A security engineer at a software development company has identified several vulnerabilities in a product late in the development cycle. This causes a huge delay for the release of the product…

Question

Options

• ARecommend switching to an SDLC methodology and perform security testing during
• BRecommend switching to a spiral software development model and perform security testing
• CRecommend switching to a waterfall development methodology and perform security testing
• DRecommend switching to an agile development methodology and perform security testing during

• A
  5% (2)
• B
  13% (5)
• C
  3% (1)
• D
  80% (32)

Explanation

Finding vulnerabilities late in the development cycle is a classic symptom of treating security as a gate at the end of the process rather than integrating it throughout. Switching to an agile development methodology (D) with security testing embedded in each sprint/iteration - a practice known as DevSecOps or Agile Secure SDLC - means vulnerabilities are discovered and remediated continuously and incrementally, preventing the costly pile-up discovered late. Waterfall (C) is a sequential model where security testing at the end is common, reproducing the same problem. Spiral (B) is iterative but not as fast-paced or security-centric. The key differentiator in the correct answer is that agile sprints create natural, frequent checkpoints for security review throughout development.

No community discussion yet for this question.