Discuss ISC2 CISSP Exam Topic 5 Question 105

Which of the following practices provides the development team with a definition of security and identification of threats in designing software?

APenetration testing

BStakeholder review

CThreat modeling

DRequirements review

Suggested Answer: C

Threat modeling is a practice that provides the development team with a definition of security and identification of threats in designing software. Threat modeling is a process of analyzing the software system or application from the perspective of an attacker, and identifying the potential threats, vulnerabilities, and risks that may affect the security of the software system or application. Threat modeling can help to improve the security awareness and mindset of the development team, as well as to guide the security design and implementation decisions of the software system or application. Penetration testing, stakeholder review, or requirements review are not the best practices to provide the development team with a definition of security and identification of threats in designing software, as they are more related to the testing, evaluation, or specification aspects of software development.Reference:CISSP All-in-One Exam Guide, Eighth Edition, Chapter 21: Software Development Security, page 1165;CISSP Official (ISC)2 Practice Tests, Third Edition, Domain 8: Software Development Security, Question 8.7, page 303.

Get Premium CISSP Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

27 comments · newest first

Ty 10 months ago

Not sure if threat modeling is the only way to define security...

Leonor 10 months ago

Totally agree, threat modeling helps identify risks early!

Teddy 10 months ago

I thought requirements review could also play a role in this.

Trinidad 10 months ago

Wait, isn't penetration testing also important for security?

Huey 11 months ago

I think it's definitely C, threat modeling is key.

Winifred 11 months ago

I might be mixing things up, but I think stakeholder review could help with security definitions, though it doesn’t seem as direct as threat modeling.

Jose 11 months ago

Requirements review sounds familiar, but I feel like it’s more about ensuring the software meets user needs rather than security threats.

Lorrine 11 months ago

I'm not entirely sure, but I remember something about penetration testing being more about finding vulnerabilities after the software is built.

Domonique 12 months ago

I think threat modeling is the right answer since it specifically focuses on identifying threats during the design phase.

Verda 12 months ago

I'm leaning towards C as well. Threat modeling is a structured way to analyze the system, identify threats, and define appropriate security controls. The other options are more reactive approaches that come later in the development lifecycle.

Isreal 12 months ago

Threat modeling sounds like the right approach here. It's all about proactively identifying potential security risks and vulnerabilities during the design process, which is key for building secure software from the ground up.

Ariel 1 year ago

Hmm, I'm a bit unsure about this one. I know penetration testing and requirements review are important for security, but I'm not sure if they provide the same level of upfront threat identification as threat modeling. I'll have to think this through carefully.

Dick 1 year ago

I'm pretty sure the answer is C - Threat modeling. That's the practice that helps identify security threats and define security requirements during the design phase.

Mari 1 year ago

Requirements review? Nah, that's so last season. Threat modeling is where it's at, baby!

Nan 1 year ago

↳ replying to Mari

Threat modeling is definitely the way to go!

Josue 1 year ago

↳ replying to Mari

Yeah, it identifies threats early!

Antonio 1 year ago

↳ replying to Mari

Penetration testing is cool, but it's not proactive.

Raymon 1 year ago

↳ replying to Mari

Requirements review is outdated, for sure!

Mira 1 year ago

Definitely C) Threat modeling. It's like having a crystal ball to see all the potential threats before they even happen.

Jettie 1 year ago

↳ replying to Mira

I agree, threat modeling is crucial for identifying potential security threats.

Evelynn 1 year ago

I think threat modeling is the way to go. It's like playing a game of 'Spot the Bad Guy' during the design phase.

Tarra 1 year ago

↳ replying to Evelynn

B) Stakeholder review

Johana 1 year ago

↳ replying to Evelynn

A) Penetration testing

Maurine 1 year ago

Penetration testing is more about testing the security controls, while threat modeling is about identifying potential threats during design.

Brett 1 year ago

I'm not sure, but I think A) Penetration testing could also help in identifying threats.

Jenelle 1 year ago

I agree with Maurine, threat modeling helps identify security threats.

Maurine 1 year ago

I think the answer is C) Threat modeling.

ISC2 CISSP Exam - Topic 5 Question 105 Discussion