The true statements are which of the following? (Choose two.)

WebGoat has 30 or so "lessons" that illustrate how security vulnerabilities work on a system. OWASP maintained it which can be installed on almost any platform, works well with Java and.NET, and provides the ideal “black box” testing environment for both beginners and experienced pen testers to train on without fear of breaking something.