Lifecycle Overview CT-SEC Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which security activity is typically performed during the requirements phase of the software lifecycle?

   • APerforming code reviews on the implemented source code
   • BConfiguring firewalls and intrusion detection systems
   • CIdentifying security requirements and potential threats
   • DExecuting penetration tests against the production system
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A development team is starting a new web application project. The security specialist wants to ensure that security is considered from the very beginning. Which activity should be performed during the requirements phase?

   • ARun static analysis on the source code to find vulnerabilities
   • BConduct a threat modeling session to identify potential threats and define security requirements
   • CPerform a penetration test on the final build to validate security controls
   • DConfigure the production environment with security hardening baselines
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security manager is explaining to stakeholders why security testing should not be a standalone phase at the end of development. Which statement best supports this view?

   • AStandalone security testing at the end is sufficient if the testers are highly skilled
   • BSecurity testing at the end of development is cheaper because it requires fewer resources
   • CSecurity testing is most effective when it is integrated into every phase, allowing early detection and continuous feedback
   • DSecurity testing should be performed only by a dedicated security team to ensure independence
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A team is about to deploy a new version of a critical application. Which security activity is most appropriate during the deployment phase?

   • AVerify that the production environment is configured according to the security baseline
   • BWrite security test cases for the new features
   • CConduct a design review of the application architecture
   • DPerform a requirements elicitation workshop with stakeholders
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which security activity is most closely associated with the development phase of the lifecycle?

   • ADefining security acceptance criteria for user stories
   • BConducting threat modeling workshops
   • CRunning vulnerability scans on the production environment
   • DPerforming static analysis and secure code reviews
   Reveal Solution Discussion Select an answer first