mediumMultiple SelectObjective-mapped
CISSP Practice Question: Which TWO of the following are essential elements…
Which TWO of the following are essential elements of a secure software development lifecycle (SSDLC)? (Select exactly 2.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Security testing during the verification phase
Options A and B are correct because threat modeling during design and security testing during verification are standard phases in SSDLC. Option C is wrong because code obfuscation after compilation is a post-development technique, not a lifecycle element. Option D is wrong because penetration testing after deployment is part of security testing, but not a separate phase; it is typically performed during the testing phase. Option E is wrong because user acceptance testing is functional, not security-focused.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Security testing during the verification phase
Why this is correct
Security testing during the verification phase is an essential element because it systematically evaluates the software's adherence to defined security requirements and identifies vulnerabilities before deployment. This phase encompasses various testing methodologies, such as static application security testing (SAST), dynamic application security testing (DAST), and vulnerability scanning, ensuring that implemented security controls function as intended. It validates that the application can withstand anticipated attacks and protects sensitive data effectively. This proactive validation is critical for minimizing post-release security incidents.
- ✓
Threat modeling during the design phase
Why this is correct
Threat modeling during the design phase is crucial as it proactively identifies potential security threats and vulnerabilities early in the software development lifecycle. By analyzing the system's architecture, data flows, and trust boundaries, development teams can anticipate attack vectors and design appropriate security controls before any code is written. This 'shift left' approach significantly reduces the cost and effort of remediation compared to discovering flaws later in the development process. It ensures security is baked into the architecture from the ground up.
- ✗
Code obfuscation after compilation
Why it's wrong here
Code obfuscation after compilation is a post-development hardening technique designed to make reverse engineering more difficult, rather than an essential phase of a secure software development lifecycle (SSDLC). While it can add a layer of defense against intellectual property theft or tampering, it does not address fundamental security vulnerabilities introduced during design or coding. Obfuscation is a tactical measure applied to compiled code, not a strategic element for integrating security throughout the development process.
- ✗
Penetration testing after deployment
Why it's wrong here
Penetration testing after deployment, while a valuable security assessment, is not an essential *phase* of the Secure Software Development Lifecycle (SSDLC) itself, nor is it the sole or primary form of security testing. Relying solely on post-deployment penetration testing misses the critical 'shift left' principle, where security activities are integrated throughout the entire development process. Effective SSDLC mandates continuous security testing and validation from requirements gathering through design, implementation, and verification, rather than just a final check.
- ✗
User acceptance testing before release
Why it's wrong here
User acceptance testing (UAT) before release primarily focuses on validating that the software meets the business requirements and functions correctly from an end-user perspective. Its scope is typically functional correctness and usability, not the identification or validation of security vulnerabilities or controls. While a secure system must also be usable, UAT does not inherently assess the robustness of security mechanisms, data protection, or resilience against attacks, making it distinct from dedicated security testing phases.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Threat
A threat is any potential danger that could harm a computer system, network, or data, whether from a malicious hacker, a natural disaster, or an accidental mistake.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.