easyMultiple Select
CISSP Practice Question: Which TWO of the following are fundamental phases…
Which TWO of the following are fundamental phases of a secure software development lifecycle (SSDLC) where security should be integrated? (Select exactly two.)
⚠ Common exam trap
The CISSP exam often tests the misconception that user acceptance testing (UAT) is a security phase, but UAT is strictly for functional acceptance by business stakeholders, not for security validation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Testing and validation
Requirements gathering (E) is a fundamental SSDLC phase where security must be integrated, since security requirements, compliance obligations, and risk analysis (e.g., misuse/abuse cases, data classification) are defined before design and coding begin. Testing and validation (A) is also a fundamental SSDLC phase where security is integrated through activities such as static/dynamic application security testing (SAST/DAST), penetration testing, and vulnerability validation to confirm controls work as intended. Software retirement (B) is a lifecycle consideration but not one of the core SSDLC phases emphasized for security integration in this context. User acceptance testing (C) is a type of testing, not a distinct fundamental SSDLC phase, and it focuses on business fitness rather than security-specific validation. Production operations (D) is an operational/maintenance concern outside the core development lifecycle phases where security is primarily built in.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Testing and validation
Why this is correct
Security testing should occur before release.
- ✗
Software retirement
Why it's wrong here
Retirement is the final phase, not a primary integration point.
- ✗
User acceptance testing
Why it's wrong here
UAT is functional, not security-focused.
- ✗
Production operations
Why it's wrong here
Operations are after deployment; SSDLC includes earlier phases.
- ✓
Requirements gathering
Why this is correct
Security requirements should be defined at the start.
Go deeper
Related to this question
Learn chapter
Security Assessment and Testing
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Data classification
Data classification is the process of organizing data into categories based on its sensitivity, value, and criticality to an organization, so that appropriate security controls can be applied.
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.