Q: 4
When in the Software Development Life Cycle (SDLC) MUST software security functional
requirements be defined?
Options
Discussion
D. Security requirements have to be set right after business analysis and data categorization, not later in SDLC. If you wait until after vulnerability analysis or design phases, it's too late to integrate them fully.
Its D, not B. Vulnerability analysis comes after, trap for people mixing up SDLC order.
D
Kind of leaning toward B. Seems like you should lock down requirements right after vulnerability analysis is done.
Its D. Saw a similar question in some practice sets and D matched the official CISSP approach for when security requirements should be set.
Not B, D. Vulnerability analysis is later in the SDLC so B is a common trap here.
No way it's B, D is right. Security functional requirements come after business analysis and data categorization, not after vulnerability analysis.
I don’t see how B fits since vulnerability analysis happens after requirements are set, not before. Security functional requirements need both the business analysis and knowing your data’s sensitivity, so D is the right sequence. Could be a tricky one if you miss that order.
Option B. Requirements usually get clearer after vulnerability checks but before detailed design.
I don't think it's B. D is correct here because vulnerability analysis comes a bit later in the SDLC, and CISSP usually expects security requirements to be set once business functions and data categorization are clear. B is a trap since it jumps ahead. Wouldn't surprise me if some practice sets tripped folks up on this one.
Be respectful. No spam.
