ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

Acceptance security testing is a formal activity performed at the end of the development cycle by stakeholders who will own or operate the system-typically business owners, customers, or their designated representatives. Their goal is to verify that the delivered software (including its security controls) satisfies the predefined acceptance criteria and business requirements before it is approved for production use. In contrast, black-box testing emphasizes attacker-like techniques without internal knowledge, stress and fault-injection testing probe system robustness under extreme conditions, and cryptographic validation focuses narrowly on compliance of encryption modules. These other activities can occur earlier or in parallel, but they do not represent the defining purpose of acceptance testing, which centers on stakeholder approval against business and security requirements.