Describe the Benefits of Continuous Testing and Static Code Analysis in a CI Pipeline 350-901 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A team is experiencing flaky tests in their CI pipeline. These tests sometimes fail due to timing issues, causing the pipeline to fail and blocking merges. The team wants to maintain confidence in the pipeline while reducing false failures. What is the best approach?

   • ADisable all tests that are flaky
   • BIgnore test failures and allow merges regardless
   • CIdentify and fix the root cause of flakiness, and temporarily quarantine flaky tests
   • DIncrease the test timeout to reduce flakiness
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A team wants to enforce coding standards and detect security vulnerabilities without executing the code. Which tool should they integrate into their CI pipeline?

   • AA unit testing framework
   • BA container scanning tool
   • CA performance testing tool
   • DA static code analysis tool
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   How does static code analysis help in detecting vulnerabilities?

   • ABy monitoring network traffic for malicious activity
   • BBy simulating attacks on a running application
   • CBy analyzing user behavior to detect anomalies
   • DBy scanning code for known insecure patterns and dangerous functions
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which type of issue can static code analysis tools identify?

   • APerformance bottlenecks caused by network latency
   • BSecurity vulnerabilities such as SQL injection or insecure function usage
   • CAuthentication failures due to incorrect user credentials
   • DMemory leaks that only occur under high load
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A team is integrating static code analysis into their CI pipeline. They are concerned about false positives that could block legitimate code changes. They want to maintain high security standards while avoiding developer frustration. What is the best approach?

   • ARun static analysis only on a nightly basis and do not fail the build
   • BFail the build on any static analysis finding, regardless of severity
   • CConfigure the static analysis tool to fail the build only on high-severity issues, and report lower-severity issues as warnings
   • DDisable all static analysis rules to avoid false positives
   Reveal Solution Discussion Select an answer first