Secure SDLC, DevSecOps and Software Testing
This topic covers secure SDLC phases, development methodologies, threat modeling, security requirements, testing, DevSecOps automation, release controls, and software assurance.
How to study for CISSP
Treat each CISSP question as a risk decision: identify the owner, objective, control type, lifecycle phase, and business consequence before choosing.
Core concepts
Concept 1
Secure SDLC, DevSecOps and Software Testing questions test whether a security leader can choose a defensible control, process, or governance response for a business risk.
Exam cue: Identify the domain objective: govern risk, protect assets, engineer securely, secure networks, control identity, test, operate, or secure software.
Concept 2
The best CISSP answer usually protects people, policy, data, and mission before jumping to a narrow technical fix.
Exam cue: Match the response to the risk owner, data owner, control objective, lifecycle phase, and assurance evidence in the scenario.
Concept 3
Eliminate answers that skip authorization, ignore legal or contractual duties, weaken least privilege, or confuse preventive, detective, and corrective controls.
Exam cue: Prefer documented policy, due care, defense in depth, least privilege, validated recovery, and continuous improvement.
Risk pitfalls and guardrails
Choosing a tool before confirming business requirements, ownership, and risk treatment.
Guardrail: Avoid answers that jump to a tool, ignore the risk owner, weaken least privilege, skip evidence, or treat one security objective as the only concern.
Treating confidentiality as the only goal when integrity, availability, authenticity, accountability, and safety also matter.
Guardrail: Avoid answers that jump to a tool, ignore the risk owner, weaken least privilege, skip evidence, or treat one security objective as the only concern.
Ignoring legal, regulatory, contractual, audit, and evidence-handling obligations.
Guardrail: Avoid answers that jump to a tool, ignore the risk owner, weaken least privilege, skip evidence, or treat one security objective as the only concern.
Memory anchors
Secure SDLC
A secure SDLC integrates security requirements, design review, coding, testing, release, and maintenance controls.
Security Requirement
Security requirements define confidentiality, integrity, availability, privacy, compliance, and abuse-case needs before build.
DevSecOps
DevSecOps embeds security testing, policy, and feedback into automated development and operations workflows.
SAST
Static application security testing examines code or binaries without running the application.
DAST
Dynamic application security testing evaluates a running application from the outside.
IAST
Interactive application security testing uses runtime instrumentation while the application is exercised.
Threat Model Review
Threat model review checks assets, trust boundaries, threats, controls, and residual risk during design.
Release Gate
A release gate enforces required testing, approval, and risk acceptance before deployment.
Secure Build
Secure build processes protect source, dependencies, build workers, artifacts, and signing keys.
Regression Test
Regression testing verifies that changes do not break existing functionality or controls.
Checkpoint rule
Do the check-up only after you can summarize each concept in one sentence and identify one dangerous pitfall from memory.
Knowledge Check (after reading)
Short check-up to confirm understanding of this module.
Check-up Questions
A product team begins coding before defining security requirements. What is the MOST likely consequence?
A project uses a waterfall lifecycle. When should security activities occur?
Answer all questions to submit.
Next step personalized recommendations
Continue learning
Move forward only after this module is stable.
What is Pass Harbor?
Completely free exam prep for 317 U.S. exams.
- Practice questions
- Flashcards
- Study guides
- Mock exams
- No registration
- No paywall
- Start instantly
“No more expensive exam prep. Quality study tools should be accessible to everyone.”