Exam CISM topic 1 question 156 discussion

bake-in-security... It should be from the very beginning of the lifecycle.

As early as possible.

C. Requirements gathering

The correct answer is (C) Requirements Gathering as this is literally the first phase of the SDLC. The SDLC phases are in the following order: - Planning and Analysis - Requirements Gathering - Design - Development - Testing - Deployment - Maintenance

The correct answer is C. Requirements gathering. This is the stage of the software development life cycle where application security controls should be first addressed to ensure that security is built into the application from the start. This involves identifying potential security risks and defining security requirements and specifications for the application. This helps to reduce the cost and effort of fixing security issues later in the SDLC, and ensures that the application is developed with security in mind.

Security should always be considered from the beginning of the project until its conclusion.

Answer is A

Application security controls should be addressed during the software code development stage of the software development life cycle (SDLC). At this stage, the code is being written, and security controls such as input validation, output encoding, and authentication can be integrated into the code. By addressing security controls early in the SDLC, it becomes easier to identify and remediate potential security vulnerabilities before the application is deployed in production.