The Software Development Lifecycle (SDLC) is a conceptual framework that outlines all the tasks and activities involved in the planning, creation, testing, deployment, and maintenance of a software system. Option B provides the most accurate and comprehensive list of these high-level phases in their logical order. It covers the entire lifespan of the software from its initial conception (Planning, Requirements), through its development and release (Design, Implementation, Testing, Deployment), to its operational life (Maintenance) and eventual decommissioning (End of Life). This "cradle-to-grave" model is a standard representation of the complete software lifecycle.

A. This option incorrectly elevates specific security activities ("security analysis," "threat mitigation") to the level of primary SDLC phases, whereas they are tasks integrated within the standard phases.

C. This option incorrectly mixes high-level phases (Plan, Design) with granular, specific tasks ("identify attack surface," "perform code reviews") that are part of those larger phases.

D. This option incorrectly lists specific techniques ("prototype," "threat modeling") and a sub-type of testing ("user acceptance testing") as distinct, top-level phases of the SDLC.

---

1. National Institute of Standards and Technology (NIST) Special Publication 800-64 Rev. 2, Security Considerations in the System Development Life Cycle. Section 2.1, "The System Development Life Cycle," outlines a five-phase model: Initiation, Development/Acquisition, Implementation/Assessment, Operations/Maintenance, and Disposal. These phases directly correspond to the concepts in the correct answer: Planning (Initiation), Requirements/Design/Implementation (Development), Testing/Deployment (Implementation/Assessment), Maintenance (Operations/Maintenance), and End of Life (Disposal).

2. ISO/IEC/IEEE 12207:2017, Systems and software engineering — Software life cycle processes. This international standard defines a comprehensive set of processes for the software lifecycle. Clause 6.4, "Technical Processes," details processes that align with the phases in option B, including System Requirements Definition, Architectural Design, Software Implementation, Testing, Operation, Maintenance, and the Disposal process (Clause 6.4.14), which corresponds to "End of Life."

3. Purdue University, College of Engineering, Systems Engineering - The System Development Life Cycle. The courseware describes the SDLC phases as: 1. Preliminary Investigation (Planning), 2. System Analysis (Requirements), 3. System Design (Design), 4. System Development (Implementation), 5. System Testing (Testing), 6. System Implementation (Deployment), and 7. System Maintenance (Maintenance). This widely accepted academic model strongly supports the sequence presented in option B.