A security engineer is working with a software development team. The engineer is tasked with ensuring all security requirements are adhered to by the developers. Which of the following BEST…

Question

Options

• AA series of ad-hoc tests that each verify security control functionality of the entire system at once.
• BA series of discrete tasks that, when viewed in total, can be used to verify and document each
• CA set of formal methods that apply to one or more of the programing languages used on the
• DA methodology to verify each security control in each unit of developed code prior to committing

• A
  2% (1)
• B
  7% (3)
• C
  15% (6)
• D
  76% (31)

Explanation

The security engineer is creating a document that guides developers in verifying security controls at the unit level-before code is committed. This is a unit-level security verification methodology: a structured procedure that maps each security requirement to a specific verification step in each discrete unit of code. This granular approach ensures that every security control is validated at the smallest level of testable code, catching vulnerabilities early when they are cheapest to fix and before they propagate to integrated builds. Option A describes system-wide ad-hoc testing, which is the opposite of granular unit-level verification. Option B (discrete tasks for documenting each control) is close but describes documentation rather than a verification methodology. Option C (formal methods for programming languages) is a specific software correctness technique, not a general security verification methodology.

No community discussion yet for this question.