Which activity is a core phase of a secure SDLC?

• A. Marketing planning
• B. Threat modeling
• C. Customer training
• D. Data migration

Answer: (B)

Threat modeling identifies potential security threats and attack paths early in the software development life cycle. By analyzing assets, actors, and how the system could be attacked, it helps teams design appropriate protections into the architecture and requirements, shifting security left to reduce risk and cost. Marketing planning, customer training, and data migration serve goals outside secure design—marketing focuses on product launches, customer training happens after deployment for usage, and data migration deals with moving data between environments—so they aren’t the activities that directly advance secure development.