Describe the Secure Software Development Life Cycle (SDLC) Process CCSP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which security activity is most appropriate during the maintenance phase of the SDLC?

   • APerforming static code analysis
   • BConducting a security requirements review
   • CCreating a data flow diagram
   • DApplying security patches and monitoring for vulnerabilities
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A financial services firm is adopting an agile methodology for a new customer-facing application. The team wants to integrate security without slowing down two-week sprints. Which approach best aligns with agile principles while maintaining effective security?

   • APerform a full threat model and security test only at the end of each release cycle.
   • BUse a waterfall model for security activities while the rest of the team works in agile.
   • CCreate a separate security team that reviews code only after all features are complete.
   • DEmbed a security champion in each scrum team and conduct security reviews as part of each sprint's definition of done.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   How does the agile SDLC methodology typically impact the integration of security practices?

   • ASecurity is integrated into each iteration or sprint
   • BSecurity is not addressed until after deployment
   • CSecurity is addressed only in a dedicated final phase
   • DSecurity is handled by a separate team outside the development process
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company is deploying a new web application to a cloud environment. The security team wants to ensure that the deployment is secure and that the application is configured correctly. Which activity is most important to perform during the deployment phase?

   • AConduct a penetration test on the production environment.
   • BWrite user documentation for the application.
   • CVerify that security configurations, such as firewall rules and identity management, are correctly applied.
   • DReview the source code for security vulnerabilities.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A retail company is planning a new e-commerce platform. The business wants to ensure that the platform can handle a surge in traffic during holiday sales and that customer payment data is protected. Which set of requirements best captures these needs?

   • AOnly non-functional requirements, since they cover all aspects of the system.
   • BFunctional requirements for payment processing and non-functional requirements for scalability and encryption.
   • CFunctional requirements for scalability and encryption and non-functional requirements for payment processing.
   • DNon-functional requirements for payment processing and functional requirements for scalability and encryption.
   Reveal Solution Discussion Select an answer first