D332 Penetration Testing and Vulnerability Analysis carries banner number ITAS 3080 and is worth 4 competency units. It covers the testing lifecycle: planning and scoping, information gathering, vulnerability identification, and attacks and exploits, plus the vulnerability management that follows. D332 and ITAS 3080 are one requirement, and the course is the bachelor's counterpart to the graduate D484. The discipline it teaches is authorisation before technique.
Scoping is the part professionals take most seriously
Students expect this course to be about exploitation and are often surprised that planning and scoping carries so much weight. There is a reason. A penetration test without written authorisation, defined boundaries and agreed rules of engagement is not a test, and every professional framework in the field puts that first. Which systems are in scope, which are explicitly excluded, what times testing may occur, what happens if something breaks, who to contact and how findings are handled are not paperwork; they are what separates a test from an incident.
Information gathering follows and it is where most of the useful work happens. Passive collection from public sources, then active discovery of hosts, services and versions, builds the picture that everything later depends on. Students frequently rush this and then attack the wrong thing, because a service they assumed was present was not, or the version they assumed was running had been patched.
Vulnerability identification is where automation helps most and misleads most. A scanner produces findings; an analyst produces validated findings. Confirming that a reported weakness actually exists in this environment, and that the conditions it requires are present, is the step that separates a report someone can act on from a list that wastes an operations team's week.
Exploitation, when your task includes it and your environment authorises it, exists to prove impact rather than to demonstrate skill. The useful question is what an attacker would gain, not how many techniques you can name. A single proven path to sensitive data is worth more in a report than a dozen theoretical weaknesses.
Your result reads Competent or Not Competent, without letter grades, and WGU keeps no ordinary grade point average, while the 4 competency units simply size the course inside a flat-priced six month term. Everything in this course is done inside the authorised environment your course materials provide, never against systems you do not have written permission to test.
Turning aspects into a test plan and report
If your version of D332 uses a performance assessment, the aspects usually track the testing lifecycle plus the reporting around it. WGU requires a score of 2 in each aspect for a task to pass and judges each aspect alone, so impressive technical findings will not carry an unaddressed scoping or remediation aspect.
Budget before drafting. Take a rubric with seven scored aspects and a target near 2,100 words alongside your evidence. Reserve 150 words for the engagement summary and authorisation basis, and 110 for the close, leaving 1,840 across seven aspects, or roughly 262 each. Weight by demand: three aspects covering findings, impact and remediation need 350 each, which is 1,050; the four remaining aspects, covering scoping, methodology, discovery and reporting practice, take 197 each, which is 788. Together that is 1,838.
Write findings in a fixed structure and repeat it exactly: what was found, where, how it was verified, what an attacker gains, how likely exploitation is in this environment, and what fixes it. A consistent finding template makes a report scannable, which is how real reports are read, and it guarantees that the remediation element never gets dropped when you are tired at the end.
Reserve budget for prioritisation. A report that ranks findings by real impact in this environment, rather than by a generic severity score, is doing the analytical work the aspects reward, and it is the part students most often leave to the scanner.
Shape for a penetration test report
D332 deliverables generally produce a test report. These proportions fit that document.
| Section | Content | Share |
|---|---|---|
| Engagement and authorisation | Scope, exclusions, rules of engagement, testing window and the authorisation the work rests on. | 13 percent |
| Methodology | The approach followed and the tooling used, at a level another tester could repeat. | 12 percent |
| Discovery | Hosts, services and versions identified, with how each was determined. | 15 percent |
| Findings | Each validated weakness in the fixed template, with evidence attached. | 25 percent |
| Impact and prioritisation | What an attacker gains from each finding, ranked by consequence in this environment. | 16 percent |
| Remediation | Specific fixes with effort and any operational side effect of applying them. | 13 percent |
| Close | Residual risk, what was out of scope, and what a follow-up test should cover. | 6 percent |
Evidence and the honesty line in testing work
Testing evidence is generated, and its credibility depends on being verifiable. Show the command or the tool interaction, the output, and the timestamp. Crop to what matters and label what each capture proves. A finding claimed with no evidence is not a finding, and evaluators in this subject are alert to conclusions that outrun their support.
For cited material, weakness descriptions belong to the recognised public catalogues, methodology belongs to published testing standards and guides, and product behaviour belongs to vendor documentation. Where you rate severity, say which scoring system produced the rating and note that a generic score is a starting point rather than a conclusion, because the same weakness has different impact in different environments.
Two honesty rules matter more here than anywhere else in the degree. First, never report a finding you did not verify; unverified scanner output belongs in an appendix labelled as such, not in the findings section. Second, never test outside the authorised environment your course provides. Everything we do in this course is preparation, review and instruction on your own authorised lab work; we do not run tests for you, and neither of us touches systems that are not explicitly in scope.
Write findings for two audiences at once, because real reports have both. A technical reader needs the detail to reproduce and fix the issue. A manager needs one sentence saying what it means for the business. Putting that one sentence at the top of each finding, before the technical body, costs nothing and is the single most requested improvement in professional testing reports. It also gives the impact aspect somewhere obvious to be scored.
Keep to the citation style the task requires and cite at the point of claim. Where a finding depends on a configuration detail, show the configuration rather than describing it.
What earns Competent in a testing course
Competent reports are actionable. Authorisation and scope are stated up front, findings are verified and evidenced, impact is expressed in terms of what an attacker gains, remediation is specific enough to assign, and prioritisation reflects this environment rather than a default score.
Returns concentrate in four shapes. The report opens with findings and never establishes scope or authorisation. Scanner output is reproduced as findings without validation. Impact is described as high with no explanation of what an attacker would actually reach. Or remediation says to patch or harden without naming the system, the setting or the version.
A quick self-test: hand your findings section to someone who does not know the environment and ask them what they would fix first and why. If they cannot answer from your document alone, the prioritisation and remediation aspects are not yet doing their job.
Performance assessment work can be revised and resubmitted with no grade penalty, so completeness beats polish when you are deciding whether to submit, rather than holding it back for another pass. If your section also carries an objective assessment, WGU objective assessments are proctored and our boundary is absolute: preparation only, with methodology drills, tool reading practice and a candid read on your preassessment result. We will not take your exam, do not assist while it is running, and portal credentials are never requested or handled.
Findings gathered, report not landing?
Send the D332 rubric and your lab evidence. We build the finding template, rank by real impact, and plan every aspect with word targets.
Eight mistakes that cost time in D332
- Treating scoping as paperwork. It carries real rubric weight and it is what makes the work legitimate.
- Reporting unvalidated scanner output. A tool produces candidates. An analyst produces findings.
- Rushing discovery. Attacking an assumed service wastes hours. Establish what is actually there first.
- Generic severity as final answer. A standard score is an input. Impact in this environment is the output.
- Vague remediation. "Harden the server" cannot be assigned to anyone. Name the setting and the version.
- Findings without evidence. Every claim needs a capture, cropped and labelled with what it proves.
- Inconsistent finding structure. One template, repeated, is what makes a report readable at speed.
- Testing outside the authorised lab. Never. Scope and written authorisation define what may be touched, without exception.
Three questions students ask about D332
How does D332 differ from the graduate D484?
What environment do I test against?
Do I need to know how to write exploits?
Where D332 sits in WGU's programs
The July 2026 catalog places this code in 1 current WGU program. Open a program page for the complete standard path and term positions. The live Degree Plan remains authoritative after transfer credit, substitutions, and mentor planning.
The assessments, one by one
The public catalog does not publish this course's PA/OA identity or task count. WGU Tutors publishes at most one PA manual per course and only from a WGU-controlled public rubric. Until that source exists, PA help begins from the student's real Course of Study and OA support remains preparation only.