nerdexam
(ISC)2

CSSLP · Question #374

What is the primary purpose of performing security reviews during the software development lifecycle?

The correct answer is C. Validation of the software development process and assurance that security controls are followed. Security reviews during the software development lifecycle primarily aim to validate the development process and assure that established security controls are being followed.

Secure Software Lifecycle Management

Question

What is the primary purpose of performing security reviews during the software development lifecycle?

Options

  • ACloud Security Command Center
  • BFuzz testing
  • CValidation of the software development process and assurance that security controls are followed

How the community answered

(40 responses)
  • A
    8% (3)
  • B
    3% (1)
  • C
    90% (36)

Why each option

Security reviews during the software development lifecycle primarily aim to validate the development process and assure that established security controls are being followed.

ACloud Security Command Center

Cloud Security Command Center is a specific Google Cloud product for security management, not the primary purpose of general SDLC security reviews.

BFuzz testing

Fuzz testing is a specific type of dynamic application security testing technique used to find vulnerabilities, not the primary purpose of overall security reviews.

CValidation of the software development process and assurance that security controls are followedCorrect

Option C accurately describes the overarching goal of security reviews, which is to systematically check if security policies, standards, and best practices are integrated and followed throughout the software development lifecycle. These reviews ensure that security is embedded by design, catching vulnerabilities and misconfigurations early before deployment.

Concept tested: Purpose of SDLC security reviews

Source: https://learn.microsoft.com/en-us/azure/security/develop/security-devops-security-reviews

Topics

#Security Reviews#SDLC#Security Controls#Process Validation

Community Discussion

No community discussion yet for this question.

Full CSSLP Practice