CCNA Secure Software Lifecycle Management Questions

A Software Security Policy establishes organisation-wide security expectations, making it the correct governance instrument. Unlike standards or procedures, which specify mandatory controls or step-by-step instructions, the SSP operates at a strategic level and applies across every development project, directly satisfying the stem's requirement for high-level expectations spanning all software work.

Security review of design documentation belongs in the design phase, where architecture, data flows and trust boundaries are still malleable. Catching flaws here avoids costly rework later, satisfying the stem's requirement for the most appropriate SDLC phase to formally assess the system's design.

Aligning security risk management with enterprise risk management ties technical risk exposure to the organisation's overall risk appetite and reporting structures. This satisfies the stem's governance requirement by ensuring security decisions are prioritised using the same business-impact criteria that drive strategic objectives.

Automated security unit tests run inside the CI pipeline on every commit, so flaws are caught without a separate review gate. This preserves the short iteration cadence Agile demands, satisfying the stem's security velocity constraint rather than slowing delivery through manual checkpoints.

A security-focused Lessons Learned meeting identifies root causes and control gaps from the incident, then feeds concrete improvements back into the SDLC — requirements, design reviews, coding standards and testing — so similar vulnerabilities are prevented in future releases rather than merely documented.

Security acceptance criteria inside the Definition of Done make each increment incomplete until controls are met, embedding verification into every sprint rather than a separate phase, which satisfies the Scrum constraint of continuous, team-owned compliance.

GitHub's secret scanning detects committed credentials, and push protection blocks them before they reach the remote repository. This pre-commit interception satisfies the stem's DevSecOps requirement to prevent secrets from being committed, rather than detecting them only after exposure.

Embedding security requirements as user stories with acceptance criteria ensures that security is considered from the start of each sprint and validated continuously. This aligns with Agile principles and shift-left security, allowing teams to address security alongside functional requirements. It promotes shared responsibility and avoids late-stage surprises, making it the most effective integration approach.

The Security Architect translates business and compliance drivers into technical security requirements, threat models and control baselines early, before design is fixed. That forward-looking remit matches identifying security requirements during initial SDLC phases, unlike developers or testers who act later.

Shift-left means security work migrates to the earliest lifecycle stage. Capturing security requirements during initial planning embeds controls before design and code exist, when change is cheapest, rather than retrofitting them during testing or operations in the legacy waterfall transition.

SAST analyzes source code for security flaws without executing it. Integrating SAST into the developer's IDE or CI pipeline during implementation provides immediate feedback, allowing developers to fix issues early. This is a key shift-left practice that reduces the cost of remediation and prevents vulnerabilities from progressing to later stages.

The percentage of applications with completed threat models indicates the adoption of proactive security practices. Threat modeling helps identify design flaws early, reducing the cost of fixes. Tracking this metric shows how well the organization is integrating security into the early phases of the lifecycle, which is a core goal of secure SDLC management.

Developers frequently lack secure coding knowledge, so they introduce vulnerabilities and cannot interpret security tooling output. This skills gap forces security teams to remediate late, undermining the Secure SDLC's shift-left intent across a large organisation.

Signing artifacts with a private key lets Jenkins verify provenance and detect tampering after the build, so only artefacts whose signature validates are deployed. This satisfies the integrity constraint by binding the deployed binary to the trusted build rather than trusting storage or transport.

IaC encodes configuration as version-controlled templates, so scanning them in the pipeline catches misconfigurations before deployment rather than after. This satisfies the stem's lifecycle-wide constraint, enforcing secure baselines consistently across environments and preventing configuration drift that manual hardening cannot sustain.

The first step should be to assess the actual risk. Not all vulnerabilities in a library affect your application if the vulnerable code is not used. By determining reachability and impact, you can prioritize remediation appropriately. This aligns with risk-based vulnerability management and avoids unnecessary panic or rework.

Security Champions are developers who receive extra security training and embed security practises within their own teams, translating security requirements into daily engineering work. This satisfies the DevSecOps need to scale security expertise without relying solely on a central security team.

Secure coding training equips developers to avoid introducing vulnerabilities such as injection and cross-site scripting during implementation, directly satisfying the plan's requirement to embed security throughout development. Because most defects originate in code, upskilling the people writing it reduces remediation cost and strengthens the Microsoft Entra ID-protected build pipeline's overall assurance.

IDE security linting flags insecure code patterns as developers write them, moving detection to the earliest lifecycle phase. This satisfies Shift-Left by preventing defects from progressing downstream, where remediation costs far more than fixing them at authoring time.

Sniffing traffic exposes data in transit, so the STRIDE category breached is Information Disclosure. The threat targets confidentiality of the client-server communication channel, not integrity, availability or authentication, making Information Disclosure the matching classification for this eavesdropping scenario.

MTTR directly quantifies how quickly identified vulnerabilities are fixed, evidencing whether secure SDLC controls actually reduce exposure over successive releases. Unlike one-off counts, it tracks remediation capability across time, satisfying the stem's requirement to measure programme effectiveness longitudinally rather than at a single point.

Metrics provide measurable evidence that governance controls actually operate, satisfying the framework's need for continuous oversight and accountability. Without tracked performance data, policy compliance cannot be verified or improved, so this practice underpins the monitoring and reporting obligations central to software security governance.

Incremental scanning analyses only changed files or diffs, cutting scan duration and surfacing findings tied to the developer's own commit. This reduces pipeline delay and noise, directly minimising the developer friction the scenario names, while full scans remain for nightly builds.

An SBOM inventories every component and dependency in your software, giving the transparency needed to identify and manage supply-chain risk. This directly satisfies the stem's goal: knowing what you ship lets you rapidly trace vulnerable libraries, verify licences, and respond to upstream compromises without guesswork.