Code Review Strategy ECDE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A team is introducing code review into their DevSecOps pipeline. They want to catch issues as early as possible while minimizing disruption. At which point should they first require a security-focused code review?

   • AAfter the code is deployed to production, to avoid delaying releases.
   • BDuring the annual security audit, to consolidate all reviews.
   • COnly when a security incident occurs, to focus effort on real problems.
   • DBefore the code is merged into the main branch, as part of the pull request process.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   How does threat modeling contribute to a code review strategy?

   • AIt identifies potential attack vectors and helps reviewers focus on security-critical code paths
   • BIt automatically fixes all vulnerabilities found during review
   • CIt replaces the need for manual code review entirely
   • DIt ensures that code is written in a specific programming language
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security team is reviewing SAST results and finds that the tool has a high false-positive rate on a particular rule. Developers are ignoring all findings from that rule. What is the best course of action?

   • AKeep the rule enabled but require manual triage of every finding.
   • BAnalyze the false positives to identify patterns, then adjust the rule's configuration or add suppressions for verified benign cases.
   • CDisable the rule entirely to reduce noise and improve developer trust.
   • DReplace the SAST tool with a different one that has fewer false positives.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A reviewer is using a secure code review checklist on a new feature that allows users to reset passwords. Which checklist item is most critical to verify to prevent account takeover?

   • AThe reset email is sent from a no-reply address.
   • BThe reset page is served over HTTP for compatibility.
   • CThe reset token is cryptographically random, expires quickly, and is invalidated after use.
   • DThe reset page uses a CAPTCHA to prevent automated attacks.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A development team has integrated a SAST tool into their CI pipeline. The tool flags a large number of potential SQL injection vulnerabilities, but the security team suspects many are false positives because the code uses parameterized queries. What is the most effective way to handle this situation?

   • AIncrease the severity threshold so only critical findings are reported.
   • BHave a security engineer manually review each flagged finding and mark confirmed false positives in the SAST tool.
   • CAutomatically dismiss all findings from files that use parameterized queries.
   • DDisable the SAST rule for SQL injection to reduce noise.
   Reveal Solution Discussion Select an answer first