A company has decided to move to an agile software development methodology. The company gives all of its developers security training. After a year of agile, a management review finds that the…

Question

Options

• APenetration tests should be performed after each sprint.
• BA security engineer should be paired with a developer during each cycle.
• CThe security requirements should be introduced during the implementation phase.
• DThe security requirements definition phase should be added to each sprint.

• A
  13% (4)
• B
  3% (1)
• C
  6% (2)
• D
  78% (25)

Explanation

In agile, there is no long upfront planning phase, so security cannot be treated as a one-time gate at the beginning or end of a project. If security requirements are not explicitly included in each sprint's definition and planning, they get consistently deprioritized in favor of functional features. Over many sprints, this accumulates into a significant vulnerability backlog. The correct fix (D) is to add a security requirements definition phase to every sprint so security is continuously addressed. Option A (pen tests after each sprint) is impractical and prohibitively expensive. Option B (pairing a security engineer with each developer) is good practice but expensive and not the most likely oversight. Option C is backwards - security requirements belong in the planning phase, not the implementation phase.

No community discussion yet for this question.