easyMultiple ChoiceObjective-mapped
CISSP A development team is adopting a secure SDLC Practice Question
A development team is adopting a secure SDLC. Which phase should include threat modeling to identify potential security vulnerabilities early?
⚠ Common exam trap
A common mix-up: candidates confuse 'Requirements gathering' (where high-level security goals are set) with 'Design' (where concrete architectural decisions enable actionable threat modeling), leading them to pick D instead of B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Design
Threat modeling is a structured activity that identifies potential threats, vulnerabilities, and attack vectors against a system. It is most effective during the Design phase because architectural decisions, data flow diagrams, trust boundaries, and component interactions are being defined, allowing security controls to be built in rather than bolted on later. Performing threat modeling here aligns with the 'shift left' principle of secure SDLC, reducing cost and effort compared to retrofitting security after implementation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implementation
Why it's wrong here
Performing threat modeling during the implementation phase is significantly reactive, as code is actively being developed or integrated. Discovering fundamental architectural or design vulnerabilities at this stage necessitates extensive rework, leading to substantial cost overruns, project delays, and potential re-architecting. It shifts the focus from preventing flaws to costly remediation after they've been introduced.
- ✓
Design
Why this is correct
The design phase is the optimal stage for threat modeling because detailed architectural diagrams, data flow diagrams, and component interactions are established. This allows security professionals to systematically analyze the system's structure, identify trust boundaries, and pinpoint potential attack vectors using methodologies like STRIDE or PASTA. Addressing security concerns here ensures controls are built-in from the ground up, preventing vulnerabilities before any code is written, which is far more efficient and cost-effective.
- ✗
Testing
Why it's wrong here
Threat modeling is a proactive security activity, fundamentally distinct from the reactive nature of the testing phase. While testing, including penetration testing and vulnerability scanning, validates the effectiveness of *implemented* security controls and discovers *existing* flaws in code, threat modeling aims to *predict* and prevent vulnerabilities based on design. Performing threat modeling during testing means missing the opportunity to influence the system's architecture and design for security, relegating it to a late-stage defect discovery mechanism.
- ✗
Requirements gathering
Why it's wrong here
During the requirements gathering phase, the primary focus is on defining the functional and non-functional needs of the system, rather than its technical architecture or implementation details. Without a concrete system design, including data flows, component interactions, and trust boundaries, there is insufficient technical detail to conduct a meaningful and effective threat model. While security requirements are established here, detailed threat analysis requires a more mature understanding of the system's proposed structure, making this phase too early for comprehensive threat modeling.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Threat
A threat is any potential danger that could harm a computer system, network, or data, whether from a malicious hacker, a natural disaster, or an accidental mistake.
Key term
SDLC
The Software Development Life Cycle (SDLC) is a structured process used by IT teams to plan, create, test, and deploy software in a reliable and organized way.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.