Code Review Strategy ECDE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security review of a critical application finds two issues: a cross-site scripting (XSS) vulnerability in a public-facing search page and a server-side request forgery (SSRF) in an internal admin tool. The SSRF is only accessible to authenticated admins. Which finding should be prioritized?

   • ABoth equally, because both are high severity.
   • BThe XSS, because it is in a public-facing page and can affect all users, making it more broadly exploitable.
   • CThe SSRF, because it can lead to internal network compromise.
   • DNeither, because both are in non-critical paths.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A DevSecOps team is establishing a collaborative review workflow. They want to ensure that findings are not only fixed but also that the process improves over time. Which practice is most important to include?

   • AUse a checklist that never changes.
   • BAssign the most senior developer to review all code.
   • CConduct a retrospective at the end of each sprint to discuss what went well and what can be improved in the review process.
   • DTrack only the number of findings, not the types.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A team wants to ensure that code review findings are not ignored. They are using a SAST tool that integrates with their version control system. What is the best way to ensure accountability?

   • AAutomatically close all findings after 30 days.
   • BRequire that all SAST findings be resolved or explicitly waived by a security lead before merge.
   • CAllow developers to dismiss findings without any review.
   • DOnly report findings to the security team after the release.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A team integrates SAST into their CI/CD pipeline. Developers complain that the build fails on many low-severity findings, slowing delivery. The security team wants to keep the gate. Which configuration best balances security and developer velocity?

   • AFail the build only on critical- and high-severity findings; report medium and low as warnings in the pipeline output.
   • BDisable SAST for the main branch and run it only on feature branches.
   • CFail the build on all findings regardless of severity to enforce a strict security posture.
   • DRun SAST only on a nightly schedule and never block the build.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team wants to measure the effectiveness of their code review process. They want to track whether security findings are being caught early and whether the process is improving over time. Which metric is most useful for this purpose?

   • AThe number of security findings detected during code review per release.
   • BThe total number of lines of code reviewed per day.
   • CThe number of developers on the review team.
   • DThe time taken to complete a code review.
   Reveal Solution Discussion Select an answer first