Software Development and Management

Sprint reviews are open to all stakeholders including the Product Owner, Scrum Master, team members, and importantly, end users and other external stakeholders. The purpose is to demonstrate working software and gather feedback, so transparency and broad participation are encouraged.

Conceptual data modeling occurs during systems analysis, which is when requirements are gathered and analyzed. It happens in parallel with other requirements analysis activities to understand what data the business needs before detailed technical design begins.

The question asks which option is NOT related to Informatica. Repository, Designer, and Mapping are all core Informatica PowerCenter components. A Flowchart is a general diagramming tool, not specific to Informatica - making it the correct answer to the negative question.

The V-Model (option C) emphasizes that for every development phase, there is a corresponding testing phase. Testing begins in parallel with development activities - test planning starts during requirements, test cases during design, etc. Waterfall has sequential phases. Spiral is iterative risk-based. Linear is sequential like waterfall.

The Plan-Do-Check-Act (PDCA) cycle follows the sequence: Plan (P) → Do (D) → Check (C) → Act (A). Option B correctly shows this order. This is the Deming Cycle/Shewhart Cycle used for continuous improvement in quality management.

Pega’s official guardrails guide developers to build robust, maintainable applications. Core guardrails include establishing a robust foundation, designing intent-driven processing, and building for change. While event-driven concepts exist in software architecture, Design Event Driven Processing is not defined as a standard Pega guardrail.

According to ISTQB risk categorization, poor software characteristics like poor performance, poor usability, or poor security are classified as Product Risks. Product risks are risks that the software will not meet its quality characteristics. Project Risks are different - they're about schedule, budget, resources, and organizational issues. Options A, C, D are incorrect because poor software quality is specifically a product risk, not a project risk.

STRIDE is a threat modeling methodology developed by Microsoft. It's an acronym for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege - categories of security threats. Option A is correct. Options B (HP for performance), C (Symantec for testing), D (Fortis for assessments) are incorrect.

SQUARE (Security Quality Requirements Engineering) is a structured, nine-step methodology developed by Carnegie Mellon University specifically designed to help organizations identify and prioritize software security requirements during early development phases, unlike general consulting or data masking tools.

Services represent functional interface endpoints where clients interact with the application. Unlike error messages or response codes (which are outputs) or packaging (which is a deployment structure), services are direct entry channels through which external systems input data, making them key entry points.

To aim for a secure application as an end result, it is important to consider security from the beginning of the software development lifecycle (SDLC). Therefore, the correct phase of SDLC to start aiming for a secure application as an end result is the Requirement Gathering Phase.

Option A: Go-Live (deployment to production) - This phase involves releasing the software to the end-users. While security testing can be conducted during this phase, it is too late to start aiming for a secure application as an end result.

Option B: Support and Maintenance - This phase involves maintaining and improving the software after it has been deployed to the end-users. While security improvements can be made during this phase, the focus should be on maintaining the security of the existing software rather than starting from scratch.

Option C: Requirement Gathering Phase - This phase involves identifying the business requirements and goals of the software. It is important to consider security requirements during this phase to ensure that the software is designed with security in mind from the beginning.

Option D: Prototyping Phase - This phase involves creating a preliminary version of the software to test its functionality. While security testing can be conducted during this phase, the focus is on testing the software's functionality rather than securing it.

Therefore, the answer is: The Answer is: C.

Threat modeling is the structured process of identifying potential threats, documenting security weaknesses, and assessing risks to an application or system. It involves enumerating assets, mapping attack surfaces, identifying threat agents, and documenting countermeasures. Control identification and prioritization (A, C) are subprocesses, while attack surface evaluation (D) is a component - threat modeling encompasses the entire risk assessment methodology. Frameworks like STRIDE, PASTA, or Microsoft's threat modeling approach provide systematic ways to document and analyze security risks.

SSE-CMM (Systems Security Engineering Capability Maturity Model) specifically describes the characteristics of security engineering processes. It provides a framework for assessing and improving the capability of security engineering processes, unlike CMMi (general software engineering) or Bell-LaPadula (access control model).

DREAD (Damage, Reproducibility, Exploitability, Affected users, Discoverability) is a risk-rating methodology used to analyze risks in threat modeling. STRIDE is a threat classification system, not a risk-rating model, while OWASP and DAR are not risk analysis methodologies.