CAS-002 · Question #109
Unit testing for security functionality and resiliency to attack, as well as developing secure code and exploit mitigation, occur in which of the following phases of the Secure Software Development…
The correct answer is B. Secure Software Implementation. Unit testing for security functionality, resilience to attacks, secure coding practices, and exploit mitigation are all hands-on coding activities that belong to the Secure Software Implementation phase of the SSDLC.
Question
Unit testing for security functionality and resiliency to attack, as well as developing secure code and exploit mitigation, occur in which of the following phases of the Secure Software Development Lifecycle?
Options
- ASecure Software Requirements
- BSecure Software Implementation
- CSecure Software Design
- DSoftware Acceptance
How the community answered
(61 responses)- A2% (1)
- B90% (55)
- C5% (3)
- D3% (2)
Why each option
Unit testing for security functionality, resilience to attacks, secure coding practices, and exploit mitigation are all hands-on coding activities that belong to the Secure Software Implementation phase of the SSDLC.
Secure Software Requirements focuses on eliciting and documenting security requirements before any code is written, not on coding or unit testing activities.
The Secure Software Implementation phase is where developers write and unit test code, applying secure coding standards, testing security controls, verifying resilience to known attacks, and implementing exploit mitigations such as input validation and bounds checking - all of which match the activities described in the question.
Secure Software Design involves architectural decisions, threat modeling, and selecting security controls at a design level, not hands-on implementation and unit testing.
Software Acceptance is a late-stage validation phase where the completed system is verified against requirements prior to release, not a phase for unit-level security testing or exploit mitigation development.
Concept tested: SSDLC implementation phase security activities
Source: https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/final
Topics
Community Discussion
No community discussion yet for this question.