CCSP Cloud Application Security Practice Question
Which TWO of the following are key components of a secure software development lifecycle (SSDLC) in a cloud environment?
⚠ Common exam trap
ISC2 often tests the distinction between core technical components of the SSDLC (like automated SAST and security-focused code reviews) versus supporting activities (like training or unit tests) that are beneficial but not mandatory for the lifecycle itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Automated static application security testing (SAST) during code commit.
Automated SAST during code commit is a key component of a secure software development lifecycle (SSDLC) in a cloud environment because it enables early detection of vulnerabilities (e.g., injection flaws, buffer overflows) by scanning source code as it is committed to the repository. This shift-left approach integrates security directly into the CI/CD pipeline, preventing flaws from progressing to later stages where remediation is more costly and complex.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Automated static application security testing (SAST) during code commit.
Why this is correct
Identifies vulnerabilities early in development.
- ✓
Conducting code reviews with a security focus.
Why this is correct
Peer review helps identify security flaws.
- ✗
Performing security testing only after deployment to production.
Why it's wrong here
Testing should be done earlier to fix issues before release.
- ✗
Mandatory security awareness training for developers.
Why it's wrong here
Training is important but is a prerequisite, not part of the lifecycle process.
- ✗
Integration of unit tests that check for security functionality.
Why it's wrong here
Unit tests usually verify correctness, not security.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.