312-50V9 · Question #49
In the software security development life cycle process, threat modeling occurs in which phase?
The correct answer is A. Design. In the Secure Development Lifecycle (SDL), threat modeling is performed during the Design phase, where the architecture is defined and attack surfaces can be identified before code is written.
Question
In the software security development life cycle process, threat modeling occurs in which phase?
Options
- ADesign
- BRequirements
- CVerification
- DImplementation
How the community answered
(31 responses)- A87% (27)
- B6% (2)
- C3% (1)
- D3% (1)
Why each option
In the Secure Development Lifecycle (SDL), threat modeling is performed during the Design phase, where the architecture is defined and attack surfaces can be identified before code is written.
Threat modeling belongs in the Design phase because it involves analyzing the system architecture, data flows, and trust boundaries to identify potential threats before implementation begins. Performing it at design time is most cost-effective, allowing architects to build mitigations into the design rather than retrofitting them later.
The Requirements phase focuses on gathering functional and security requirements, not on modeling threats against a specific architecture that does not yet exist.
The Verification phase involves testing and validating the implemented system against requirements - threat modeling precedes this phase.
The Implementation phase is where code is written; by this point the design decisions that threat modeling informs have already been made.
Concept tested: Threat modeling placement in the Secure Development Lifecycle
Source: https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool
Topics
Community Discussion
No community discussion yet for this question.