Which statement best describes the role of secure coding practices, such as input validation and output encoding, within the secure SDLC?
- AThey are detective controls applied after deployment to identify vulnerabilities that reached production
- BThey are corrective controls that automatically remediate exploited flaws in the running application
- CThey are compensating controls used only when architectural security requirements cannot be met
- DThey are preventive controls applied during implementation to stop classes of vulnerability from entering the codebase Correct
Why A is wrong: Detection after deployment describes monitoring or scanning, not secure coding. This confuses a preventive development practice with a later detective activity.
Why B is wrong: Automatic remediation at runtime is not what secure coding does. Secure coding prevents defects during development rather than correcting them after exploitation, so the category is wrong.
Why C is wrong: Compensating controls substitute for an unmet requirement. Secure coding is a baseline preventive practice expected throughout implementation, not a fallback, so this mischaracterises it.
Why D is correct: Secure coding practices are preventive measures used as developers write code, reducing whole classes of flaws such as injection at source. This correctly places them in the implementation phase.