Code Review Strategy ECDE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A team is about to review a microservices-based application. The application includes a user service, a payment service, and an inventory service. The team has limited time for manual review. Which service should be prioritized for manual review?

   • AThe inventory service, because it has the most complex business logic.
   • BThe user service, because it handles authentication.
   • CThe payment service, because it handles sensitive financial data and is a high-value target.
   • DAll services equally, because every service is equally important.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A DevSecOps team is defining the scope and timing of code review in their pipeline. They want to catch vulnerabilities as early as possible while minimizing the impact on developers. Which approach is most appropriate?

   • APerform code review on every pull request before merging.
   • BPerform code review only when a security incident occurs.
   • CPerform code review only after the release.
   • DPerform code review only on the main branch after merge.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which statement best describes the scope of a code review in a DevSecOps context?

   • AIt only covers code that is deployed to production
   • BIt examines the code for correctness, maintainability, and security vulnerabilities
   • CIt is limited to reviewing code written by junior developers
   • DIt focuses only on syntax errors and code compilation issues
   Reveal Solution Discussion Select an answer first
5. 34application · easy

   A team is creating a secure code review checklist for a Java web application. The checklist should cover common vulnerability categories. Which set of items is most appropriate for the checklist?

   • AInput validation, authentication and session management, error handling, and logging.
   • BCode formatting, variable naming conventions, and comment quality.
   • CDatabase indexing, query performance, and connection pooling.
   • DUI color scheme, button placement, and accessibility features.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A development team wants to establish a collaborative code review workflow. They want to ensure that all security findings are tracked and resolved before code is merged. Which workflow best achieves this?

   • AUse an automated tool to approve merges without human review.
   • BAllow any developer to merge code after a self-review.
   • CRequire at least one reviewer to approve the code, and use a ticketing system to track security findings.
   • DHave a security team review code only after the release.
   Reveal Solution Discussion Select an answer first