In a secure software development lifecycle process, what must be created as soon as the architecture is in place?

Question

Options

• Aintegration plan
• Btest plan
• Cfunctional specification document
• Dthreat modeling

• A
  2% (1)
• B
  6% (3)
• C
  91% (48)
• D
  2% (1)

Explanation

In a secure SDLC, the functional specification document (C) is created immediately after architecture is established because the architecture defines the system's structure, components, and interfaces - the foundation needed to precisely document what each part of the system must do. Without an architecture, functional specifications remain too abstract to be actionable or testable.

Why the distractors are wrong:

• A (integration plan): This comes later, once individual components are being built and need to be joined - it depends on knowing what will actually be implemented.
• B (test plan): Testing strategy is derived from the functional specification itself, so it logically follows, not precedes, the functional spec.
• D (threat modeling): While threat modeling is critical in secure SDLC and is closely associated with architecture, it is part of the architectural design phase itself - not something produced after architecture is complete.

Memory tip: Think of the sequence as "Architect → Specify → Test → Integrate." The functional specification bridges the gap between high-level design and everything else downstream - you can't write tests, integration plans, or code without first specifying what needs to be built. The phrase "spec before test" can anchor this in memory.

No community discussion yet for this question.