Discuss Isaca CDPSE Exam Topic 3 Question 58

Which of the following is the BEST way to ensure that application hardening is included throughout the software development life cycle (SDLC)?

ARequire an annual internal audit of SDLC processes.

BInclude qualified application security personnel as part of the process.

CEnsure comprehensive application security testing immediately prior to release.

DRequire an annual third-party audit of new client software solutions.

Suggested Answer: B

The best way to ensure that application hardening is included throughout the software development life cycle (SDLC) is to include qualified application security personnel as part of the process. Application hardening is the process of applying security measures and techniques to an application to reduce its attack surface, vulnerabilities, and risks. Application hardening should be integrated into every stage of the SDLC, from planning and design to development and testing to deployment and maintenance. Including qualified application security personnel as part of the process helps to ensure that application hardening is performed effectively and consistently, as well as to provide guidance, feedback, and support to the developers, testers, and project managers. The other options are not as effective or sufficient as including qualified application security personnel as part of the process, as they do not address the root cause of the lack of application hardening, which is the gap in skills and knowledge among the SDLC participants.

Get Premium CDPSE Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

35 comments · newest first

Elvera 10 months ago

Wait, are we really trusting third-party audits? That feels risky!

Alesia 11 months ago

D seems excessive for every new client solution.

Lucy 11 months ago

A sounds good, but an annual audit might not be enough.

Fabiola 11 months ago

I think C is more effective. Testing right before release is crucial.

Dominic 11 months ago

B is definitely the way to go! Security needs to be part of the team.

Junita 12 months ago

I vaguely recall that audits can help, but I feel like they might not be as effective as having security integrated from the start.

Yesenia 12 months ago

I’m leaning towards option C since it emphasizes testing, but I wonder if that’s enough without ongoing involvement from security experts.

Caitlin 12 months ago

I think option B sounds familiar from our practice questions, but I also feel like testing right before release is crucial too.

Dorothy 1 year ago

I remember discussing how integrating security personnel into the SDLC could really help, but I'm not sure if that's the absolute best way.

Ceola 1 year ago

Annual audits and testing are good, but they're reactive. Option B is proactive and gets security involved from the start.

Desiree 1 year ago

I'm leaning towards B as well. Bringing in qualified security experts to be part of the process seems like the most effective way to embed application hardening.

Matthew 1 year ago

Okay, I think the key here is to ensure security is integrated throughout the SDLC, not just at the end. Option B looks like the best choice.

Noel 1 year ago

Hmm, I'm not sure. Including security personnel seems like a good idea, but I'm not convinced that's the best approach.

Alyce 1 year ago

This is a tricky one. I'll need to think through the different options carefully.

Elfriede 2 years ago

I'd have to go with B. Bringing in the security team as an integral part of the process is key.

Stephanie 2 years ago

Wow, this question is really making me hungry. Maybe we should test the app by seeing if it can order a pizza securely?

Lilli 2 years ago

Option B is the way to go. You can't have a secure application without security experts involved from the start.

Paulina 2 years ago

↳ replying to Lilli

It's important to prioritize security throughout the entire development process.

Callie 2 years ago

↳ replying to Lilli

Including them in the process can help prevent security issues down the line.

Cristina 2 years ago

↳ replying to Lilli

Definitely, they can help identify potential vulnerabilities early on.

German 2 years ago

↳ replying to Lilli

I agree, having security experts involved from the beginning is crucial.

Tonette 2 years ago

I'm not sure, but D sounds like the most thorough approach. A third-party audit would be really comprehensive.

Elza 2 years ago

C seems like the way to go. Comprehensive testing right before release is the best way to catch any security issues.

Eden 2 years ago

↳ replying to Elza

Annual third-party audits can provide an extra layer of security assurance.

Thaddeus 2 years ago

↳ replying to Elza

Having qualified application security personnel involved throughout the process is also crucial.

Laurene 2 years ago

↳ replying to Elza

I agree, C is definitely important to catch any security issues before release.

Elenore 2 years ago

I believe ensuring comprehensive application security testing immediately prior to release is also crucial to catch any vulnerabilities before deployment.

Zack 2 years ago

I think both suggestions are valid. Having security personnel involved from the start and conducting thorough testing before release can greatly enhance application hardening.

Edwin 2 years ago

I agree with Sharan. Having experts involved throughout the SDLC can help identify and address security issues early on.

Sharan 2 years ago

I think the best way is to include qualified application security personnel as part of the process.

Hobert 2 years ago

I think the best option is B. Having qualified security personnel involved throughout the SDLC is crucial for ensuring application hardening.

Teddy 2 years ago

↳ replying to Hobert

I think having both internal and external audits can also help strengthen security measures.

Denna 2 years ago

↳ replying to Hobert

Yes, that's a good point. Both are important for ensuring application security.

Eladia 2 years ago

↳ replying to Hobert

But wouldn't it also be important to have comprehensive testing before release?

Margart 2 years ago

↳ replying to Hobert

I agree, having security personnel involved from the start is key.

Isaca CDPSE Exam - Topic 3 Question 58 Discussion