CPA Quiz: Systems Development Life Cycle Sdlc Phases
20 questions · exam conditions
0:00
Systems Development Life Cycle Sdlc PhasesQuestion 1 of 20

A project's cost-benefit case is approved before requirements are documented. Which SDLC phase is this?

Systems analysis
Project planning
Systems design
System testing
← Back to quizzes

CPA Quiz

CPA Quiz: Systems Development Life Cycle Sdlc Phases

Practice Systems Development Life Cycle Sdlc Phases in CPA with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Systems Development Life Cycle Sdlc Phases, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

A project's cost-benefit case is approved before requirements are documented. Which SDLC phase is this?

  1. Systems analysis
  2. Project planning (correct answer)
  3. Systems design
  4. System testing
Explanation: The cost-benefit case is part of feasibility and project planning, deciding whether the project is worth doing before requirements are gathered. Systems analysis is where requirements are actually documented and user needs studied, so it comes after the planning phase's go/no-go decision.

Question 2

Only unit tests passed before production; business users never tested it. Which SDLC activity was bypassed?

  1. Implementation
  2. System maintenance
  3. Acceptance testing (correct answer)
  4. Project planning
Explanation: Business users perform acceptance testing to confirm the system meets their needs. If they never tested it before production, that activity was bypassed. Implementation still occurred because the system reached production. The tempting wrong answer is system maintenance, but maintenance happens after release, not before user approval.

Question 3

A new system runs in parallel with the old system for one month before cutover. Which SDLC phase is this?

  1. Implementation phase (correct answer)
  2. Maintenance phase
  3. System testing phase
  4. Systems design phase
Explanation: Running the new and old systems side by side is a parallel conversion strategy, which is part of putting the system into production. That is the work of the implementation phase. The tempting answer is system testing, but that phase verifies the software before you go live; the parallel run happens after you start using the new system.

Question 4

An emergency patch is released after go-live to fix a security flaw. Which SDLC phase covers this change?

  1. Implementation
  2. Systems design
  3. Maintenance phase (correct answer)
  4. Regression testing
Explanation: After go-live, fixes and emergency patches fall under the maintenance phase, which covers all post-release changes. Implementation applies only to the initial build and deployment, not to later security updates. So the change is handled during maintenance.

Question 5

After requirements are approved, the team specifies database structures and screen layouts. Which phase is this?

  1. Systems analysis
  2. Development
  3. System testing
  4. Systems design (correct answer)
Explanation: After requirements are approved, defining database structures and screen layouts is the design phase. This is where you translate requirements into a blueprint for builders. It isn't development, because development writes and implements the code; specifying structures and layouts happens before coding.

Question 6

Which of the following correctly lists the phases of the traditional Systems Development Life Cycle (SDLC) in the proper sequence?

  1. Design, Planning, Analysis, Testing, Implementation, Maintenance
  2. Implementation, Analysis, Design, Planning, Testing, Maintenance
  3. Planning, Analysis, Design, Development, Testing, Implementation, Maintenance (correct answer)
  4. Analysis, Planning, Testing, Design, Implementation, Maintenance
Explanation: The traditional SDLC phases in sequence are: Planning, Analysis (requirements), Design, Development (coding), Testing, Implementation (deployment), and Maintenance. Answer C is correct. Answers A, B, and D sequence the phases incorrectly.

Question 7

A financial services company uses a DevOps approach where development and operations work together and code changes are deployed multiple times per day through automated pipelines. From an ITGC perspective, the most critical control in this environment is:

  1. Ensuring all developers maintain their professional certifications annually.
  2. That the automated deployment pipeline enforces required approval gates, automated testing, and security scanning before any code reaches production - providing continuous control assurance at deployment speed. (correct answer)
  3. That all code changes are manually reviewed by the CISO before deployment.
  4. That deployments only occur during low-traffic periods to minimize user impact.
Explanation: In DevOps, traditional manual controls cannot keep pace with rapid deployments - controls must be automated and embedded in the pipeline, with required approvals, testing, and security scanning as non-bypassable gates. Answer B is correct. Certifications (A), manual CISO reviews (C), and deployment timing (D) don't address the continuous deployment control challenge.

Question 8

A company is implementing a new ERP system using a waterfall SDLC approach. The project is in the Design phase. The business sponsor requests adding significant new functionality that was not in the original requirements. The most appropriate action is:

  1. Immediately incorporate the new requirements into the design without formal review.
  2. Reject the request since requirements cannot change after the Analysis phase.
  3. Implement the new functionality in the next project after go-live.
  4. Submit the change through a formal change control process to assess impact on scope, cost, and timeline, and obtain management approval before proceeding. (correct answer)
Explanation: Scope changes during development require formal change control - assessing impact and obtaining management approval - to prevent uncontrolled scope creep that compromises quality, budget, and timelines. Answer D is correct. Informal incorporation (A) causes uncontrolled scope creep. Absolute rejection (B) ignores legitimate business needs. Deferral (C) may be appropriate but requires formal evaluation first.

Question 9

Which of the following represents a key difference between the 'Waterfall' and 'Agile' SDLC methodologies from a risk management perspective?

  1. Waterfall produces higher quality software than Agile in all circumstances.
  2. Agile eliminates all project risks through continuous customer engagement.
  3. Waterfall concentrates risk at the end (full system delivered at once after a long cycle); Agile distributes risk across shorter iterations where issues are identified earlier and course corrections are more frequent. (correct answer)
  4. Waterfall is less expensive than Agile for all project types.
Explanation: Waterfall's sequential approach means problems may not be discovered until late in the project (after significant investment), while Agile's iterative model surfaces issues earlier and allows continuous adjustment. Answer C is correct. Neither methodology is universally superior (A, D). Agile reduces but does not eliminate risk (B).

Question 10

During the 'Analysis' phase of the SDLC, the primary deliverable is:

  1. A detailed requirements specification documenting what the system must do to meet business and user needs. (correct answer)
  2. A completed and tested application ready for deployment.
  3. A high-level project plan identifying timelines, resources, and costs.
  4. The system architecture and technical design specifications.
Explanation: The Analysis phase produces the requirements specification - a comprehensive document defining what the system must do, who will use it, and what business problems it solves. Answer A is correct. A completed application (B) is the Development phase deliverable. Project plans (C) are produced in Planning. System architecture (D) is the Design phase deliverable.

Question 11

An auditor is evaluating controls over a system development project. Which of the following represents a key control during the 'Planning' phase?

  1. A formal feasibility study and project charter approved by appropriate management, establishing scope, objectives, and authorization for the project. (correct answer)
  2. Completed user acceptance testing sign-offs from all business stakeholders.
  3. Technical architecture documentation reviewed by the IT security team.
  4. Post-implementation review confirming the system met its business objectives.
Explanation: Planning phase controls establish project authorization and feasibility - ensuring management approves the project, understands its scope, and commits resources before development begins. Answer A is correct. UAT sign-offs (B) and PIR (D) occur after implementation. Security architecture review (C) occurs in Design.

Question 12

In the SDLC, the 'Design' phase translates requirements into:

  1. Source code written by developers according to functional specifications.
  2. User training materials and system documentation.
  3. Test cases and test scripts for validating system functionality.
  4. Technical blueprints specifying the system architecture, database design, interface layouts, and processing logic. (correct answer)
Explanation: The Design phase converts business requirements into technical specifications - database schemas, system architecture, interface designs, and processing logic - that guide the Development phase. Answer D is correct. Source code (A) is written in Development. Training materials (B) and test cases (C) are produced later.

Question 13

In agile SDLC methodology, work is organized into short iterations called 'sprints.' From a controls perspective, which of the following is most important to ensure in an agile environment?

  1. All requirements must be fully defined before any development begins.
  2. Each sprint must produce a complete, deployable system with all features.
  3. External auditors must review and approve each sprint before work begins.
  4. Testing, code review, and security validation are embedded within each sprint rather than deferred to a final phase, maintaining control quality despite rapid delivery cycles. (correct answer)
Explanation: In agile, controls must be continuous rather than phase-based - quality gates (testing, review, security) embedded in each sprint prevent defects and unauthorized code from accumulating across many rapid releases. Answer D is correct. Upfront complete requirements (A) describes waterfall. Full system per sprint (B) is not the agile model. External auditor sprint approval (C) is impractical.

Question 14

User acceptance testing (UAT) is performed in which SDLC phase, and by whom?

  1. Testing phase, performed by business users and end users to confirm the system meets business requirements before go-live. (correct answer)
  2. Design phase, performed by IT architects to confirm technical specifications.
  3. Planning phase, performed by project managers to assess feasibility.
  4. Maintenance phase, performed by IT operations to validate system stability.
Explanation: UAT is the final testing phase conducted by business users to confirm from their perspective that the system does what they need before it is deployed to production. Answer A is correct. Design (B), Planning (C), and Maintenance (D) are different phases with different activities.

Question 15

Which of the following represents a segregation of duties control in the SDLC?

  1. Requiring developers to use a version control system for all code changes.
  2. Conducting security testing before system deployment.
  3. Ensuring that the individuals who develop code are different from those who test, approve, and deploy it to production. (correct answer)
  4. Documenting all system changes in the change management system.
Explanation: Segregation of duties in the SDLC separates development from testing, approval, and deployment - preventing any single individual from introducing and deploying unauthorized code without oversight. Answer C is correct. Version control (A), security testing (B), and change documentation (D) are important controls but not the segregation of duties principle.

Question 16

Which of the following testing types is performed by developers to verify that individual code modules function correctly before integration?

  1. User acceptance testing (UAT)
  2. Unit testing (correct answer)
  3. Regression testing
  4. Integration testing
Explanation: Unit testing is performed by developers on individual code components in isolation - verifying that each module functions as designed before being combined with other modules. Answer B is correct. UAT (A) is performed by business users at system level. Regression testing (C) tests for unintended side effects of changes. Integration testing (D) tests how modules work together.

Question 17

The 'Implementation' phase of the SDLC is also referred to as deployment. Which of the following controls is most important during this phase?

  1. A formal go/no-go decision gate with documented management authorization confirming that all testing is complete, data migration is validated, and the organization is ready for production. (correct answer)
  2. Completion of user interface wireframes approved by the UX team.
  3. Developer code reviews confirming all modules compile without errors.
  4. Business case approval confirming the project is financially justified.
Explanation: A go/no-go decision gate ensures that production deployment only occurs after confirmed readiness across all dimensions - testing, migration, training, and management authorization. Answer A is correct. UI wireframes (B) are Design artifacts. Code compilation checks (C) occur in Development. Business case approval (D) is a Planning activity.

Question 18

Regression testing is performed when:

  1. New users are added to the system and need to test their access.
  2. A system is first developed and deployed to the production environment.
  3. Changes or enhancements are made to an existing system to ensure previously working functions still operate correctly after the changes. (correct answer)
  4. Business users perform UAT before system go-live.
Explanation: Regression testing verifies that new changes didn't break existing functionality - running previously validated test cases to confirm the system behaves as expected after modifications. Answer C is correct. User access testing (A) and UAT (D) have different purposes. Initial deployment (B) uses different test types.

Question 19

In the context of the SDLC, what is the primary purpose of a 'feasibility study'?

  1. To document the detailed functional requirements for the proposed system.
  2. To design the technical architecture and infrastructure for the new system.
  3. To train end users on the functionality of the new system.
  4. To evaluate whether the proposed project is technically achievable, financially justified, and operationally viable before committing significant resources. (correct answer)
Explanation: A feasibility study answers the fundamental question of whether a project should proceed - assessing technical feasibility, cost-benefit analysis, legal constraints, and operational fit. Answer D is correct. Requirements documentation (A) is Analysis. Architecture design (B) is Design. User training (C) is Implementation.

Question 20

A company is in the 'Analysis' phase of an SDLC project for a new revenue recognition system. Which of the following stakeholders should be most actively involved at this stage?

  1. Business users, financial reporting staff, and subject matter experts who understand the revenue recognition requirements and business processes. (correct answer)
  2. IT security staff who will configure the system's access controls.
  3. IT operations staff who will monitor the system after go-live.
  4. External auditors who will assess the system's financial reporting controls.
Explanation: Analysis phase success depends on accurate requirements - which requires deep involvement from business users and SMEs who understand the processes and regulatory requirements the system must support. Answer A is correct. IT security (B), operations (C), and external auditors (D) have important roles later in the lifecycle but not in requirements gathering.