Which option is NOT a typical SDLC security practice?

Which option is NOT a typical SDLC security practice?

• A. Threat modeling
• B. Secure coding
• C. Code reviews
• D. Marketing integration with product launch

Answer: (D)

In SDLC security, the focus is on building secure software from the start. Threat modeling identifies potential threats in the design and helps plan mitigations; secure coding ensures developers implement features with security in mind; and code reviews bring in checks to catch security flaws before code moves forward. Marketing integration with product launch, by contrast, is about go-to-market activities and coordinating release timing and messaging. It doesn’t directly contribute to designing, coding, or verifying security controls, so it isn’t a typical SDLC security practice.

In SDLC security, the focus is on building secure software from the start. Threat modeling identifies potential threats in the design and helps plan mitigations; secure coding ensures developers implement features with security in mind; and code reviews bring in checks to catch security flaws before code moves forward. Marketing integration with product launch, by contrast, is about go-to-market activities and coordinating release timing and messaging. It doesn’t directly contribute to designing, coding, or verifying security controls, so it isn’t a typical SDLC security practice.