mediumMultiple ChoiceObjective-mapped
Integrating Security into Agile Development
An organization is transitioning from waterfall to agile development. How should security be integrated into the new process to align with the SDLC?
Quick Answer
The correct answer is to include security requirements in user stories and conduct threat modeling each iteration. This approach embeds security directly into the Agile SDLC by treating security as a functional requirement that evolves with each sprint, while iterative threat modeling proactively identifies and mitigates risks as new features are developed. On the CISSP exam, this question tests your understanding of the Secure Software Development Lifecycle (SSDLC) and how to shift security left in Agile environments—a common trap is assuming that security can be deferred to a final release phase or replaced entirely by automated scans, which misses critical design-level flaws. Remember the mnemonic “STAR”: Security stories, Threat modeling, Agile iterations, Risk reduction—ensuring security is a continuous, integrated practice rather than a gate at the end.
⚠ Common exam trap
The trap here is that candidates mistakenly think security can be 'bolted on' at the end or only during specific phases, failing to recognize that agile demands security be woven into every iteration through practices like threat modeling and security user stories.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Include security requirements in user stories and conduct threat modeling each iteration
In agile development, security must be integrated continuously throughout each iteration, not deferred to the end. Option D is correct because it embeds security into the user story definition (including acceptance criteria for security requirements) and mandates threat modeling each iteration, which aligns with the iterative, incremental nature of agile and ensures security is addressed early and often, reducing risk and rework.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Perform a single security review at the end of the release cycle
Why it's wrong here
This is a waterfall approach; agile requires iterative security.
- ✗
Conduct security testing only during the integration phase
Why it's wrong here
Security should be continuous throughout the sprint.
- ✗
Skip threat modeling and rely solely on automated scanning
Why it's wrong here
Threat modeling identifies design flaws that scanners miss.
- ✓
Include security requirements in user stories and conduct threat modeling each iteration
Why this is correct
This embeds security into agile practices.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Threat
A threat is any potential danger that could harm a computer system, network, or data, whether from a malicious hacker, a natural disaster, or an accidental mistake.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISSP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization is migrating from a waterfall to an Agile development methodology. Which of the following is a key security advantage of Agile?
easy- A.Security testing is performed only at the end of the project
- ✓ B.Security issues can be addressed incrementally throughout development
- C.Security requirements are finalized upfront
- D.Security documentation is minimized to reduce overhead
Why B: In Agile development, security testing and remediation are integrated into each iteration (sprint), allowing teams to identify and fix vulnerabilities incrementally rather than waiting until the end. This continuous feedback loop reduces the risk of late-stage security surprises and aligns with the principle of 'shifting left' on security.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.