SDLC Inclusion: Branch Protection Requirements

SY0-701 By islever Editorial Last updated

Given a scenario, select mitigation techniques or controls to secure an enterprise environment.

Short answer

D Branch protection requirements are included in the SDLC to ensure code integrity and security during the development and deployment phases.

Question

Which of the following topics would most likely be included within an organization's SDLC?
  1. Service-level agreements
  2. Information security policy
  3. Penetration testing methodology
  4. Branch protection requirements Correct Answer

Key Takeaways

The question tests the distinction between high-level governance policies and specific operational controls implemented during the SDLC phases, with the common trap being the selection of broad policies over actionable development safeguards.

This question tests the integration of security controls within the Software Development Life Cycle (SDLC), specifically focusing on version control practices. The correct answer identifies branch protection requirements as a key mechanism for enforcing code quality and security during development.

Common mistake: Many learners select Penetration Testing Methodology (C) because they associate SDLC heavily with the testing phase, overlooking that branch protection is a continuous control integrated throughout the development workflow to prevent insecure code from merging.

Expert Analysis

Why the Answer Is Correct

Branch protection requirements are integral to the Implementation and Maintenance phases of the SDLC. They enforce rules such as mandatory code reviews and status checks before code can be merged into main branches, ensuring that security and quality standards are met continuously rather than just at the end of the cycle.

Why the Other Options Are Wrong

Service-level agreements (A) are contractual documents between providers and clients, not part of the internal development process. Information security policy (B) is a governing document that guides the SDLC but is not a procedural step or control within the lifecycle itself. Penetration testing methodology (C) is a technique used during the Testing phase, but it is an external validation activity, whereas branch protection is an intrinsic control embedded in the development environment.

Community Comment Notes

Community consensus leans towards D, with users noting that branch protection ensures code changes are reviewed and approved before merging. Some users argued for C, stating penetration testing is part of the SDLC testing phase, but this misses the nuance of 'included within' implying ongoing operational controls versus periodic assessments. One user correctly cited that SDLC policies govern the structured plan, and branch protection is a tangible implementation of that governance.

Exam Strategy

When asked what is included 'within' the SDLC, look for specific technical controls or processes applied during development (like code reviews, static analysis, or branch protection) rather than high-level policies or external contracts.

Frequently Asked Questions

Why isn't Penetration Testing included in the SDLC?

Penetration testing is part of the Testing phase, but branch protection is a continuous control embedded throughout the development workflow, making it more representative of daily SDLC operations.

Is Information Security Policy part of the SDLC?

No, the policy governs the SDLC but is not a step or control executed within the lifecycle itself; it is the framework rather than the execution.

More SY0-701 FAQ →

Community Votes

D
39%
C
36%
B
24%

39% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 20 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 20

  1. Cee007 👍 8 Answered D
    D. Branch protection requirements Branch protection requirements are related to the version control and development process within the SDLC, ensuring that code changes are reviewed, tested, and approved before being merged into main branches. This helps maintain code quality and security throughout the development process. Penetration testing is usually conducted as part of the testing phase or after deployment to identify vulnerabilities and security weaknesses. It is a separate process from the core stages of the SDLC but is an important aspect of ensuring the security and robustness of the application once development is completed.
  2. cri88 👍 4 Answered B
    B. Information security policy An Information security policy is often included within an organization's Software Development Life Cycle (SDLC) because security considerations are critical during the design, development, and deployment phases of software development. The SDLC aims to integrate security measures throughout the process to protect against vulnerabilities and ensure compliance with security standards. Service-level agreements (A) are more related to contracts and service performance rather than the SDLC. Penetration testing methodology (C) is typically used for post-development testing, not a core part of the SDLC. Branch protection requirements (D) relate to source code management and version control, but they are not commonly included as a core topic of the SDLC. Thus, Information security policy aligns most closely with the SDLC's focus on incorporating security best practices throughout the software development process.
  3. 9149f41 👍 3 Answered C
    Branch protection is not directly part of SDLC. However, the penetration test is. 1. Planning 2. Analysis 3. Design; 4. Implementation 5. Testing ( various testing, e.g. Penetration testing) 6. Deployment 7. Maintenance.
  4. fmeox567 👍 2 Answered C
    C. Penetration testing methodology Here's why: The SDLC is a framework that outlines the process for developing, deploying, and maintaining systems or applications. It typically includes phases such as planning, requirements gathering, design, development, testing, deployment, and maintenance. Penetration testing methodology is directly tied to the testing and security assurance phases of the SDLC. Organizations often incorporate security assessments, such as penetration testing, into the development process to identify and mitigate vulnerabilities before deployment. GPT
  5. dhewa 👍 2 Answered B
    This is because an information security policy outlines the guidelines and practices for protecting sensitive data throughout the development process.
Show 15 more comments
  1. Layrhian01 👍 2 Answered C
    Chat gpt says The topic that would most likely be included within an organization's Software Development Life Cycle (SDLC) is:
  2. Konversation 👍 1 Answered D
    The CompTIA Sec+ Student Guide defines SDLC as: "SDLC policies govern software development within an organization. These policies provide a structured plan detailing the stages of development from initial requirement analysis to maintenance after deployment. It ensures that all software produced meets the organization’s efficiency, reliability, and security standards." Based on this definition, the answer "D" fits best. A: the SLA is related to a third party B: the InfoSec Policy is a high-level policy. It can contain SDLC requirements, but does not provide detailed standard requirements. C: Penetration testing method defined by CompTIA is more holistic view and not app-coding. Especially, there are some questions, where it is about how to secure own code and the answer is "peer reviews" and not pen-testing. D: I know SDLC as part of policies/guidelines for End-User-Computing (EUC) or individual data processing (IDP) and they contain protection requirements and standards derived from a BIA or a PNA. Best of luck with your exam.
  3. jbmac 👍 1 Answered D
    The correct answer is: D. Branch protection requirements Explanation: The Software Development Life Cycle (SDLC) refers to the structured process for planning, creating, testing, and deploying software applications. Among the provided options, branch protection requirements would most likely be included in the SDLC as part of the version control process to ensure that changes to the codebase are reviewed, tested, and securely merged. Branch protection ensures that only authorized and verified code can be merged into critical branches (like the main or master branch), which helps maintain the security, quality, and stability of the software. It often involves using code reviews, automated testing, and other safeguards to protect the integrity of the development process.
  4. laternak26 👍 1 Answered D
    Branch protection requirements are typically part of the Software Development Life Cycle (SDLC), specifically in the phase where code is managed and controlled. These requirements ensure that the code in version control systems (like Git) is protected from unauthorized or accidental changes. For example, branch protection can enforce rules such as requiring code reviews, preventing direct pushes to the main branch, or ensuring all tests pass before code is merged. These practices help maintain the quality and security of the codebase throughout the development lifecycle.
  5. User92 👍 1 Answered D
    Branch protection requirements are directly related to the software development process, particularly in version control and code management. These requirements help ensure that only reviewed and approved code is merged into the main branch, maintaining the integrity and quality of the software throughout its development lifecycle. Why not B: Information security policy is a broader organizational policy that governs overall security practices. Why not C: Penetration testing methodology is part of security testing but not specifically tied to the SDLC phases.
  6. Cocopqr 👍 1 Answered D
    Software Development Life Cycle (SDLC) is a framework that defines the stages involved in developing software. It focuses on the technical aspects of software development, including requirements gathering, design, development, testing, and deployment. Branch protection requirements are directly related to the development process and ensure code quality and security. They typically involve rules for merging code, such as requiring code reviews and preventing direct pushes to the main branch
  7. a4e15bd 👍 1 Answered C
    The correct answer is C in this context. Pen Testing methodology could be part of the SDLC and directly relevant to the testing and security assurance phases of software development. D is incorrect because Branch Protection Requirements is more related to security measures around the physical or network infrastructure not software development.
  8. Ayokunle01 👍 1
    B. Information security policy An organization's Software Development Life Cycle (SDLC) typically includes information security policy to ensure that software development aligns with the organization's overall security posture. This policy outlines security requirements, standards, and guidelines for software development.
  9. Lavette 👍 1
    C. Penetration testing methodology is often part of the SDLC, especially in the testing phase, to identify vulnerabilities in the software before it goes live. While the other options are important in the broader organizational policies and security management, they are not typically a direct part of the SDLC process.
  10. Clau95 👍 1 Answered B
    The Software Development Life Cycle (SDLC) includes policies and procedures to ensure secure and efficient software development. An Information Security Policy is a crucial part of SDLC because it defines security requirements
  11. Murtuza 👍 1 Answered C
    option like penetration testing methodology would more closely align with SDLC than the overarching Information Security Policy
  12. e2ba0ff 👍 1 Answered C
    SDLC Includes secure coding practices, code reviews, and testing standards
  13. 17f9ef0 👍 2 Answered C
    Answer is C
  14. khank14 👍 1
    so many different answers
  15. Dayabaran 👍 1 Answered B
    ChatGPT & Copilot says

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide