Code Review Strategy ECDE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security reviewer is about to conduct a manual code review of a web application that handles financial transactions. The application uses a third-party payment gateway and has a custom authentication module. Given limited review time, which code paths should be prioritized?

   • AThe code that formats error messages and logs system events.
   • BThe code that renders static pages and manages user preferences.
   • CThe code that integrates with the third-party payment gateway's SDK.
   • DThe authentication module and the code that processes payment responses from the gateway.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A DevSecOps team is integrating SAST into a CI pipeline for a large monorepo. The SAST scan takes 45 minutes, and developers are complaining about slow feedback. The team wants to keep the gate but improve speed. Which approach is most effective?

   • AIncrease the SAST timeout to 90 minutes to ensure thorough scanning.
   • BRun SAST on changed files only in pull requests, and run the full scan nightly on the main branch.
   • CRun SAST in parallel with the build and deploy steps, but do not block the deployment.
   • DRun the full SAST scan only on the main branch and rely on pre-commit hooks for developers.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A team is creating a secure code review checklist for a Python web application that uses a REST API. The checklist should include items specific to the application's technology stack. Which item is most relevant to include?

   • ACheck that all functions have docstrings.
   • BVerify that all API endpoints enforce authentication and authorization.
   • CConfirm that the code follows PEP 8 style guidelines.
   • DEnsure that all database queries are optimized for performance.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A team wants to ensure that code review findings are not only fixed but also that the fixes are verified. Which practice best supports this goal?

   • ARequire the reviewer who found the issue to re-review the fix before merge.
   • BAllow the developer who wrote the code to merge the fix without further review.
   • CAutomatically close the finding when the code is merged.
   • DTrack the finding in a spreadsheet but do not require re-review.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A development team is deciding how to allocate resources between manual and automated code review. They have a large codebase and a small security team. They want to maximize coverage while ensuring that complex security issues are not missed. Which approach is most effective?

   • AUse only manual review for all code, because automated tools produce too many false positives.
   • BUse automated tools only on new code and manual review only on legacy code.
   • CUse automated SAST tools for broad coverage and manual review for high-risk modules identified by threat modeling.
   • DUse only automated tools, because they can catch all types of vulnerabilities.
   Reveal Solution Discussion Select an answer first