Pre-Commit Code Evaluation ECDE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A development team is new to DevSecOps and wants to implement pre-commit security checks. They have a small codebase and a small team. They want to start with a simple solution that can be expanded later. They are considering using a pre-commit framework like pre-commit (Python) or husky (JavaScript). What is the most important factor in choosing between these frameworks?

   • AThe framework's ability to run on Windows, macOS, and Linux.
   • BThe number of contributors to the framework's open-source repository.
   • CThe primary programming language of the codebase and the ecosystem of available hooks.
   • DThe framework's integration with the team's CI/CD system.
   Reveal Solution Discussion Select an answer first
2. 2expert · medium

   A team is implementing pre-commit hooks for a large, mixed-language repository. The hooks currently run a secret scanner and a linter on all files, which takes several minutes. Developers are complaining that the hooks are too slow and are starting to bypass them. The team wants to keep the security coverage but improve the speed. Which approach is most effective?

   • AIncrease the number of CPU cores available to the pre-commit hook process.
   • BDisable the linter and keep only the secret scanner in the pre-commit hook.
   • CRun the secret scanner and linter only on the files that have been staged for commit, using the `git diff --cached` command to identify them.
   • DMove the secret scanner and linter to the CI pipeline and remove them from pre-commit hooks.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team has implemented a SAST tool in the CI pipeline. The tool is generating a large number of findings, and the team is struggling to triage them. They want to establish a process to ensure that findings are reviewed and remediated in a timely manner. Which process is most effective?

   • ARequire developers to check the SAST report in the CI pipeline and fix any findings before merging.
   • BAutomatically create a Jira ticket for every SAST finding and assign it to the developer who committed the code that introduced the finding.
   • CIgnore low and medium severity findings and only track critical findings.
   • DSend a weekly email digest of all SAST findings to the security team and have them manually assign the findings to developers.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is a common technique to reduce false positives in pre-commit security scans?

   • ATuning the scan rules to the specific technologies and context of the project
   • BIncreasing the number of rules to catch more issues
   • CRunning scans only on weekends to reduce interference
   • DDisabling all security checks to avoid false positives
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Why is it important to optimize the performance of pre-commit security scans?

   • ATo ensure that scans are run only once per year
   • BTo minimize delays in the developer workflow and encourage adoption
   • CTo reduce the number of security findings
   • DTo make the scans more complex and thorough
   Reveal Solution Discussion Select an answer first