- In the context of the SDLC, what is the primary purpose of a 'feasibility study'?
Answer: To evaluate whether the proposed project is technically achievable, financially justified, and operationally viable before committing significant resources.
A feasibility study answers the fundamental question of whether a project should proceed - assessing technical feasibility, cost-benefit analysis, legal constraints, and operational fit. Answer D is correct. Requirements documentation (A) is Analysis. Architecture design (B) is Design. User training (C) is Implementation.
- A project's cost-benefit case is approved before requirements are documented. Which SDLC phase is this?
Answer: Project planning
The cost-benefit case is part of feasibility and project planning, deciding whether the project is worth doing before requirements are gathered. Systems analysis is where requirements are actually documented and user needs studied, so it comes after the planning phase's go/no-go decision.
- Only unit tests passed before production; business users never tested it. Which SDLC activity was bypassed?
Answer: Acceptance testing
Business users perform acceptance testing to confirm the system meets their needs. If they never tested it before production, that activity was bypassed. Implementation still occurred because the system reached production. The tempting wrong answer is system maintenance, but maintenance happens after release, not before user approval.
- Which of the following best describes the Agile SDLC approach compared to the traditional Waterfall approach?
Answer: Agile delivers working software in short iterative cycles with continuous feedback; Waterfall follows a sequential phase-by-phase approach with formal gates between phases.
Agile iterates rapidly with continuous customer feedback and adaptive planning; Waterfall follows a linear sequence with formal phase completion before moving forward. Answer B is correct. Agile embraces evolving requirements while Waterfall front-loads them (A). Both methodologies scale to different project types (C). Agile incorporates continuous testing (D).
- In agile SDLC methodology, work is organized into short iterations called 'sprints.' From a controls perspective, which of the following is most important to ensure in an agile environment?
Answer: Testing, code review, and security validation are embedded within each sprint rather than deferred to a final phase, maintaining control quality despite rapid delivery cycles.
In agile, controls must be continuous rather than phase-based - quality gates (testing, review, security) embedded in each sprint prevent defects and unauthorized code from accumulating across many rapid releases. Answer D is correct. Upfront complete requirements (A) describes waterfall. Full system per sprint (B) is not the agile model. External auditor sprint approval (C) is impractical.
- In the SDLC, 'integration testing' is performed to:
Answer: Verify that multiple components or modules work correctly together as an integrated system, including interfaces between the new system and connected applications.
Integration testing verifies component interactions - that data flows correctly between modules and that interfaces between systems work as designed. Answer D is correct. End user validation (A) is UAT. Isolated module testing (B) is unit testing. Performance under load (C) is performance/stress testing.
- User acceptance testing (UAT) is performed in which SDLC phase, and by whom?
Answer: Testing phase, performed by business users and end users to confirm the system meets business requirements before go-live.
UAT is the final testing phase conducted by business users to confirm from their perspective that the system does what they need before it is deployed to production. Answer A is correct. Design (B), Planning (C), and Maintenance (D) are different phases with different activities.
- During the 'Analysis' phase of the SDLC, the primary deliverable is:
Answer: A detailed requirements specification documenting what the system must do to meet business and user needs.
The Analysis phase produces the requirements specification - a comprehensive document defining what the system must do, who will use it, and what business problems it solves. Answer A is correct. A completed application (B) is the Development phase deliverable. Project plans (C) are produced in Planning. System architecture (D) is the Design phase deliverable.
- A new system runs in parallel with the old system for one month before cutover. Which SDLC phase is this?
Answer: Implementation phase
Running the new and old systems side by side is a parallel conversion strategy, which is part of putting the system into production. That is the work of the implementation phase. The tempting answer is system testing, but that phase verifies the software before you go live; the parallel run happens after you start using the new system.
- An emergency patch is released after go-live to fix a security flaw. Which SDLC phase covers this change?
Answer: Maintenance phase
After go-live, fixes and emergency patches fall under the maintenance phase, which covers all post-release changes. Implementation applies only to the initial build and deployment, not to later security updates. So the change is handled during maintenance.
- An auditor is evaluating controls over a system development project. Which of the following represents a key control during the 'Planning' phase?
Answer: A formal feasibility study and project charter approved by appropriate management, establishing scope, objectives, and authorization for the project.
Planning phase controls establish project authorization and feasibility - ensuring management approves the project, understands its scope, and commits resources before development begins. Answer A is correct. UAT sign-offs (B) and PIR (D) occur after implementation. Security architecture review (C) occurs in Design.
- Which of the following SDLC controls helps ensure that software changes do not introduce security vulnerabilities into production systems?
Answer: Incorporating security requirements in the Analysis phase, conducting security design reviews in Design, and performing security testing (including vulnerability scanning and penetration testing) before implementation.
Security must be embedded throughout the SDLC - from security requirements capture through secure design review and security testing - rather than bolted on at the end. Answer D is correct. Business approval of technical design (A), work-hour restrictions (B), and framework selection (C) don't specifically address security in the SDLC.
- Post-implementation review (PIR) occurs in which SDLC phase and serves what purpose?
Answer: Maintenance phase - to evaluate whether the system achieved its objectives, identify issues, and capture lessons learned to improve future projects.
The PIR occurs after go-live (beginning of Maintenance) to assess whether the system delivered its intended benefits, identify residual issues, and feed lessons learned into future SDLC projects. Answer C is correct. Test result review (A) is in Testing. Architecture validation (B) is in Design. Business case validation (D) is in Planning.
- Regression testing is performed when:
Answer: Changes or enhancements are made to an existing system to ensure previously working functions still operate correctly after the changes.
Regression testing verifies that new changes didn't break existing functionality - running previously validated test cases to confirm the system behaves as expected after modifications. Answer C is correct. User access testing (A) and UAT (D) have different purposes. Initial deployment (B) uses different test types.
- Which of the following represents a segregation of duties control in the SDLC?
Answer: Ensuring that the individuals who develop code are different from those who test, approve, and deploy it to production.
Segregation of duties in the SDLC separates development from testing, approval, and deployment - preventing any single individual from introducing and deploying unauthorized code without oversight. Answer C is correct. Version control (A), security testing (B), and change documentation (D) are important controls but not the segregation of duties principle.
- After requirements are approved, the team specifies database structures and screen layouts. Which phase is this?
Answer: Systems design
After requirements are approved, defining database structures and screen layouts is the design phase. This is where you translate requirements into a blueprint for builders. It isn't development, because development writes and implements the code; specifying structures and layouts happens before coding.
- The 'Maintenance' phase of the SDLC is significant from a controls perspective because:
Answer: Changes made to a production system during maintenance must go through the formal change management process to prevent unauthorized modifications.
Maintenance involves ongoing changes to production systems - each change must follow the change management process (authorization, testing, approval, deployment) to maintain control integrity. Answer C is correct. Initial user introduction (A) and security configuration (A) occur in Implementation. Requirements approval (B) is Analysis. Testing is always required (D).
- Which of the following activities is performed during the 'Development' (coding) phase of the SDLC?
Answer: Writing source code, unit testing, conducting code reviews, and using version control to manage code changes.
The Development phase involves writing code according to design specifications, conducting unit tests, peer code reviews, and managing code versions - the technical construction of the system. Answer A is correct. Requirements gathering (B) is Analysis. User training and cutover (C) are Implementation activities. Post-go-live monitoring (D) is Maintenance.
- The 'Implementation' phase of the SDLC is also referred to as deployment. Which of the following controls is most important during this phase?
Answer: A formal go/no-go decision gate with documented management authorization confirming that all testing is complete, data migration is validated, and the organization is ready for production.
A go/no-go decision gate ensures that production deployment only occurs after confirmed readiness across all dimensions - testing, migration, training, and management authorization. Answer A is correct. UI wireframes (B) are Design artifacts. Code compilation checks (C) occur in Development. Business case approval (D) is a Planning activity.
- A company is in the 'Analysis' phase of an SDLC project for a new revenue recognition system. Which of the following stakeholders should be most actively involved at this stage?
Answer: Business users, financial reporting staff, and subject matter experts who understand the revenue recognition requirements and business processes.
Analysis phase success depends on accurate requirements - which requires deep involvement from business users and SMEs who understand the processes and regulatory requirements the system must support. Answer A is correct. IT security (B), operations (C), and external auditors (D) have important roles later in the lifecycle but not in requirements gathering.
