Which Topic Belongs in an Organization's SDLC?

SY0-701 By islever Editorial Last updated

Given a scenario, apply common security techniques to computing resources.

Short answer

D Branch protection requirements are the SDLC topic because they enforce reviewed, tested code merges during development, unlike SLAs, infosec policy, or penetration testing methodology.

Question

Which of the following topics would most likely be included within an organization's SDLC?
  1. Service-level agreements
  2. Information security policy
  3. Penetration testing methodology
  4. Branch protection requirements Correct Answer

Key Takeaways

It tests whether you can separate SDLC-level software development controls from enterprise governance and standalone security assessments; the trap is choosing penetration testing because it sounds security-related.

This SY0-701 question asks which topic most likely belongs within an organization's SDLC. The answer is D: branch protection requirements, because they govern code review and merge controls during software development.

Common mistake: The most tempting wrong answer is C, penetration testing methodology, because it is security-related, but penetration testing is an assessment activity often performed outside the normal development workflow, whereas branch protection is embedded in code review and merge control.

Expert Analysis

Where the SDLC actually operates The SDLC is the structured process an organization uses to move software from requirements and design through development, testing, deployment, and maintenance. A topic belongs inside the SDLC when it defines or gates one of those phases, especially the software development and change-control workflow. Broad governance documents and standalone security assessments may influence the SDLC, but they are not lifecycle topics themselves.

Tracing a code change through the pipeline Consider a developer creating a feature branch, committing code, and opening a pull request. Branch protection requirements are the controls applied at that exact step: they can require peer review, require automated status checks to pass, block force pushes, and prevent direct commits to the main branch. That is a concrete SDLC control embedded in the development and review path, ensuring code is reviewed and tested before merge. The discussion repeatedly returns to this point: branch protection governs how code changes enter the shared repository during development, which is squarely within the SDLC.

Why the alternatives sit outside the lifecycle Option A, service-level agreements, belongs to service management and vendor/third-party relationships. Option B, an information security policy, is enterprise-wide governance that may mandate an SDLC but is not itself an SDLC topic. Option C, penetration testing methodology, is a security assessment activity often performed after development or as a separate engagement; it can support SDLC testing, but it is not the development workflow gate. Comments favoring penetration testing treat it as part of the testing phase, but that reasoning stretches a specialized assessment into the whole lifecycle.

Verdict Option D, branch protection requirements, is the most likely topic included within an organization's SDLC because it directly enforces reviewed, tested, and controlled code merges during software development.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question asks what belongs inside the SDLC, map each option to a lifecycle phase or gate: requirements, design, code/commit, review, test, deploy, maintain. Eliminate options that are enterprise governance, vendor contracts, or standalone assessments unless the stem explicitly ties them to a phase. Prefer concrete development-workflow controls such as branch protection, code review, and automated status checks over broad policies.

Frequently Asked Questions

Why is branch protection considered part of the SDLC?

Branch protection is a version-control gate during development that can require reviews and passing status checks before code is merged. That directly enforces SDLC quality and security controls in the code review and integration workflow.

Why isn't penetration testing methodology the SDLC answer?

Penetration testing is a security assessment often performed after development or as a separate engagement. It can support SDLC testing, but it is not the embedded development workflow control that branch protection provides.

How does an information security policy differ from the SDLC?

An information security policy is enterprise-wide governance that may require secure development practices. The SDLC is the structured process for building, testing, deploying, and maintaining software, so the policy sits above it rather than inside it.

More SY0-701 FAQ →

Discussion 30 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30

  1. Cee007 👍 12 Answered D
    D. Branch protection requirements Branch protection requirements are related to the version control and development process within the SDLC, ensuring that code changes are reviewed, tested, and approved before being merged into main branches. This helps maintain code quality and security throughout the development process. Penetration testing is usually conducted as part of the testing phase or after deployment to identify vulnerabilities and security weaknesses. It is a separate process from the core stages of the SDLC but is an important aspect of ensuring the security and robustness of the application once development is completed.
  2. 9149f41 👍 8 Answered C
    Branch protection is not directly part of SDLC. However, the penetration test is. 1. Planning 2. Analysis 3. Design; 4. Implementation 5. Testing ( various testing, e.g. Penetration testing) 6. Deployment 7. Maintenance.
  3. cri88 👍 4 Answered B
    B. Information security policy An Information security policy is often included within an organization's Software Development Life Cycle (SDLC) because security considerations are critical during the design, development, and deployment phases of software development. The SDLC aims to integrate security measures throughout the process to protect against vulnerabilities and ensure compliance with security standards. Service-level agreements (A) are more related to contracts and service performance rather than the SDLC. Penetration testing methodology (C) is typically used for post-development testing, not a core part of the SDLC. Branch protection requirements (D) relate to source code management and version control, but they are not commonly included as a core topic of the SDLC. Thus, Information security policy aligns most closely with the SDLC's focus on incorporating security best practices throughout the software development process.
  4. Layrhian01 👍 3 Answered C
    Chat gpt says The topic that would most likely be included within an organization's Software Development Life Cycle (SDLC) is: C. Penetration testing methodology Explanation: Penetration testing methodology is directly relevant to the SDLC as it pertains to the security assessment of applications developed during the software lifecycle. It involves evaluating the security of the application through simulated attacks after the development and before deployment, ensuring that security is integrated into the development process. While service-level agreements, information security policies, and branch protection requirements are also important in the broader context of IT governance and security, they are not specifically part of the SDLC itself. The SDLC focuses on processes related to software development, including design, implementation, testing (which includes penetration testing), and maintenance.
  5. CYS_7710 👍 3 Answered B
    The Software Development Life Cycle (SDLC) defines how software is planned, designed, developed, tested, deployed, and maintained. Security requirements must be embedded from the beginning, and those requirements come directly from the organization’s information security policy.
Show 25 more comments
  1. fmeox567 👍 2 Answered C
    C. Penetration testing methodology Here's why: The SDLC is a framework that outlines the process for developing, deploying, and maintaining systems or applications. It typically includes phases such as planning, requirements gathering, design, development, testing, deployment, and maintenance. Penetration testing methodology is directly tied to the testing and security assurance phases of the SDLC. Organizations often incorporate security assessments, such as penetration testing, into the development process to identify and mitigate vulnerabilities before deployment. GPT
  2. dron_nuahs 👍 2 Answered B
    B. Information security policy InfoSec policies are foundational to the SDLC because they set the security requirements that must be followed during development. Without these policies, the SDLC cannot ensure security standards are met.
  3. dhewa 👍 2 Answered B
    This is because an information security policy outlines the guidelines and practices for protecting sensitive data throughout the development process.
  4. Dayabaran 👍 2 Answered B
    ChatGPT & Copilot says
  5. koala_lay 👍 2
    Agree to answer D.
  6. 17f9ef0 👍 2 Answered C
    Answer is C
  7. Konversation 👍 1 Answered D
    The CompTIA Sec+ Student Guide defines SDLC as: "SDLC policies govern software development within an organization. These policies provide a structured plan detailing the stages of development from initial requirement analysis to maintenance after deployment. It ensures that all software produced meets the organization’s efficiency, reliability, and security standards." Based on this definition, the answer "D" fits best. A: the SLA is related to a third party B: the InfoSec Policy is a high-level policy. It can contain SDLC requirements, but does not provide detailed standard requirements. C: Penetration testing method defined by CompTIA is more holistic view and not app-coding. Especially, there are some questions, where it is about how to secure own code and the answer is "peer reviews" and not pen-testing. D: I know SDLC as part of policies/guidelines for End-User-Computing (EUC) or individual data processing (IDP) and they contain protection requirements and standards derived from a BIA or a PNA. Best of luck with your exam.
  8. jbmac 👍 1 Answered D
    The correct answer is: D. Branch protection requirements Explanation: The Software Development Life Cycle (SDLC) refers to the structured process for planning, creating, testing, and deploying software applications. Among the provided options, branch protection requirements would most likely be included in the SDLC as part of the version control process to ensure that changes to the codebase are reviewed, tested, and securely merged. Branch protection ensures that only authorized and verified code can be merged into critical branches (like the main or master branch), which helps maintain the security, quality, and stability of the software. It often involves using code reviews, automated testing, and other safeguards to protect the integrity of the development process.
  9. Empath 👍 1 Answered C
    The System Development Life Cycle (SDLC) defines how systems are planned, developed, tested, deployed, and maintained. Security must be built into this process (“secure SDLC”), which usually includes: •Security requirements gathering •Secure design practices •Code reviews and static analysis •Security testing (including penetration testing, dynamic analysis, etc.) •Deployment and maintenance with ongoing monitoring Branch protection requirements is more about version control/repository management, not core SDLC phases. Penetration testing methodology is most likely included in the SDLC.
  10. laternak26 👍 1 Answered D
    Branch protection requirements are typically part of the Software Development Life Cycle (SDLC), specifically in the phase where code is managed and controlled. These requirements ensure that the code in version control systems (like Git) is protected from unauthorized or accidental changes. For example, branch protection can enforce rules such as requiring code reviews, preventing direct pushes to the main branch, or ensuring all tests pass before code is merged. These practices help maintain the quality and security of the codebase throughout the development lifecycle.
  11. Philco 👍 1 Answered D
    The Software Development Lifecycle (SDLC) focuses explicitly on the phases involved in developing, testing, deploying, and maintaining software applications. Branch protection requirements (such as requiring peer reviews/pull requests, passing automated status checks, and preventing forced pushes) are security controls applied directly to the source code repositories during the development process. They ensure that only authorized, reviewed, and secure code is merged into production, making them a fundamental component of a secure SDLC (often referred to as DevSecOps).
  12. User92 👍 1 Answered D
    Branch protection requirements are directly related to the software development process, particularly in version control and code management. These requirements help ensure that only reviewed and approved code is merged into the main branch, maintaining the integrity and quality of the software throughout its development lifecycle. Why not B: Information security policy is a broader organizational policy that governs overall security practices. Why not C: Penetration testing methodology is part of security testing but not specifically tied to the SDLC phases.
  13. Cocopqr 👍 1 Answered D
    Software Development Life Cycle (SDLC) is a framework that defines the stages involved in developing software. It focuses on the technical aspects of software development, including requirements gathering, design, development, testing, and deployment. Branch protection requirements are directly related to the development process and ensure code quality and security. They typically involve rules for merging code, such as requiring code reviews and preventing direct pushes to the main branch
  14. a4e15bd 👍 1 Answered C
    The correct answer is C in this context. Pen Testing methodology could be part of the SDLC and directly relevant to the testing and security assurance phases of software development. D is incorrect because Branch Protection Requirements is more related to security measures around the physical or network infrastructure not software development.
  15. Ayokunle01 👍 1
    B. Information security policy An organization's Software Development Life Cycle (SDLC) typically includes information security policy to ensure that software development aligns with the organization's overall security posture. This policy outlines security requirements, standards, and guidelines for software development.
  16. Lavette 👍 1
    C. Penetration testing methodology is often part of the SDLC, especially in the testing phase, to identify vulnerabilities in the software before it goes live. While the other options are important in the broader organizational policies and security management, they are not typically a direct part of the SDLC process.
  17. trac0420 👍 1 Answered D
    Branch protection requirements (such as requiring peer code reviews, approval workflows, and passing automated tests before code can be merged into a main or production branch) are core security controls directly embedded within the code management phase of the Software Development Life Cycle (SDLC).
  18. Clau95 👍 1 Answered B
    The Software Development Life Cycle (SDLC) includes policies and procedures to ensure secure and efficient software development. An Information Security Policy is a crucial part of SDLC because it defines security requirements
  19. 400b492 👍 1 Answered C
    Answer is C: Penetration testing methodology Part of the SDLC testing phase allows you to: identify vulnerabilities test application security used before production deployment
  20. Murtuza 👍 1 Answered C
    option like penetration testing methodology would more closely align with SDLC than the overarching Information Security Policy
  21. sno_opy 👍 1 Answered D
    D. Branch protection requirements This was in my exam and no options related to letter C "penetration testing method"
  22. Sam_sgv 👍 1 Answered D
    Branch protection requirements are directly related to secure software development.
  23. e2ba0ff 👍 1 Answered C
    SDLC Includes secure coding practices, code reviews, and testing standards
  24. khank14 👍 1
    so many different answers
  25. 2491527 👍 1 Answered B
    Chat GPT

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide