CAS-004 Security Architecture Practice Question
A security team is implementing a secure SDLC for a new application. Which THREE activities should be included as part of the development phase? (Choose three.)
⚠ Common exam trap
CAS-005 often tests the misconception that runtime protections like RASP or production pen testing are 'development' activities, when they actually belong to the operations/deployment phase.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Static application security testing (SAST)
Static application security testing (SAST) (C) belongs in the development phase because it analyzes source code or bytecode without executing the application, letting developers find injection flaws, insecure coding patterns, and other defects while code is still being written. Threat modeling (D) is a development-phase design activity that systematically identifies assets, trust boundaries, data flows, and threats (e.g., via STRIDE) so that controls are built into the architecture before coding is complete. Dependency analysis for open-source libraries (E) is also a development-phase activity, typically implemented as software composition analysis (SCA) that inspects manifests such as package.json, pom.xml, or requirements.txt to detect vulnerable or outdated third-party components and their transitive dependencies. By contrast, RASP (A) is a runtime protection mechanism that instruments the executing application in production or test, so it is a deployment/operations control rather than a development activity, and penetration testing on production (B) is an assurance activity performed after deployment against a running system, not during development.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Runtime application self-protection (RASP) deployment
Why it's wrong here
RASP instruments a running application to detect and block attacks at execution time, so it belongs to the operations and maintenance phase, not development. RASP would be the correct choice when hardening a deployed application against live runtime exploitation.
- ✗
Penetration testing on production environment
Why it's wrong here
Penetration testing targets a deployed, running system, placing it in testing or operations rather than the development phase. It would be the correct activity when validating a completed build in a staging or production environment before release.
- ✓
Static application security testing (SAST)
Why this is correct
SAST scans source code statically during development, identifying injection flaws, insecure patterns and coding errors before compilation or deployment. Running it in the development phase satisfies the shift-left constraint, giving developers immediate feedback while remediation remains cheapest.
- ✓
Threat modeling
Why this is correct
Threat modelling examines the application's design and data flows to enumerate potential threats and mitigations before code is written. Performing it during development satisfies the early-integration constraint, steering architecture away from exploitable weaknesses rather than detecting them later.
- ✓
Dependency analysis for open-source libraries
Why this is correct
Dependency analysis inventories third-party and open-source libraries, flagging components with known CVEs or licence issues. Conducting it during development satisfies the shift-left constraint, letting teams patch or replace vulnerable transitive dependencies before they reach production builds.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 973-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.