ISC2 CISSP Practice Question

The correct answer is including security testing as part of the definition of "done" for each user story. This approach ensures that security is considered and verified continuously throughout development, rather than being deferred until later. It embeds security into the regular workflow of each feature development, making security a shared responsibility of the development team.

Conducting a comprehensive security audit at the end of each major release delays security testing, which contradicts Agile principles of continuous integration and delivery. Finding security issues at this late stage is more expensive to fix.

Having a dedicated security sprint after every three development sprints creates a gap between development and security testing, allowing security issues to accumulate. This approach doesn't align with Agile principles of delivering potentially shippable increments in each sprint.

**Assigning all security testing to a specialized team that works separately **creates a siloed approach to security. This contradicts the Agile principle of cross-functional teams and can lead to delays and communication gaps.