Code Review Strategy ECDE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A team is reviewing a large legacy codebase that has never been security-reviewed. They have limited time and must prioritize. Which approach is most effective?

   • ASkip the review because the code has been running for years without issues.
   • BManually review every line of code in the codebase.
   • CRun SAST and fix all findings regardless of severity.
   • DRun SAST on the entire codebase and manually review only the highest-risk findings in the most critical components.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A DevSecOps team runs SAST on a legacy payment application. The scanner flags a SQL injection in a rarely used admin report and a hardcoded API key in a widely used customer-facing module. The team has limited remediation capacity this sprint. Which approach best aligns with risk-based prioritization?

   • ASuppress both findings as false positives because the code is legacy and has been running for years without incident.
   • BFix the SQL injection first because injection is a higher-severity vulnerability class than hardcoded credentials.
   • CFix both in the same sprint because all SAST findings must be remediated before the next release.
   • DFix the hardcoded API key first because it is in a widely used customer-facing module and is directly exploitable by anyone with access to the code or binary.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security team has a limited budget for fixing vulnerabilities. They have identified a remote code execution (RCE) vulnerability in an internal tool, a cross-site request forgery (CSRF) issue in a public-facing web form, and a low-severity information disclosure in a public API. Which vulnerability should be fixed first?

   • AThe CSRF issue in the public-facing web form, because it affects external users.
   • BAll three at the same time, because they are all security vulnerabilities.
   • CThe information disclosure in the public API, because it is exposed to the internet.
   • DThe RCE vulnerability in the internal tool, because it allows an attacker to execute arbitrary code.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security team has identified a vulnerability in a public-facing web application that allows an attacker to access other users' data by manipulating a request parameter. The vulnerability is in a function that is used by multiple features. The team has limited time to fix it. What should they do?

   • ADisable the affected features temporarily.
   • BFix the vulnerability in the shared function immediately, because it affects multiple features.
   • CFix only the most critical feature that uses the function.
   • DAdd a firewall rule to block the attack.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A SAST tool reports a potential command injection in a function that builds a shell command from user input. A developer claims it is a false positive because the input is validated earlier. What is the most appropriate next step?

   • ASuppress the finding immediately to avoid blocking the pipeline.
   • BAsk the SAST vendor to remove the rule that generated the finding.
   • CIgnore the finding because the developer is familiar with the code.
   • DTrace the data flow from input to the shell command to confirm whether the earlier validation is sufficient and cannot be bypassed.
   Reveal Solution Discussion Select an answer first