Describe the Benefits of Continuous Testing and Static Code Analysis in a CI Pipeline 350-901 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security team wants to prevent known vulnerable functions from being introduced into the codebase. They want a check that runs quickly on every commit without requiring a running application. What should they add to the CI pipeline?

   • AA static analysis rule that flags dangerous function calls
   • BA penetration test performed by an external team
   • CA dynamic application security testing (DAST) tool
   • DA runtime monitoring tool
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a primary benefit of continuous testing in a CI pipeline?

   • AIt guarantees that the application is free of all defects
   • BIt speeds up the compilation of code
   • CIt eliminates the need for code reviews
   • DIt detects bugs early in the development cycle
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A team is adopting continuous testing in their CI pipeline. They have a large legacy codebase with no existing tests. They want to start gaining benefits quickly while gradually increasing test coverage. Which approach is most pragmatic?

   • AOnly run static analysis and skip automated tests
   • BRequire 100% test coverage before enabling CI testing
   • CWrite tests for new features and critical bug fixes, and run them in CI, while gradually adding tests to legacy code
   • DRun all tests manually until the team writes enough automated tests
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is a key characteristic of static code analysis tools?

   • AThey require a running application to perform analysis
   • BThey only check code formatting and style
   • CThey execute the code to find runtime errors
   • DThey analyze source code without executing it
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In a CI pipeline, where is static code analysis typically performed?

   • AAfter deployment to production
   • BAs a separate manual step outside the pipeline
   • CAs an automated step in the pipeline, often before or alongside unit tests
   • DOnly when a security incident occurs
   Reveal Solution Discussion Select an answer first