nerdexam
CompTIA

CAS-002 · Question #808

An organization has implemented an Agile development process for front end web application development. A new security architect has just joined the company and wants to integrate security…

The correct answer is A. Static and dynamic analysis is run as part of integration D. For each major iteration penetration testing is performed. This question tests which security activities directly enforce measurable code quality within an Agile development process.

Integration of Computing, Communications and Business Disciplines

Question

An organization has implemented an Agile development process for front end web application development. A new security architect has just joined the company and wants to integrate security activities into the SDLC. Which of the following activities MUST be mandated to ensure code quality from a security perspective? (Select TWO).

Options

  • AStatic and dynamic analysis is run as part of integration
  • BSecurity standards and training is performed as part of the project
  • CDaily stand-up meetings are held to ensure security requirements are understood
  • DFor each major iteration penetration testing is performed
  • ESecurity requirements are story boarded and make it into the build
  • FA security design is performed at the end of the requirements phase

How the community answered

(40 responses)
  • A
    85% (34)
  • B
    5% (2)
  • E
    3% (1)
  • F
    8% (3)

Why each option

This question tests which security activities directly enforce measurable code quality within an Agile development process.

AStatic and dynamic analysis is run as part of integrationCorrect

Static analysis (SAST) and dynamic analysis (DAST) run during integration directly examine source code and running application behavior for security defects, providing automated and repeatable evidence of code quality against known vulnerability patterns.

BSecurity standards and training is performed as part of the project

Security training improves developer knowledge but does not produce a verifiable artifact or automated check that code quality requirements have been met.

CDaily stand-up meetings are held to ensure security requirements are understood

Daily stand-ups are a project management ceremony that communicate intent but do not validate whether the code being produced actually meets security requirements.

DFor each major iteration penetration testing is performedCorrect

Penetration testing aligned to each major Agile iteration validates that implemented security controls hold up against real attack techniques at each release increment, ensuring security quality is verified continuously rather than only at project end.

ESecurity requirements are story boarded and make it into the build

Story boarding security requirements ensures they are captured in the backlog but does not verify that the resulting code actually satisfies those requirements.

FA security design is performed at the end of the requirements phase

A formal security design phase at the end of requirements does not fit Agile methodology, which has no discrete requirements phase, and addresses architecture rather than code-level quality verification.

Concept tested: Security activity integration in Agile SDLC for code quality

Source: https://owasp.org/www-project-samm/

Topics

#Agile security#SDLC integration#static analysis#penetration testing

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice