WGU D385 Software Security and
Testing Static Code Analysis & Flake8
Practice Lab Python Security, Logging,
Testing & Remediation 2026 | Verified
WGU D385 Software Security and Testing Static | Comprehensive
Examination
WGU D385 Software Security and Testing Static Code
Analysis & Flake8 Practice Lab Python Security, Logging,
Testing & Remediation 2026 actual exam preparation
INTRODUCTION
This document is an important and very helpful preparation
resource for WGU D385 Software Security and Testing Static
Code Analysis & Flake8 Practice Lab Python Security, Logging,
Testing & Remediation 2026. Every item uses a focused exam
stem, four response options, a keyed response, and a clear
rationale, making it easier to understand the subject, spot
distractors, and build real exam confidence.
Page 1
, Question 1
A flake8 run with the bandit plugin reports B301: pickle.loads() on untrusted
data. Which remediation best preserves functionality while eliminating the
vulnerability?
A. Replace pickle with json and validate the schema with pydantic before
use.
B. Wrap pickle.loads in a try/except and log the exception.
C. Use pickle.Unpickler with find_class restricted to a whitelist of safe
classes.
D. Enable Python's -X dev mode to catch deserialization errors.
Correct Answer: C - Use pickle.Unpickler with find_class
restricted to a whitelist of safe classes.
RATIONALE
Restricting find_class to a whitelist maintains pickle compatibility
while blocking arbitrary code execution. JSON (A) may not support
all types; try/except (B) does not prevent exploitation; -X dev (D) only
adds runtime checks, not security.
Question 2
In a CI pipeline, flake8 reports E501 line too long on a line containing a
hardcoded AWS secret. Which action best aligns with secure remediation and
linting policy?
A. Add # noqa: E501 to suppress the warning and commit.
B. Refactor the line and move the secret to an environment variable, then
rotate the exposed key.
C. Increase max-line-length in setup.cfg to 120.
D. Use a pre-commit hook to auto-format with black.
Correct Answer: B - Refactor the line and move the secret to an
environment variable, then rotate the exposed key.
Page 2
, RATIONALE
The secret must be removed from source and rotated; refactoring
addresses the lint issue. Suppression (A) or config change (C) hides
the problem; auto-formatting (D) does not remove the secret.
Question 3
Which flake8 plugin combination best detects both style and security issues in
Python code?
A. flake8-docstrings and flake8-import-order
B. flake8-bugbear and flake8-comprehensions
C. flake8-bandit and flake8-bugbear
D. flake8-annotations and flake8-quotes
Correct Answer: C - flake8-bandit and flake8-bugbear
RATIONALE
flake8-bandit integrates Bandit security checks; flake8-bugbear
catches likely bugs. The others focus on style, documentation, or
import ordering, not security.
Question 4
A developer uses logging.info(f"User {user} logged in with password
{password}"). What is the most critical security flaw?
A. Using f-strings instead of %-formatting causes performance overhead.
B. Logging at INFO level may be disabled in production.
C. Sensitive credentials are written to logs, risking exposure.
D. The log message lacks a timestamp and correlation ID.
Correct Answer: C - Sensitive credentials are written to logs,
risking exposure.
Page 3
, RATIONALE
Logging passwords is a severe data leakage vulnerability. Performance
(A) and log level (B) are secondary; missing metadata (D) is an audit
concern, not the primary flaw.
Question 5
Which testing approach is most effective for uncovering edge cases in a
function that parses untrusted input?
A. Unit tests with mocked inputs
B. Property-based testing with Hypothesis
C. Integration tests with a real database
D. Manual exploratory testing
Correct Answer: B - Property-based testing with Hypothesis
RATIONALE
Property-based testing generates diverse inputs to find edge cases.
Unit tests (A) may miss unexpected inputs; integration tests (C) focus
on system interaction; manual testing (D) is not systematic.
Question 6
A flake8 report shows F401 'module imported but unused' for the
'cryptography' module. What is the best remediation?
A. Remove the import if truly unused.
B. Add # noqa: F401 to suppress the warning.
C. Use the module in a dummy function to avoid the warning.
D. Move the import inside a function.
Correct Answer: A - Remove the import if truly unused.
Page 4
Testing Static Code Analysis & Flake8
Practice Lab Python Security, Logging,
Testing & Remediation 2026 | Verified
WGU D385 Software Security and Testing Static | Comprehensive
Examination
WGU D385 Software Security and Testing Static Code
Analysis & Flake8 Practice Lab Python Security, Logging,
Testing & Remediation 2026 actual exam preparation
INTRODUCTION
This document is an important and very helpful preparation
resource for WGU D385 Software Security and Testing Static
Code Analysis & Flake8 Practice Lab Python Security, Logging,
Testing & Remediation 2026. Every item uses a focused exam
stem, four response options, a keyed response, and a clear
rationale, making it easier to understand the subject, spot
distractors, and build real exam confidence.
Page 1
, Question 1
A flake8 run with the bandit plugin reports B301: pickle.loads() on untrusted
data. Which remediation best preserves functionality while eliminating the
vulnerability?
A. Replace pickle with json and validate the schema with pydantic before
use.
B. Wrap pickle.loads in a try/except and log the exception.
C. Use pickle.Unpickler with find_class restricted to a whitelist of safe
classes.
D. Enable Python's -X dev mode to catch deserialization errors.
Correct Answer: C - Use pickle.Unpickler with find_class
restricted to a whitelist of safe classes.
RATIONALE
Restricting find_class to a whitelist maintains pickle compatibility
while blocking arbitrary code execution. JSON (A) may not support
all types; try/except (B) does not prevent exploitation; -X dev (D) only
adds runtime checks, not security.
Question 2
In a CI pipeline, flake8 reports E501 line too long on a line containing a
hardcoded AWS secret. Which action best aligns with secure remediation and
linting policy?
A. Add # noqa: E501 to suppress the warning and commit.
B. Refactor the line and move the secret to an environment variable, then
rotate the exposed key.
C. Increase max-line-length in setup.cfg to 120.
D. Use a pre-commit hook to auto-format with black.
Correct Answer: B - Refactor the line and move the secret to an
environment variable, then rotate the exposed key.
Page 2
, RATIONALE
The secret must be removed from source and rotated; refactoring
addresses the lint issue. Suppression (A) or config change (C) hides
the problem; auto-formatting (D) does not remove the secret.
Question 3
Which flake8 plugin combination best detects both style and security issues in
Python code?
A. flake8-docstrings and flake8-import-order
B. flake8-bugbear and flake8-comprehensions
C. flake8-bandit and flake8-bugbear
D. flake8-annotations and flake8-quotes
Correct Answer: C - flake8-bandit and flake8-bugbear
RATIONALE
flake8-bandit integrates Bandit security checks; flake8-bugbear
catches likely bugs. The others focus on style, documentation, or
import ordering, not security.
Question 4
A developer uses logging.info(f"User {user} logged in with password
{password}"). What is the most critical security flaw?
A. Using f-strings instead of %-formatting causes performance overhead.
B. Logging at INFO level may be disabled in production.
C. Sensitive credentials are written to logs, risking exposure.
D. The log message lacks a timestamp and correlation ID.
Correct Answer: C - Sensitive credentials are written to logs,
risking exposure.
Page 3
, RATIONALE
Logging passwords is a severe data leakage vulnerability. Performance
(A) and log level (B) are secondary; missing metadata (D) is an audit
concern, not the primary flaw.
Question 5
Which testing approach is most effective for uncovering edge cases in a
function that parses untrusted input?
A. Unit tests with mocked inputs
B. Property-based testing with Hypothesis
C. Integration tests with a real database
D. Manual exploratory testing
Correct Answer: B - Property-based testing with Hypothesis
RATIONALE
Property-based testing generates diverse inputs to find edge cases.
Unit tests (A) may miss unexpected inputs; integration tests (C) focus
on system interaction; manual testing (D) is not systematic.
Question 6
A flake8 report shows F401 'module imported but unused' for the
'cryptography' module. What is the best remediation?
A. Remove the import if truly unused.
B. Add # noqa: F401 to suppress the warning.
C. Use the module in a dummy function to avoid the warning.
D. Move the import inside a function.
Correct Answer: A - Remove the import if truly unused.
Page 4
