Register
Question 1
In the API code snippet that performs a GET request and prints result content, which HTTP status would you expect from a forbidden resource?
Correct Answer:
403 - FORBIDDEN
Explanation:
Access control is shown by HTTP status codes. If a resource exists but the client isn’t allowed to access it, the server returns 403 Forbidden, signaling that authentication may be present but the client lacks the necessary permissions. A 200 OK would indicate the request succeeded and content was returned, which isn’t the case for a restricted resource. A 404 Not Found means the resource doesn’t exist at that location, not simply that access is blocked. A 500 Server Error points to a problem on the server, not an access control issue. So for a resource you’re not allowed to access, 403 Forbidden is the appropriate response.
Question 2
What is an incident response plan and what are its typical steps?
Correct Answer:
A plan for detecting, containing, eradicating, and recovering from security incidents, including preparation, detection, containment, eradication, recovery, and lessons learned.
Explanation:
An incident response plan is a structured, repeatable process for handling security incidents so you can detect them quickly, contain their impact, remove the threat, and restore normal operations while learning from the event. It typically covers preparation (team roles, communication plans, and playbooks), detection and analysis (monitoring, alert triage, and incident classification), containment (short-term actions to limit spread), eradication (removing the threat and cleaning affected systems), recovery (restoring services and validating systems are clean), and lessons learned (post-incident review to improve defenses and responses). This sequence helps ensure incidents don’t escalate, evidence is preserved for forensics and legal needs, and defenses get strengthened over time. The other options describe activities outside the full scope of incident response: planning for feature development, birth of data backups and disaster recovery (which are broader business continuity concerns), or HR and budgeting tasks. While backups and DR are important and can support recovery, they do not by themselves constitute an incident response plan.
Question 3
What does cross-origin resource sharing (CORS) allow browsers to do?
Correct Answer:
Override the same-origin policy for specific resources
Explanation:
CORS lets the browser relax the same-origin policy for certain cross-origin requests when the server explicitly allows it. In practice, this means a server can opt in to let a web page from another origin access its resources by sending headers like Access-Control-Allow-Origin. The browser may also perform a preflight check using an OPTIONS request for some non-simple requests before granting access. This mechanism does not apply to all cross-origin requests automatically, only to those the server has permitted. It isn’t about encrypting traffic (that’s TLS/HTTPS) and it doesn’t inherently require authentication for access—the server’s response may or may not require credentials. So the best description is that it allows browsers to override the same-origin policy for specific resources.
Question 4
What does STRIDE stand for in threat modeling?
Correct Answer:
Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege
Explanation:
In threat modeling, STRIDE refers to six categories of security threats used to categorize and reason about risks systematically. The canonical expansion is Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege. This exact phrasing is why that option is the best match: it uses the standard terms, including Information Disclosure (not Data Disclosure) and Elevation of Privilege (not Privilege Elevation). The other choices differ only in wording or order, but they don’t align with the widely adopted STRIDE names. Knowing STRIDE helps you map attacker goals to concrete threats— impersonating users, altering data, denying accountability, leaking information, taking down services, or obtaining higher access.
Question 5
Given r = range(1, 10) and num = int(input()), which value prints 'The number input is in the range from 1 and 10'?
Correct Answer:
The number input is not in the range from 1 and 10.
Explanation:
The key idea is how Python defines range boundaries. range(1, 10) includes numbers starting at 1 up to, but not including, 10. So the valid values are 1 through 9. If your code prints the message about being in the range only when the input is actually in the range, then an input like 10 would not satisfy that condition and would trigger the message that the number is not in the range. That matches the option stating not in the range. In short, 10 is outside the range 1–9, so the not-in-range message is printed, which is why that option is correct.
Question 1
Exam overview

About this Exam

Welcome to your essential preparation guide for the WGU ITEC2034 D385 Software Security and Testing Practice Test. This course is a critical component of the Western Governors University Information Technology degree programs, specifically designed for students pursuing careers in cybersecurity, software development, and quality assurance. This exam validates a student's fundamental understanding of how to integrate security principles throughout the entire software development lifecycle (SDLC). It targets aspiring IT professionals who need to move beyond simple coding to understanding robust, defensive software construction and comprehensive testing methodologies.

More details

Additional Information

What the Course Entails and Exam Details

The ITEC2034 D385 course focuses heavily on the defensive aspect of software engineering. Students will dive deep into analyzing vulnerabilities and implementing countermeasures. Key competency areas and skills covered include:

  • Secure Software Concepts: Understanding the core principles of CIA (Confidentiality, Integrity, Availability) and authentication within applications.

  • The OWASP Top 10: A detailed study of the most critical web application security risks and how to mitigate them.

  • Static Application Security Testing (SAST): Learning how to analyze source code or binaries without executing the program to find security flaws.

  • Dynamic Application Security Testing (DAST): Mastering black-box testing techniques to find vulnerabilities in running applications.

  • Threat Modeling: Understanding how to identify, communicate, and understand threats and mitigations within the context of protecting something of value.

  • Vulnerability Management: The process of identifying, classifying, prioritizing, remediating, and mitigating software vulnerabilities.

The examination structure for ITEC2034 D385 is typically a single, objective assessment. This means students are evaluated based on their ability to choose the correct answer from multiple-choice questions or similar objective formats, rather than completing performance-based tasks like live coding.


What to Expect in the Final Exam

While the exact nature of the WGU objective assessment (OA) for D385 is subject to change, students can generally expect the following format for their proctored final exam:

  • Format: Multiple-choice questions, which may include scenario-based questions where you must apply security principles to a hypothetical coding or architectural situation.

  • Competency-Based Assessment: Unlike a traditional university that might grade on a curve, WGU measures mastery. You must demonstrate that you meet the required cut score to pass the unit.

  • Time Limit: Typically, objective assessments are timed, often ranging from 90 to 120 minutes.

  • Passing Score: The cut score (passing threshold) is determined by WGU and is not always publicly disclosed as a rigid percentage, as it is based on achieving competency across all domain areas.

  • Rules: This is a proctored exam. You will be required to have a webcam and microphone, and an external proctor will monitor your environment and your screen throughout the duration of the test.


How to Study and Exam Centers

Preparing for the ITEC2034 D385 OA requires a focused and active study approach. WGU provides significant resources that should be your first line of defense. Follow these actionable strategies:

  • Thoroughly Review Course Material: Start by methodically working through the provided WGU learning modules and textbooks.

  • Take the Pre-Assessment Seriously: The Pre-Assessment (PA) is designed to mimic the final Objective Assessment in content and style. Take this early to gauge your baseline, and then again after studying to measure readiness. Use the coaching report from the PA to identify weak areas.

  • Master the OWASP Top 10: This framework is foundational to the exam. Know the definitions, common examples of attack vectors, and specific coding remediations for each of the ten risks.

  • Understand SAST vs. DAST: You should clearly be able to differentiate when to use static versus dynamic testing and the pros/cons of each methodology.

  • Utilize Quizlet and Cohorts: Many WGU students benefit from shared Quizlet flashcards for vocabulary (e.g., threat modeling, CVE, cross-site scripting). Participate in scheduled cohorts or view recordings where Course Instructors review difficult concepts.

  • Simulate Test Conditions: When taking practice exams, do so in a quiet environment, timed, and without consulting notes, to prepare yourself for the final assessment's rigor.

Exam Center Information: Because WGU is an online university, you do not typically go to a physical "exam center" like Pearson VUE for objective assessments. Instead, the final exam is proctored online. You will use a WGU-approved third-party proctoring service (such as Examity) to take the exam from the comfort of your own home or a quiet, secure location.


Job Opportunities from the Course

Successfully mastering the concepts in ITEC2034 D385 directly prepares you for several critical, high-demand roles in information technology. Employers across all industries are desperately seeking professionals who can build secure software rather than patching it later. This course unlocks career paths such as:

  • Junior Security Analyst

  • Software Quality Assurance (SQA) Engineer

  • Application Security Associate

  • Cybersecurity Compliance Officer

  • Information Security Specialist

  • DevSecOps Engineer (Associate level)

Good luck with your studies and your upcoming assessment!


Quiz information

Frequently Asked Questions

The complete question count is available after full access is unlocked.
No fixed duration is currently configured for this quiz.
Question explanations are included where they are available in the quiz content, helping you review the reasoning after answering.
Yes. You can retake the practice test again as you continue studying during your available access period.
After your access is confirmed, you can continue into the complete practice exam from this quiz flow.
Unless explicitly stated otherwise, this page provides independent practice material for study and exam preparation and is not the official examination itself.
Keep studying

Related Questions

ISC2 Certified in Cybersecurity Practice Exam

0 min

2391-52 Inspection and Testing Practice Exam

0 min

Arizona Security Guard Knowledge Practice Exam

0 min

Arizona State University (ASU) BIO201 Human Anatomy and Physiology I Exam 3 Practice Study Guide

0 min

Arizona State University (ASU) BIO345 Evolution Exam 1 Practice

0 min

ABAA Whole-Building Airtightness Testing Level 1 Practice Exam

0 min