WGU D385 Software Security and Testing Exam Latest Update 2024-2025 Actual Exam with 165 Questions and 100% Verified Correct Answers Guaranteed A+ At First Attempt Verified By Professor
3 methods for protecting against XSS? - CORRECT ANSWER: - validating input
- escaping output
- managing response headers
Advantage of Dynamic Code Analysis? - CORRECT ANSWER: - no need to understand
how to write software
- finds runtime vulnerabilities
- requires only a running system; conducted on any application
Advantage of Static Code Analysis? - CORRECT ANSWER: - fast turnaround time
- especially when tools are used
Common Status Codes? - CORRECT ANSWER: - 200 = OK
- 201 = CREATED
- 400 = BAD REQUEST
- 401 = UNAUTHORIZED
- 404 = NOT FOUND
- 405 = METHOD NOT ALLOWED
- 500 = INTERNAL SERVER ERROR
CSRF Mitigation - CORRECT ANSWER: - SameSite directive set to "strict"
- Referer header validation 1 / 3
- CSRF Tokens
Example of CSP - CORRECT ANSWER: - Content-Security-Policy: script-src none
Examples of Block Ciphers? - CORRECT ANSWER: - Triple DES
- Blowfish
- Twofish
- AES
Examples of Stream Ciphers? - CORRECT ANSWER: - RC4
- ChaCha
How to hash with sha256 in Python? - CORRECT ANSWER: import hashlibsha256 =
hashlib.sha256()sha256.update(b'message')hash = sha256.hexdigest()
Impact of Log Injection Attacks? - CORRECT ANSWER: - Logs might be tampered with or added
- If the application allows log records to be parsed, it might be possible to inject
executable code into the web application.
Limitations of Dynamic Code Analysis? - CORRECT ANSWER: - false positives and
false negatives
- dependent on the correctness of the rules
- false sense of security
- difficult to trace back to exact location
OAuth 4 Phases - CORRECT ANSWER: 1. requesting authorization
- granting authorization
- performing token exchange
- accessing protected resources 2 / 3
SameSite Directive setting "Lax" - CORRECT ANSWER: - browser will echo the session ID cookie for the same site and cross-site top-level navigation requests that use safe HTTP methods like GET
- DEFAULT
SameSite Directive setting "strict" - CORRECT ANSWER: - browser will only echo the session ID cookie for same site requests
SameSite Directive setting NONE - CORRECT ANSWER: - browser will echo the
session ID cookie without any conditions back to the server
- cannot be the default
Secure Directive - CORRECT ANSWER: - prevents MITM
- ensures cookie transmitted over HTTPS
Secure Unit Testing - CORRECT ANSWER: - check for bad input
- bypass security
- inject bad data
Set-Cookie Response Header 5 Directives? - CORRECT ANSWER: - HttpOnly
- SameSite
- Secure
- Domain
- Max-Age
TLS Handshake: 3 Tasks - CORRECT ANSWER: 1. cipher suite negotiation
- key exchange
- server authentication
- / 3