A development team is writing code for a new web application. The organization has a secure coding standard that includes input validation, output encoding, and proper error handling. Which practice best ensures that the team consistently follows these standards during the development phase?

Wait until the testing phase to run a single comprehensive security scan.

Rely on the security team to manually review all code after release.

Provide developers with training on secure coding and integrate static analysis tools into the CI/CD pipeline.

Perform a security code review after every major feature is merged.

A company is in the maintenance phase of a legacy application. The application has been in production for several years and is being updated with new features. Which security activity is most important during the maintenance phase?

Regularly apply security patches and monitor for vulnerabilities in the application and its dependencies.

Remove all security controls to improve performance.

Perform a one-time threat model at the beginning of the maintenance phase.

Stop all updates to the application to avoid introducing new vulnerabilities.

A large enterprise is developing a new customer portal. The project has a fixed deadline and strict regulatory requirements for audit trails and change management. The development team is experienced with agile, but the compliance team insists on formal phase-gate reviews. Which approach best balances the need for agility with regulatory compliance?

Use a DevOps model with automated compliance checks but no formal reviews.

Use a pure agile model and ignore the compliance team's request for formal reviews.

Use a hybrid model: agile for development sprints, with formal security and compliance reviews at the end of each sprint.

Use a pure waterfall model to satisfy the compliance team's requirement for formal reviews.

Which characteristic is most typical of the waterfall SDLC methodology?

Security testing integrated into every sprint

Continuous delivery of small increments

Linear progression through phases with limited backtracking

Iterative development with frequent feedback loops

Certified Cloud Security Professional

Domain 4Objective 2

Describe the Secure Software Development Life Cycle (SDLC) Process CCSP Practice Questions (Page 5)

Part of the Cloud Application Security domain, which accounts for 16% of the CCSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 2–3 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

4concepts

16%of the exam

Questions 21–25

21application · medium
A development team is writing code for a new web application. The organization has a secure coding standard that includes input validation, output encoding, and proper error handling. Which practice best ensures that the team consistently follows these standards during the development phase?
Select an answer first
22foundation · easy
During the requirements phase of an SDLC, a business stakeholder specifies that the new customer portal must be accessible to users with visual impairments. Which type of requirement is this?
Select an answer first
23application · medium
A company is in the maintenance phase of a legacy application. The application has been in production for several years and is being updated with new features. Which security activity is most important during the maintenance phase?
Select an answer first
24expert · hard
A large enterprise is developing a new customer portal. The project has a fixed deadline and strict regulatory requirements for audit trails and change management. The development team is experienced with agile, but the compliance team insists on formal phase-gate reviews. Which approach best balances the need for agility with regulatory compliance?
Select an answer first
25foundation · easy
Which characteristic is most typical of the waterfall SDLC methodology?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CCSP” is a trademark of its owner, used for identification only.

Describe the Secure Software Development Life Cycle (SDLC) Process CCSP Practice Questions (Page 5)

Questions 21–25

A development team is writing code for a new web application. The organization has a secure coding standard that includes input validation, output encoding, and proper error handling. Which practice best ensures that the team consistently follows these standards during the development phase?

During the requirements phase of an SDLC, a business stakeholder specifies that the new customer portal must be accessible to users with visual impairments. Which type of requirement is this?

A company is in the maintenance phase of a legacy application. The application has been in production for several years and is being updated with new features. Which security activity is most important during the maintenance phase?

Which characteristic is most typical of the waterfall SDLC methodology?

Keep studying — Cloud Application Security