CISSP domain - 10% of the exam

Software Development Security

Software Development Security is 10% of the Certified Information Systems Security Professional (CISSP) (CISSP) exam. These are the objectives it covers, each with practice questions and worked explanations.

Objectives in this domain

Sample question from this domain

Free sampleSoftware Development Securityhard

A security architect is explaining to a delivery manager why the organisation is moving from a quality gate at the end of the release pipeline to embedding security activities throughout each SDLC phase. Which statement BEST captures the underlying principle of this shift-left approach?

  • AIdentifying security defects in the phase that introduced them lowers remediation cost and prevents flawed assumptions from propagating into later phases. Correct
  • BConcentrating security review at the release gate is preferable because defects can be triaged once the system is feature-complete and behaviour is stable.
  • CRunning automated penetration testing against production replicas is the most efficient way to remove vulnerabilities before customers see them.
  • DOutsourcing security testing to an independent third party removes bias and provides a defensible assurance artefact for auditors.
Explain why integrating security activities across every SDLC phase reduces remediation cost compared with late-stage gates. The economics of defect removal are central to secure SDLC thinking: a flaw introduced in requirements that survives into production can cost orders of magnitude more to fix than one caught in the phase that produced it. Shift-left embeds threat modelling, secure design review, secure coding standards, and unit-level security tests in the phase that owns the artefact, so flawed assumptions do not propagate.

Why A is correct: This is the canonical rationale for shift-left: defect-removal economics worsen the further a flaw travels, and design-level errors found in coding or testing are expensive to unwind. Embedding requirements, threat modelling, and secure coding reviews in each phase contains that cost.

Why B is wrong: This describes the legacy waterfall posture the team is moving away from. Late discovery raises remediation cost and forces risk-based exceptions to meet release dates, which is exactly the failure shift-left is meant to address.

Why C is wrong: Pen testing against a production-like environment is valuable, but it happens late and finds only what survives earlier phases. It is a verification activity, not the principle that drives integrating security across the SDLC.

Why D is wrong: Independent assessment supports assurance but does not address when in the lifecycle security is considered. A late third-party test still inherits the cost curve that shift-left is intended to flatten.

Other domains in this exam

See also the CISSP cert hub, the study guide, and the cheat sheet.

Examworthy is not affiliated with or endorsed by (ISC)2. Original, blueprint-aligned practice material only.