hardMultiple SelectObjective-mapped
CAS-004 SSDLC essential practices Practice Question
A security architect is designing a secure software development lifecycle (SSDLC). Which of the following practices are essential for integrating security into the development process? (Select TWO.)
⚠ Common exam trap
The CAS-004 exam often tests the distinction between security controls applied during development (SAST, dependency scanning) versus runtime controls (RASP, WAF) or post-deployment activities (penetration testing), leading candidates to select options that are valid security measures but not essential to the SSDLC itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conducting static application security testing (SAST) during coding
Static application security testing (SAST) analyzes source code, bytecode, or binaries without executing the program, allowing developers to identify vulnerabilities such as buffer overflows, SQL injection, and cross-site scripting during the coding phase. Integrating SAST early in the SSDLC reduces the cost and effort of fixing security flaws by catching them before they reach later stages like testing or production.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Performing penetration testing only after production deployment
Why it's wrong here
Pen testing is important but occurs later; it's not integrated into the development process early.
- ✗
Implementing runtime application self-protection (RASP) in development
Why it's wrong here
RASP is a runtime control, not typically integrated into the development phase.
- ✗
Deploying a web application firewall (WAF) in staging
Why it's wrong here
WAF is a network security control, not a development practice.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CAS-005 exam frequently reuses these exact scenarios with slightly different constraints.
✓Conducting static application security testing (SAST) during codingCorrect answer▾
✗Performing penetration testing only after production deploymentWrong answer — click to see why▾
Why this is wrong here
Pen testing is important but occurs later; it's not integrated into the development process early.
✗Implementing runtime application self-protection (RASP) in developmentWrong answer — click to see why▾
Why this is wrong here
RASP is a runtime control, not typically integrated into the development phase.
✗Deploying a web application firewall (WAF) in stagingWrong answer — click to see why▾
Why this is wrong here
WAF is a network security control, not a development practice.
Analysis generated from the official CAS-005blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.