Which of the following should be of MOST concern to a risk practitioner reviewing the system development life cycle (SDLC)?

Phased testing with user testing as a final phase is a common and acceptable SDLC practice, allowing for incremental validation.

Temporarily overriding segregation of duties controls during specific, controlled user testing phases might be necessary for practical testing purposes, provided proper oversight and logging are in place, and is less of a concern than lack of user input itself.

Data anonymization in end-user testing is a good practice for privacy and data protection, reducing risk rather than being a concern.

If testing is solely performed by IT support users without input from end users, there is a high risk that the system will not meet the actual business requirements, contain functional errors, or have usability issues, leading to operational inefficiencies and potential security vulnerabilities that could have been identified by those who use the system daily.