Code Review Strategy ECDE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security team has identified several vulnerabilities in a web application. The vulnerabilities include a SQL injection in a public-facing login form, a cross-site scripting (XSS) issue in an internal admin panel, and a low-severity information disclosure in error messages. The application is about to be released. How should the team prioritize remediation?

   • AFix all three simultaneously in a single release.
   • BFix the XSS first because it affects the admin panel, then the SQL injection, and finally the information disclosure.
   • CFix the SQL injection first, then the XSS, and finally the information disclosure.
   • DFix the information disclosure first because it is quick, then the XSS, and finally the SQL injection.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security reviewer is conducting a threat model for a new feature that allows users to upload files. The feature will store files in a cloud storage service and provide download links. Which code path should be prioritized for review?

   • AThe file upload and validation logic, because it handles untrusted input.
   • BThe code that generates download links, because it may expose files.
   • CThe code that displays the file list to users.
   • DThe code that logs user activity.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A reviewer is using a secure code review checklist on a new file-upload feature. The code accepts user-supplied filenames and stores files on disk. Which checklist item is most directly relevant to preventing a path traversal vulnerability?

   • AVerify that the filename is sanitized and that the final storage path is validated to stay within the intended directory.
   • BConfirm that the file size is limited to prevent denial-of-service attacks.
   • CCheck that the upload endpoint uses HTTPS to protect data in transit.
   • DEnsure that the file content is scanned by an antivirus engine.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A DevSecOps team wants to improve accountability in their code review process. Currently, findings are discussed in chat and often forgotten. Which workflow change would most directly ensure that every finding is tracked to resolution?

   • ASend an email summary of findings to the team lead at the end of each sprint.
   • BCreate a ticket for each confirmed finding, assign an owner, and link it to the code review.
   • CRequire all developers to attend a weekly security meeting to discuss findings.
   • DAdd a comment in the code for each finding and hope developers fix it before release.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A team is about to review a new microservice that handles user profile updates. The threat model identifies that the service accepts JSON input and stores data in a database. Which code path should be prioritized for manual review?

   • AThe logging configuration, because log injection is a common issue.
   • BThe health check endpoint, because it is publicly accessible.
   • CThe startup configuration, because misconfigurations can weaken security.
   • DThe JSON deserialization and database query construction, because they are the main attack surface for injection and deserialization attacks.
   Reveal Solution Discussion Select an answer first