Describe the Secure Software Development Life Cycle (SDLC) Process CCSP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A development team is using a CI/CD pipeline to build and deploy a microservices-based application. The security team wants to ensure that vulnerabilities are caught early and that security is not an afterthought. Which action is most effective?

   • AIntegrate static application security testing (SAST) and dependency scanning into the CI/CD pipeline.
   • BRun a penetration test manually after each deployment.
   • CReview code only when a security incident occurs.
   • DDisable security scanning to speed up the pipeline.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A government agency is developing a system with strict regulatory requirements and a fixed, non-negotiable delivery date. The project manager wants to ensure that security is thoroughly documented and reviewed at each phase. Which SDLC methodology is most appropriate for this environment?

   • AWaterfall, because it provides structured phases with formal reviews and documentation.
   • BDevOps, because it automates security testing in the CI/CD pipeline.
   • CSpiral, because it emphasizes risk analysis in each iteration.
   • DAgile, because it allows for rapid iteration and continuous security testing.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A software company is developing a new product and wants to release it to market quickly. The product will handle payment card data and must comply with PCI DSS. The team is considering using a DevOps approach with continuous deployment. Which practice best ensures that PCI DSS requirements are met while maintaining the speed of continuous deployment?

   • ARemove all manual checks to speed up the deployment process.
   • BAutomate security and compliance checks in the CI/CD pipeline and require manual approval for production deployments.
   • CUse a separate, non-compliant pipeline for rapid releases and a compliant pipeline for production.
   • DPerform all security checks after the deployment to avoid delaying the release.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which security practice is most directly associated with the deployment phase of a secure SDLC?

   • AWriting secure code
   • BConducting threat modeling
   • CPerforming unit testing
   • DSecure configuration of the production environment
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security team is reviewing the SDLC of a new application. They want to ensure that security is considered at every phase, not just at the end. Which approach best achieves this?

   • APerform a single security review after the application is fully developed.
   • BOnly focus on security during the testing phase.
   • CDefine security activities for each phase, such as threat modeling in design, secure coding in development, and security testing in the testing phase.
   • DRely on the security team to fix all vulnerabilities after deployment.
   Reveal Solution Discussion Select an answer first