Which of the following security controls will you use for the deployment phase of the SDLC to build secure software? Each correct answer represents a complete solution. Choose all that apply.

Change and Configuration Control is primarily an ongoing process throughout the entire SDLC, managing changes to code and infrastructure, rather than a specific control applied solely during the deployment phase for building secure software.

Security Certification and Accreditation (C&A) is crucial during deployment as it formally assesses and authorizes the system to operate, considering its security posture prior to going live. This process ensures the system meets defined security requirements and the risks are acceptable.

Vulnerability Assessment and Penetration Testing (VAPT) are essential right before or during deployment to identify and remediate any last-minute security flaws or misconfigurations. This helps ensure the deployed system is robust against known attack vectors.

Risk Adjustments involve reviewing and updating risk assessments based on the actual implementation and testing results during deployment. This ensures that the residual risks are understood and managed, and any necessary mitigating actions are taken before full operational status.