Whizlabs is designing the CI/CD pipeline for the new project. They want to include several test steps in their pipeline. They created the following list of proposed tests: 
a.Unit testing 
b.Load and Performance testing 
c.Threat Modeling 
d.Active Pen Testing 
e.Integration Testing 
f.Static Code Analysis 
Could you select the right sequence of tests from the point of the Software Development and DevOps pipeline workflow?

Answer options:

A.Static Code -> Unit -> Load/Performance -> Pen -> Threat -> Integration
B.Unit -> Static Code -> -> Integration -> Load/Performance -> Pen -> Threat
C.Threat -> Static Code -> Unit -> Integration -> Load/Performance -> Pen
D.Static Code -> Threat -> Unit -> Load/Performance -> Pen -> Integration
E.Threat -> Static Code -> Unit -> Load/Performance -> Integration -> Pen

Correct Answers:C 
Threat -> Static Code -> Unit -> Integration -> Load/Performance -> Pen 
Understanding the flow of these events within Software Development Lifecycle is an essential foundation for Secure DevOps. 
Threat Modeling is the most fundamental security and risk analysis testing step during the software design. It defines security requirements, identifies and mitigates threats. It validates that threats have been mitigated. 
Static Code Analysis must be present in the different forms starting from the tools within development IDE to various scanners during a pull request and build process. 
Unit testing must be the required step of any CI pipeline. 
Integration testing is required to verify that multiple components are working in combination according to the requirements. 
Load and Performance testing is necessary during development and/or QA deployments in CD part of the CI/CD pipeline. 
Active Pen Testing is a "must-have" step to test application dynamically for any vulnerabilities using different penetration techniques. 

For more information about Testing Strategies, please visit the below URLs- 

https://www.microsoft.com/en-us/securityengineering/sdl/threatmodeling
https://docs.microsoft.com/en-us/azure/devops/migrate/security-validation-cicd-pipeline?view=azure-devops
https://www.microsoft.com/en-us/securityengineering/devsecops