Which activity demonstrates verification of secure coding practices in a software development program?

• A. Examine software development policies & procedures and interview responsible personnel to verify training and practices.
• B. Inspect only production logs.
• C. Rely solely on automated scan results.
• D. Review only change management records

Answer: (A)

The main idea tested is that verifying secure coding practices relies on evidence from both formal guidance and actual understanding and application by the people involved. This option does that by examining the software development policies and procedures and interviewing responsible personnel to verify training and practices. It shows that there are defined secure coding standards and that developers have received training and knowledge of how to apply them, which is what proper verification seeks to confirm.

In contrast, looking only at production logs doesn’t prove secure coding practices were followed in development or during coding; it shows runtime events, not prior behavior. Relying solely on automated scans captures known vulnerabilities but doesn’t verify training, procedures, or whether developers consistently apply secure coding practices. Reviewing only change management records highlights how changes are controlled, not whether secure coding standards were followed throughout development or whether staff were trained.