Western Governors University (WGU) ITEC2034 D385 Software Security and Testing Practice Test

These questions are part of the practice quiz. Start practicing

• How do input validation and output encoding contribute to security?
• Which header would you inspect to determine the client’s preferred response format, such as JSON?
• CORS relaxes which security policy for certain resources?
• Which activity is part of mitigation planning?
• In a Secure Software Development Life Cycle (Secure SDLC), which phases include security activities?
• What is the purpose of fuzz testing in security testing?
• In the 403 server response question, which status code indicates the server understood the request but refuses to authorize?
• Which HTTP header indicates what content types the client can accept in responses?
• What can an attacker do with a log injection attack?
• What is the concept of separation of duties and provide an example?
• Given r = range(1, 10) and num = int(input()), which value prints 'The number input is in the range from 1 and 10'?
• What are patch management basics in secure software?
• Which is NOT a category in the OWASP Top 10 vulnerability categories?
• Which vulnerability is indicated by checking for the Strict-Transport-Security header in HTTP responses?
• In the grant_permission function, when result is False, what permission is assigned to the file?
• Which package is meant for internal use by Python for regression testing?
• In STRIDE threat modeling, which threat category corresponds to impersonation or pretending to be someone else to gain access?
• In the context of secure releases, what is the purpose of tamper-evident logs?
• Which response attribute, when sent a request, returns information about the server's response and is delivered back to the console?
• What is a threat model and what are common steps in creating one?
• What does STRIDE stand for in threat modeling?
• Which STRIDE category is primarily about altering data to misrepresent or corrupt information?
• Which check does the function check_numeric_value perform?
• Which concept involves re-running existing tests to ensure changes have not introduced new defects?
• In Python's string.Template, which method raises an error if a placeholder in the template has no corresponding value?
• Explain the difference between manual security testing and automated testing.
• Which API design practice helps prevent privilege escalation by controlling access at both resource and field levels?
• Exploiting query parameters is an example of what attack?
• Which software testing method relies on using old test cases?
• What is business continuity and disaster recovery in a software security context?
• What does least privilege mean and how is it typically implemented in software systems?
• What does HTTP status code 400 indicate?
• Which HTTP status code indicates the request could not be understood due to invalid syntax or bad formatting?
• An attacker exploits a cross-site scripting vulnerability. What is the attacker able to do?
• Which status code should be used when the requested operation is not allowed on the endpoint's method?
• What does Cross-origin Resource Sharing (CORS) govern?
• Why is synthetic data used in a security test environment?
• When accessing an API endpoint that requires a header, requesting 'https://api.github.com/invalid' and calling raise_for_status() typically yields which status code?
• What are two common defensive coding techniques?
• Which of the following is NOT typically considered a security control?
• In the provided function, what is returned when the first argument x is None?
• Why is monitoring and logging important for security?
• Which status code indicates the server understood the request but requires authentication to proceed?
• In threat modeling using STRIDE, mapping assets to threats helps with what?
• Explain how to perform SQL injection testing safely in a practice test environment.
• Which item describes when testing is complete in a security test plan?
• What technique is used to ensure the zip code is numeric in the provided example?
• What does HTTP status code 201 indicate?
• Which defensive coding principle involves verifying conditions before and after a function runs?
• Which HTTP header reveals the software the server is using to communicate with the client?
• What is the primary defense against log injection attacks?
• Which HTTP header identifies the client software making the request?
• What will be the result of running the code that asserts the user has 'admin' in the list, given ['user']?
• What type of validation is performed by code that repeatedly prompts for a number until a valid integer between 1 and 10 is entered?
• Which security vulnerability is demonstrated by a function that reveals data only if the caller's user ID equals the stored owner ID?
• What does SCA stand for and what does it do?
• Which of the following is a STRIDE threat category?
• Which HTTP status code indicates access is forbidden due to insufficient permissions?
• In the AES encrypt method shown, which mode is used for the cipher?
• Which HTTP status code indicates the endpoint does not allow for that specific HTTP method?
• Which HTTP header is described as carrying the authentication credentials in requests?
• Which Python package is intended for internal use by Python for regression testing?
• What is the difference between authentication and authorization?
• Which method is used for a SQL injection attack?
• When should regression testing be conducted?
• Which status code is used when authentication credentials are missing or invalid?
• Which Python function is used to protect against log injection attacks?
• What is the best way to ensure the API is protected against privilege escalation?
• Which outcome is a likely result if a site is vulnerable to cross-site scripting?
• What is the OWASP Top 10 and why is it important in software security testing?
• What is common misconfiguration risk and how to prevent it?
• What is the key difference between SAST and DAST in application security testing?
• What is security misconfiguration and how to mitigate?
• Which deployment principle includes secure defaults, patching, configuration hardening, least privilege, logging, and monitoring?
• Which of the following is a category in the OWASP Top 10?
• What is returned when using response.content?
• What is printed when a non-numeric zip code is entered in the provided code snippet?
• What role does TLS play in securing communications?
• Why is privacy impact assessment relevant to software security testing?
• Which Python package is described as intended for internal use by Python to support regression testing?
• Which of the following best describes the goals of cryptography in software security?
• Which consequence is commonly associated with a Cross-Site Scripting (XSS) attack for other users?
• Which statement best describes encryption at rest versus encryption in transit?
• What is the purpose of code reviews in security?
• Which of the following is an example of defense in depth?
• What does cross-origin resource sharing (CORS) allow users to do?
• What condition commonly yields HTTP status code 403 in the given scenario?
• What is a threat model in information security, and which activity is typically performed first?
• Which statement best reflects the principle of fail-safe defaults?
• How should you design security test cases?
• In the hash_password example, which method yields the hexadecimal representation of the hash?
• What is an incident response plan and what are its typical steps?
• What is the purpose of the safe_deserialize function when key verification fails?
• Which response method, when sent a request, returns information about the server's response and is delivered back to the console?
• Which Python function should be avoided when evaluating user-provided input to prevent code execution?
• How does threat modeling influence testing scope?
• Why is the OWASP Top 10 important in software security testing?
• Which scenario would most likely trigger a 400 Bad Request response?
• Which HTTP status code indicates an internal server error?
• Which practice best reduces the risk of SQL injection during testing?
• What does a code injection attack involve?
• The Celsius to Fahrenheit function uses an assertion. What condition does this assertion enforce?
• Which status code corresponds to Not Found?
• What does cross-origin resource sharing (CORS) allow browsers to do?
• What does check_null_string return when the input is None?
• Which Python function is used for input validation?
• In risk assessment, what is the next step after identifying threats and vulnerabilities?
• Which statement about code injection attacks is accurate?
• Which statement best describes what the AES encrypt method returns?
• What is threat modeling used for in the design phase?
• The header that announces which software is handling requests on the server side is called what?
• Difference between compliance testing and security testing?
• In Python, which statement inside an exception handler logs an error message?
• Which status category is described as being common with API related errors in the material?
• Which statement describes 403 Forbidden?
• Which tool type is used for static analysis in security testing?
• What is attack surface and how can you reduce it?
• Which secure coding practice addresses input validation and output encoding to prevent injection?
• If the calculated bucket in the rate-limiting code exceeds the rate, what happens?
• Which permission setting corresponds to granting read, write, and execute only to the owner and no permissions to others?
• Which statement best describes a security test environment?
• IAST stands for what and how does it work?
• What is the primary defense against log injection attacks?
• What is the purpose of CVE in vulnerability management?
• When you send credentials with a request, which header is described as carrying authentication information in the material?
• Which status code is returned when the requested resource cannot be found?
• Which statement correctly distinguishes 401 Unauthorized from 403 Forbidden?
• Which Python function is prone to a potential code injection attack?
• In the ShowData security example, which user ID would grant access to the data?
• How do you measure security testing effectiveness?
• What happens when the bucket value is less than 1 in the rate-limiting snippet?
• Which metric is commonly used to evaluate the quality of security testing results?
• Which practice reduces the risk of log injection by ensuring log content cannot be interpreted as code?
• A user masquerades as other users, what type of attack was used?
• What is secure-by-default cloud resource configuration?
• SQL injection mitigation best practice?
• Which statement best contrasts 401 and 403 responses?
• Which HTTP status code indicates the requested resource does not exist?
• What does the abbreviation XSS stand for in web security?
• Which HTTP status code means the request requires authentication to proceed?
• Access Control Allow Origin: client request to (www.client.url) What is returned by the server?
• What is the primary goal of a Denial of Service (DoS) attack?
• Which protocol caches a token after it has been acquired?
• In the password length check program, what message is printed when a 7-character password is entered?
• Which status code represents valid authentication but insufficient authorization?
• Why is vulnerability management a continuous process in software security?
• Which statement best differentiates intrusion detection and intrusion prevention systems?
• Which protocol caches a token after it has been acquired?
• Which aspect best ensures secure authentication system design?
• Which statement best describes the roles of red team, blue team, and purple team in security testing?
• Which library is commonly used to cache tokens after acquisition in authentication flows?
• Which statement describes a NOT recommended stage in patch management?
• What are security controls and provide examples in software?
• Cross-Site Scripting (XSS) occurs when an attacker...
• Status code 401 is common with?
• Which status code indicates the resource has been created as a result of the request?
• Which description best captures a security test plan's content?
• What describes cross-site scripting and how to prevent it?
• Which hashing algorithm is used in the hash_password function?
• What are secure coding practices for authentication systems?
• A security analyst has noticed a vulnerability in which an attacker took over multiple users' accounts. Which vulnerability did the security analyst encounter?
• In disaster recovery planning, which elements are commonly included?
• In the 404 NOT FOUND scenario for an invalid API endpoint, which condition yields 404?
• Which HTTP header indicates the type of content the server will respond with?
• What does HTTP status code 200 indicate?
• Which description best captures a key practice in patch management?
• What is the primary purpose of fuzzers in security testing?
• Can be used on the first (ungraded) page to view status codes
• What is a secure release and how can you ensure it?
• What does defense in depth mean in software security, and what is a practical example?
• What is the primary role of the purple team in security testing?
• Which components provide the data used to validate requests in web communications?
• What algorithm is illustrated by a rate-limiting snippet that uses a token bucket approach?
• What is software composition analysis (SCA) and why it matters?
• Which statement best describes secure SDLC practices?