CISSP Practice Question: If security testing is deferred until system testing or just prior to…

Correct Answer: A. Increased development and remediation costs resulting in schedule delays

Explanation (CISSP Manager Logic):

Remediating vulnerabilities late in the SDLC follows the cost-of-change curve, where fixing flaws after integration is exponentially more expensive than during design. From a business perspective, discovering critical risks just before release forces costly redesigns, extensive regression testing, and missed market opportunities.

By shifting security left, you:

• Reduce the total cost of ownership by identifying defects early.
• Ensure predictable release schedules and project timelines.
• Minimize technical debt and the need for emergency post-launch patches.

While the other options are relevant, they fall short because:

• B: Late discovery often leads to rushed workarounds or accepted risks rather than a superior security posture.
• C: Remediation and refactoring at the end of the cycle inevitably extend timelines and delay time-to-market.
• D: Security testing timing has no direct correlation with the discovery rate of unrelated functional defects.

Think like a manager:

Security must be integrated into every SDLC phase to ensure fiscal responsibility and operational resilience. Proactive risk management is always more cost-effective than reactive firefighting.