Which statement best describes SSDLC's purpose?

• A. It embeds security into only the testing phase.
• B. It embeds security into each phase of software development, from requirements to deployment.
• C. It focuses solely on secure coding practices without vulnerability management.
• D. It replaces enterprise architecture governance.

Answer: (B)

SSDLC aims to embed security into each phase of software development, from the initial requirements through deployment and ongoing maintenance. This means capturing security requirements and performing threat modeling early, designing with defense-in-depth, applying secure coding standards during implementation, and conducting thorough verification—static and dynamic analysis, vulnerability testing, and penetration testing—before release. It also covers secure deployment practices and ongoing vulnerability management to address new threats after go-live. The other options are too narrow: focusing only on testing misses security in planning and design, while concentrating only on secure coding neglects verification and maintenance, and replacing governance is not what SSDLC is about.