Which statement best describes secure SDLC practices?

• A. It integrates security throughout the software lifecycle including multiple phases.
• B. It delays security until after deployment.
• C. It relies only on manual testing.
• D. It ignores maintenance.

Answer: (A)

Secure SDLC practices mean weaving security into every stage of the software lifecycle, from planning and requirements through design, implementation, testing, deployment, and ongoing maintenance. By treating security as an integral part of each phase, teams can perform threat modeling during design, apply secure coding standards during development, run automated and manual security testing as part of verification, configure deployments securely, and continuously monitor and patch in production. This approach reduces vulnerabilities earlier, improves risk management, and supports safer, more reliable releases.

Delaying security until after deployment leads to exposed systems and higher remediation costs. Relying only on manual testing misses many issues, especially in larger codebases and with frequent releases, where automation is essential. Ignoring maintenance neglects the fact that threats evolve and dependencies need ongoing updates and patching.