CPA Isc Quiz: Systems Development Life Cycle Sdlc Phases

What this quiz covers

This quiz focuses on Systems Development Life Cycle Sdlc Phases, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA Isc.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

Question 1

1. Design, Planning, Analysis, Testing, Implementation, Maintenance
2. Implementation, Analysis, Design, Planning, Testing, Maintenance
3. Planning, Analysis, Design, Development, Testing, Implementation, Maintenance (correct answer)
4. Analysis, Planning, Testing, Design, Implementation, Maintenance

Explanation: The traditional SDLC phases in sequence are: Planning, Analysis (requirements), Design, Development (coding), Testing, Implementation (deployment), and Maintenance. Answer C is correct. Answers A, B, and D sequence the phases incorrectly.

Question 2

1. A detailed requirements specification documenting what the system must do to meet business and user needs. (correct answer)
2. A completed and tested application ready for deployment.
3. A high-level project plan identifying timelines, resources, and costs.
4. The system architecture and technical design specifications.

Explanation: The Analysis phase produces the requirements specification - a comprehensive document defining what the system must do, who will use it, and what business problems it solves. Answer A is correct. A completed application (B) is the Development phase deliverable. Project plans (C) are produced in Planning. System architecture (D) is the Design phase deliverable.

Question 3

1. A formal feasibility study and project charter approved by appropriate management, establishing scope, objectives, and authorization for the project. (correct answer)
2. Completed user acceptance testing sign-offs from all business stakeholders.
3. Technical architecture documentation reviewed by the IT security team.
4. Post-implementation review confirming the system met its business objectives.

Explanation: Planning phase controls establish project authorization and feasibility - ensuring management approves the project, understands its scope, and commits resources before development begins. Answer A is correct. UAT sign-offs (B) and PIR (D) occur after implementation. Security architecture review (C) occurs in Design.

Question 4

1. All requirements must be fully defined before any development begins.
2. Each sprint must produce a complete, deployable system with all features.
3. External auditors must review and approve each sprint before work begins.
4. Testing, code review, and security validation are embedded within each sprint rather than deferred to a final phase, maintaining control quality despite rapid delivery cycles. (correct answer)

Explanation: In agile, controls must be continuous rather than phase-based - quality gates (testing, review, security) embedded in each sprint prevent defects and unauthorized code from accumulating across many rapid releases. Answer D is correct. Upfront complete requirements (A) describes waterfall. Full system per sprint (B) is not the agile model. External auditor sprint approval (C) is impractical.

Question 5

1. Testing phase, performed by business users and end users to confirm the system meets business requirements before go-live. (correct answer)
2. Design phase, performed by IT architects to confirm technical specifications.
3. Planning phase, performed by project managers to assess feasibility.
4. Maintenance phase, performed by IT operations to validate system stability.

Explanation: UAT is the final testing phase conducted by business users to confirm from their perspective that the system does what they need before it is deployed to production. Answer A is correct. Design (B), Planning (C), and Maintenance (D) are different phases with different activities.

Question 6

1. Requiring developers to use a version control system for all code changes.
2. Conducting security testing before system deployment.
3. Ensuring that the individuals who develop code are different from those who test, approve, and deploy it to production. (correct answer)
4. Documenting all system changes in the change management system.

Explanation: Segregation of duties in the SDLC separates development from testing, approval, and deployment - preventing any single individual from introducing and deploying unauthorized code without oversight. Answer C is correct. Version control (A), security testing (B), and change documentation (D) are important controls but not the segregation of duties principle.

Question 7

1. User acceptance testing (UAT)
2. Unit testing (correct answer)
3. Regression testing
4. Integration testing

Explanation: Unit testing is performed by developers on individual code components in isolation - verifying that each module functions as designed before being combined with other modules. Answer B is correct. UAT (A) is performed by business users at system level. Regression testing (C) tests for unintended side effects of changes. Integration testing (D) tests how modules work together.

Question 8

1. A formal go/no-go decision gate with documented management authorization confirming that all testing is complete, data migration is validated, and the organization is ready for production. (correct answer)
2. Completion of user interface wireframes approved by the UX team.
3. Developer code reviews confirming all modules compile without errors.
4. Business case approval confirming the project is financially justified.

Explanation: A go/no-go decision gate ensures that production deployment only occurs after confirmed readiness across all dimensions - testing, migration, training, and management authorization. Answer A is correct. UI wireframes (B) are Design artifacts. Code compilation checks (C) occur in Development. Business case approval (D) is a Planning activity.

Question 9

1. New users are added to the system and need to test their access.
2. A system is first developed and deployed to the production environment.
3. Changes or enhancements are made to an existing system to ensure previously working functions still operate correctly after the changes. (correct answer)
4. Business users perform UAT before system go-live.

Explanation: Regression testing verifies that new changes didn't break existing functionality - running previously validated test cases to confirm the system behaves as expected after modifications. Answer C is correct. User access testing (A) and UAT (D) have different purposes. Initial deployment (B) uses different test types.

Question 10

1. To document the detailed functional requirements for the proposed system.
2. To design the technical architecture and infrastructure for the new system.
3. To train end users on the functionality of the new system.
4. To evaluate whether the proposed project is technically achievable, financially justified, and operationally viable before committing significant resources. (correct answer)

Explanation: A feasibility study answers the fundamental question of whether a project should proceed - assessing technical feasibility, cost-benefit analysis, legal constraints, and operational fit. Answer D is correct. Requirements documentation (A) is Analysis. Architecture design (B) is Design. User training (C) is Implementation.

Question 11

1. Business users, financial reporting staff, and subject matter experts who understand the revenue recognition requirements and business processes. (correct answer)
2. IT security staff who will configure the system's access controls.
3. IT operations staff who will monitor the system after go-live.
4. External auditors who will assess the system's financial reporting controls.

Explanation: Analysis phase success depends on accurate requirements - which requires deep involvement from business users and SMEs who understand the processes and regulatory requirements the system must support. Answer A is correct. IT security (B), operations (C), and external auditors (D) have important roles later in the lifecycle but not in requirements gathering.

Question 12

1. Planning, because this is where project risks are first identified.
2. Analysis, because requirements drive the design of financial controls.
3. Testing and Implementation, because these phases require evidence of adequate testing and authorized deployment - key program change ITGC requirements. (correct answer)
4. Maintenance, because this is where ongoing system operations are managed.

Explanation: ITGC program change controls focus on the Testing and Implementation phases - requiring evidence that changes were adequately tested before deployment and that deployment was authorized. Answer C is correct. Planning (A), Analysis (B), and Maintenance (D) are all relevant but testing and authorized deployment are the core ITGC focus.

Question 13

1. Writing source code, unit testing, conducting code reviews, and using version control to manage code changes. (correct answer)
2. Gathering and documenting business requirements from stakeholders.
3. Training end users and preparing for system cutover.
4. Monitoring system performance and addressing post-go-live issues.

Explanation: The Development phase involves writing code according to design specifications, conducting unit tests, peer code reviews, and managing code versions - the technical construction of the system. Answer A is correct. Requirements gathering (B) is Analysis. User training and cutover (C) are Implementation activities. Post-go-live monitoring (D) is Maintenance.

Question 14

1. Requiring business users to approve all technical design decisions.
2. Scheduling all development work during business hours only.
3. Using an open-source development framework for all applications.
4. Incorporating security requirements in the Analysis phase, conducting security design reviews in Design, and performing security testing (including vulnerability scanning and penetration testing) before implementation. (correct answer)

Explanation: Security must be embedded throughout the SDLC - from security requirements capture through secure design review and security testing - rather than bolted on at the end. Answer D is correct. Business approval of technical design (A), work-hour restrictions (B), and framework selection (C) don't specifically address security in the SDLC.

Question 15

1. Ensuring all developers maintain their professional certifications annually.
2. That the automated deployment pipeline enforces required approval gates, automated testing, and security scanning before any code reaches production - providing continuous control assurance at deployment speed. (correct answer)
3. That all code changes are manually reviewed by the CISO before deployment.
4. That deployments only occur during low-traffic periods to minimize user impact.

Explanation: In DevOps, traditional manual controls cannot keep pace with rapid deployments - controls must be automated and embedded in the pipeline, with required approvals, testing, and security scanning as non-bypassable gates. Answer B is correct. Certifications (A), manual CISO reviews (C), and deployment timing (D) don't address the continuous deployment control challenge.

Question 16

1. Source code written by developers according to functional specifications.
2. User training materials and system documentation.
3. Test cases and test scripts for validating system functionality.
4. Technical blueprints specifying the system architecture, database design, interface layouts, and processing logic. (correct answer)

Explanation: The Design phase converts business requirements into technical specifications - database schemas, system architecture, interface designs, and processing logic - that guide the Development phase. Answer D is correct. Source code (A) is written in Development. Training materials (B) and test cases (C) are produced later.

Question 17

1. Verify that end users can effectively use the system to perform their job functions.
2. Test individual code modules in isolation before combining them.
3. Ensure the system meets performance requirements under expected load conditions.
4. Verify that multiple components or modules work correctly together as an integrated system, including interfaces between the new system and connected applications. (correct answer)

Explanation: Integration testing verifies component interactions - that data flows correctly between modules and that interfaces between systems work as designed. Answer D is correct. End user validation (A) is UAT. Isolated module testing (B) is unit testing. Performance under load (C) is performance/stress testing.

Question 18

1. Immediately incorporate the new requirements into the design without formal review.
2. Reject the request since requirements cannot change after the Analysis phase.
3. Implement the new functionality in the next project after go-live.
4. Submit the change through a formal change control process to assess impact on scope, cost, and timeline, and obtain management approval before proceeding. (correct answer)

Explanation: Scope changes during development require formal change control - assessing impact and obtaining management approval - to prevent uncontrolled scope creep that compromises quality, budget, and timelines. Answer D is correct. Informal incorporation (A) causes uncontrolled scope creep. Absolute rejection (B) ignores legitimate business needs. Deferral (C) may be appropriate but requires formal evaluation first.

Question 19

1. IT developers will spend more time coding since they have to figure out requirements themselves.
2. Without documented requirements and design specifications, there is no agreed baseline for testing, no evidence of management authorization, and no traceability between business needs and system functionality - creating high risk of defects, scope disputes, and audit gaps. (correct answer)
3. The project manager will have difficulty tracking progress.
4. End users will need more training to use the system.

Explanation: Skipping documentation removes the foundation for quality assurance and governance - testing without requirements, no authorization evidence, and no baseline for auditors or stakeholders to verify the system does what was intended. Answer B is correct. Developer efficiency (A), project tracking (C), and training needs (D) are secondary concerns.

Question 20

1. Agile requires complete requirements before any development begins; Waterfall allows requirements to evolve.
2. Agile delivers working software in short iterative cycles with continuous feedback; Waterfall follows a sequential phase-by-phase approach with formal gates between phases. (correct answer)
3. Agile is used only for small projects; Waterfall is used for enterprise-scale implementations.
4. Agile eliminates the need for testing; Waterfall requires extensive testing at each phase.

Explanation: Agile iterates rapidly with continuous customer feedback and adaptive planning; Waterfall follows a linear sequence with formal phase completion before moving forward. Answer B is correct. Agile embraces evolving requirements while Waterfall front-loads them (A). Both methodologies scale to different project types (C). Agile incorporates continuous testing (D).