nerdexam
CompTIA

CAS-002 · Question #109

Unit testing for security functionality and resiliency to attack, as well as developing secure code and exploit mitigation, occur in which of the following phases of the Secure Software Development…

The correct answer is B. Secure Software Implementation. Unit testing for security functionality, resilience to attacks, secure coding practices, and exploit mitigation are all hands-on coding activities that belong to the Secure Software Implementation phase of the SSDLC.

Enterprise Security

Question

Unit testing for security functionality and resiliency to attack, as well as developing secure code and exploit mitigation, occur in which of the following phases of the Secure Software Development Lifecycle?

Options

  • ASecure Software Requirements
  • BSecure Software Implementation
  • CSecure Software Design
  • DSoftware Acceptance

How the community answered

(61 responses)
  • A
    2% (1)
  • B
    90% (55)
  • C
    5% (3)
  • D
    3% (2)

Why each option

Unit testing for security functionality, resilience to attacks, secure coding practices, and exploit mitigation are all hands-on coding activities that belong to the Secure Software Implementation phase of the SSDLC.

ASecure Software Requirements

Secure Software Requirements focuses on eliciting and documenting security requirements before any code is written, not on coding or unit testing activities.

BSecure Software ImplementationCorrect

The Secure Software Implementation phase is where developers write and unit test code, applying secure coding standards, testing security controls, verifying resilience to known attacks, and implementing exploit mitigations such as input validation and bounds checking - all of which match the activities described in the question.

CSecure Software Design

Secure Software Design involves architectural decisions, threat modeling, and selecting security controls at a design level, not hands-on implementation and unit testing.

DSoftware Acceptance

Software Acceptance is a late-stage validation phase where the completed system is verified against requirements prior to release, not a phase for unit-level security testing or exploit mitigation development.

Concept tested: SSDLC implementation phase security activities

Source: https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/final

Topics

#SSDLC#secure software implementation#unit testing#exploit mitigation

Community Discussion

No community discussion yet for this question.

Full CAS-002 Practice