Exam CISSP Topic 3 Question 1336 Discussion

Defense in depth is a security strategy that employs multiple layers of security controls and mechanisms to protect the system or network from various types of attacks. Defense in depth can be applied during the development phase of a software product by using security auditing as a technique to support the concept.
Security auditing is a process of reviewing and evaluating the security aspects of the software product, such as the design, code, functionality, performance, or compliance. Security auditing can help to identify and fix any security vulnerabilities or flaws in the software product, as well as to ensure that the software product meets the security requirements and standards of the organization and the stakeholders. Security auditing can be performed by internal or external auditors, using manual or automated tools, methods, or frameworks.
Maintenance hooks, polyinstantiation, or known vulnerability list are not used to support the concept of defense in depth during the development phase of a software product, as they are more related to maintenance, data security, or vulnerability management. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 21: Software Development Security, page 1180; CISSP Official (ISC)2 Practice Tests, Third Edition, Domain 8: Software Development Security, Question 8.9, page 304.