Explain the Secure Development Lifecycle (SDLC) and the TA's role in secure coding practices.

• A. SDLC stages treat security as optional; the TA signs off on releases.
• B. Security is only tested in the final phase; the TA focuses on QA.
• C. Security is only the developers' responsibility; the TA does not engage.
• D. Security is integrated at each SDLC phase (planning, design, coding, testing, deployment); the TA enforces threat modeling, secure coding standards, and security testing.

Answer: (D)

Security must be woven into every phase of the SDLC, from planning through deployment. The idea is to treat security as an ongoing, shared responsibility rather than a final checkpoint. In this approach, threats are identified, and security controls are defined early, and they are continuously validated as the project progresses.

The TA’s role is to enforce secure coding practices throughout the lifecycle. This means guiding threat modeling so risks are understood and mitigations are mapped to the design, helping establish and maintain secure coding standards that developers follow, and overseeing security testing to catch vulnerabilities before release. In planning, threat modeling helps determine what needs protecting and what controls are essential. In design, security principles shape the architecture and data flows. In coding, developers implement using secure patterns and do so in alignment with the standards. In testing, a mix of static and dynamic analysis, vulnerability scanning, and manual testing verifies that security controls work as intended. In deployment, secure configurations, patch management, and ongoing monitoring ensure protections persist after release.

This integrated, phase-spanning approach is what makes security effective and cost-efficient, catching issues early rather than after deployment. The other options fall short because security isn’t optional, isn’t confined to the final phase, and cannot be effective if the TA isn’t actively guiding and enforcing secure practices across planning, design, coding, testing, and deployment.