mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: Implementing a secure software development…
A company is implementing a secure software development lifecycle (SSDLC). Which of the following is a key activity during the design phase?
⚠ Common exam trap
Many exam-takers confuse 'design phase' with 'implementation phase' activities, mistakenly selecting static code analysis (A) because it is a common security review, but it requires code to exist, whereas threat modeling is the only design-phase option that addresses architecture before code is written.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Threat modeling
Threat modeling is a key activity during the design phase of the SSDLC because it proactively identifies potential security threats, vulnerabilities, and attack vectors before any code is written. By analyzing the system's architecture, data flows, and trust boundaries (e.g., using STRIDE or PASTA methodologies), teams can design security controls directly into the system, reducing the cost and impact of fixes later. This aligns with the NIST SP 800-64 and Microsoft SDL frameworks, which mandate threat modeling as a core design-phase activity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Static code analysis
Why it's wrong here
Static code analysis is a white-box testing method performed on source code or compiled binaries without executing the program. It identifies potential vulnerabilities, coding standard violations, and security flaws during the development phase, well before deployment. While crucial for security, it occurs after the initial design and architecture are established, making it a later activity than identifying threats during the design phase itself.
- ✗
Code signing
Why it's wrong here
Code signing involves digitally signing executable code and scripts to verify the author's identity and ensure the code has not been altered since it was signed. This process typically occurs during the build and release phase, after the code has been written and compiled. Its primary purpose is to provide integrity and authenticity to users, not to identify design-level threats or vulnerabilities early in the SDLC.
- ✓
Threat modeling
Why this is correct
Threat modeling is a structured approach used early in the Software Development Life Cycle (SDLC), specifically during the design phase, to identify potential threats, vulnerabilities, and attack vectors. It involves analyzing the system's architecture, data flows, and trust boundaries to proactively understand where security controls are needed. By identifying and mitigating risks before coding begins, it significantly reduces the cost and effort of fixing security flaws later.
- ✗
Penetration testing
Why it's wrong here
Penetration testing is a simulated cyberattack against a running computer system, network, or web application to find exploitable vulnerabilities. This adversarial testing method is typically performed late in the SDLC, often on a fully developed or deployed system, to validate security controls and identify real-world weaknesses. It is a reactive measure to discover existing flaws rather than a proactive design-phase activity for threat identification.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
STRIDE
STRIDE is a threat classification model that helps IT professionals identify and categorize security threats across six categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.
Key term
Threat
A threat is any potential danger that could harm a computer system, network, or data, whether from a malicious hacker, a natural disaster, or an accidental mistake.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.