ISC2 CISSP Practice Question

Security is addressed continuously throughout every phase of the SDL. The methodology embeds mandatory security activities-training, requirements definition, threat modeling, secure coding, verification, and response-across requirements, design, implementation, verification, release, and production phases. By integrating security end-to-end, SDL reduces vulnerabilities and avoids costly late fixes.

The other statements conflict with SDL guidance:

• Security review gates only at final release contradict SDL's phased security checkpoints.
• Threat modeling must be performed and updated for all products; skipping it for so-called low-risk systems violates SDL practice.
• Using approved libraries does not remove the need for static, dynamic, and composition analysis; code scanning remains mandatory.