architecture, Endpoint Exposure, & OWASP API Top
10
Q1: A REST API endpoint GET /api/v2/users/{user_id}/profile returns the full
profile for any user_id supplied by the authenticated client, with no server-side ownership
check. An attacker changes user_id from 1001 to 1002 and retrieves another user's data.
Which OWASP API Top 10 (2023) vulnerability is demonstrated?
A. Broken Authentication (API2:2023)
B. Unrestricted Resource Consumption (API4:2023)
C. Broken Object Level Authorization (API1:2023) [CORRECT]
D. Server Side Request Forgery (API10:2023)
Correct Answer: C
Rationale: BOLA (API1:2023) occurs when an endpoint exposes an object identifier (user_id) and
fails to verify the requester is authorized for that specific object; the fix is per-object authorization
on every request. Option A concerns credential/session flaws, not object-level access; Option B
concerns resource exhaustion (rate/CPU); Option D involves the server making outbound
requests to attacker-supplied URLs, which is unrelated.
Q2: An API returns user records including password_hash and security_answers fields in
the JSON response even though the frontend only displays username and email. Clients can
read hidden fields via DevTools. Which vulnerability is this?
A. Mass Assignment
B. Excessive Data Exposure (API3:2023) [CORRECT]
C. Improper Inventory Management
D. Broken Function Level Authorization
Correct Answer: B
Rationale: Excessive Data Exposure occurs when the API returns more sensitive fields than the
client needs, relying on the frontend to filter them; the secure fix is to return only required fields
server-side via response DTOs. Option A (Mass Assignment) concerns accepting too many input
fields; Option C concerns undocumented/old API versions; Option D concerns
function/endpoint-level access control.
Page 3
API Security & Endpoint Vulnerability Practice
Lab
REST APIs, Authentication, Authorization, Pytest & Remediation | 2026 | 2027
Institution Western Governors University (WGU)
Course D385 - Software Security & Testing
Lab Title API Security & Endpoint Vulnerability Practice Lab
Academic Year
Total Questions 40 (4 sections x 10)
Cognitive Mix 30% recall | 50% application | 20% analysis
Question Style 75% scenario-based | 25% direct
Aligned Standards OWASP API Security Top 10 (2023), OAuth2/OIDC, JWT (RFC 7519)
Document Type Practice Lab Workbook + Exemplar + Grading Rubric
Total Points 100 (2.5 pts per question)
Scope. This workbook provides a hands-on, scenario-driven practice lab for identifying
vulnerable REST API endpoints, writing Pytest scripts to verify vulnerabilities, and selecting the
correct secure remediation. It integrates the latest OWASP API Security Top 10 guidelines,
modern API gateway configurations, and 2026/2027 updates including AI-driven API fuzzing,
GraphQL security, zero-trust API gateways, and automated DevSecOps pipeline integration.
How to use. Attempt all 40 questions before consulting Part 2 (Exemplar) or Part 3 (Grading
Rubric). Each rationale explains the exact vulnerability mechanism, the secure Pythonic fix,
and why distractors represent insecure code, broken tests, or flawed API designs.
WGU D385 | 2026 | 2027
, WGU D385 | API Security & Endpoint Vulnerability Practice Lab | 2026 Practice Lab Workbook
Table of Contents
Part Content Page Reference
Cover Title page and lab metadata 1
Part 1 40-Question Practice Lab Workbook (Q1-Q40) 3
Section 1: REST API Architecture & OWASP API Top 10 (Q1-Q10) 3
Section 2: Authentication, Authorization & Identity (Q11-Q20) 7
Section 3: Pytest Automation & Vulnerability Verification (Q21-Q30) 10
Section 4: Secure Remediation & 2026 Updates (Q31-Q40) 13
Part 2 Complete Solution (Exemplar Answer Key) 16
Part 3 Grading Rubric & Solution Key 18
Page 2
, WGU D385 | API Security & Endpoint Vulnerability Practice Lab | 2026 Practice Lab Workbook
Part 1: Practice Lab Workbook (40 Questions)
Instructions: Select the single best answer (A-D) for each question. Each question is worth 2.5
points. Mark your answers on a separate sheet before verifying with Part 2 (Exemplar) and Part
3 (Grading Rubric).
Section 1: REST API Architecture, Endpoint Exposure, & OWASP API Top
10
Q1: A REST API endpoint GET /api/v2/users/{user_id}/profile returns the full
profile for any user_id supplied by the authenticated client, with no server-side ownership
check. An attacker changes user_id from 1001 to 1002 and retrieves another user's data.
Which OWASP API Top 10 (2023) vulnerability is demonstrated?
A. Broken Authentication (API2:2023)
B. Unrestricted Resource Consumption (API4:2023)
C. Broken Object Level Authorization (API1:2023) [CORRECT]
D. Server Side Request Forgery (API10:2023)
Correct Answer: C
Rationale: BOLA (API1:2023) occurs when an endpoint exposes an object identifier (user_id) and
fails to verify the requester is authorized for that specific object; the fix is per-object authorization
on every request. Option A concerns credential/session flaws, not object-level access; Option B
concerns resource exhaustion (rate/CPU); Option D involves the server making outbound
requests to attacker-supplied URLs, which is unrelated.
Q2: An API returns user records including password_hash and security_answers fields in
the JSON response even though the frontend only displays username and email. Clients can
read hidden fields via DevTools. Which vulnerability is this?
A. Mass Assignment
B. Excessive Data Exposure (API3:2023) [CORRECT]
C. Improper Inventory Management
D. Broken Function Level Authorization
Correct Answer: B
Rationale: Excessive Data Exposure occurs when the API returns more sensitive fields than the
client needs, relying on the frontend to filter them; the secure fix is to return only required fields
server-side via response DTOs. Option A (Mass Assignment) concerns accepting too many input
fields; Option C concerns undocumented/old API versions; Option D concerns
function/endpoint-level access control.
Page 3
