WGU D385 LOGGING AND SECURITY ISSUES COMPREHENSIVE
EXAM PAPER WITH SOLVED QUESTIONS
◉ LOG: The Dec 25 deletion incident
Answer: DELETE /api/v1/admin/delete_user removed user alice, called unauthenticated from an
external IP - broken access control on a destructive endpoint is the single scariest log line
◉ LOG: The Dec 24 API-key-in-URL event
Answer: A GET request carried api_key as a query parameter; the log itself notes keys belong in the
Authorization header - live evidence of CWE-598
◉ LOG: The Dec 26 horizontal privilege escalation
Answer: Logged-in alice fetched bob's user data - same-role users can read each other's records
because no per-resource authorization check exists
, ◉ LOG: The Dec 27 mass assignment event
Answer: A rental POST smuggled an extra role field set to admin and the API accepted it - only accept
the expected fields (allowlist the request schema)
◉ LOG: The Dec 27 boundary failures
Answer: A 10,000-character search string broke memory allocation (buffer-overflow-style, no length
validation) and days of 999999 produced a half-billion-dollar rental (no boundary validation)
◉ LOG: The Dec 27 DNS hijacking indicator
Answer: A suspicious DNS query for a malicious domain - possible DNS hijack or data exfiltration
channel; the pen-test template asks you to explain this attack class
◉ LOG: Other exposure events worth citing
Answer: SSN fields exposed in rental responses, password_hash values leaking in an API response, and
a raw sqlite3 OperationalError string sent to a client - all D-report ammunition
EXAM PAPER WITH SOLVED QUESTIONS
◉ LOG: The Dec 25 deletion incident
Answer: DELETE /api/v1/admin/delete_user removed user alice, called unauthenticated from an
external IP - broken access control on a destructive endpoint is the single scariest log line
◉ LOG: The Dec 24 API-key-in-URL event
Answer: A GET request carried api_key as a query parameter; the log itself notes keys belong in the
Authorization header - live evidence of CWE-598
◉ LOG: The Dec 26 horizontal privilege escalation
Answer: Logged-in alice fetched bob's user data - same-role users can read each other's records
because no per-resource authorization check exists
, ◉ LOG: The Dec 27 mass assignment event
Answer: A rental POST smuggled an extra role field set to admin and the API accepted it - only accept
the expected fields (allowlist the request schema)
◉ LOG: The Dec 27 boundary failures
Answer: A 10,000-character search string broke memory allocation (buffer-overflow-style, no length
validation) and days of 999999 produced a half-billion-dollar rental (no boundary validation)
◉ LOG: The Dec 27 DNS hijacking indicator
Answer: A suspicious DNS query for a malicious domain - possible DNS hijack or data exfiltration
channel; the pen-test template asks you to explain this attack class
◉ LOG: Other exposure events worth citing
Answer: SSN fields exposed in rental responses, password_hash values leaking in an API response, and
a raw sqlite3 OperationalError string sent to a client - all D-report ammunition
