Pre-Commit Code Evaluation ECDE Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   Which of the following is an effective strategy for establishing a remediation process for pre-commit findings?

   • AAssigning a severity level to each finding and prioritizing fixes accordingly
   • BIgnoring low-severity findings to save time
   • CDeferring all remediation to a yearly security audit
   • DRequiring every finding to be fixed before any code is committed
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A team's pre-commit hook runs a dependency vulnerability scan that takes over five minutes, significantly slowing down every commit. Developers are complaining. They want to keep the scan but reduce the impact on local development. Which approach best balances speed and security?

   • AIncrease the severity threshold to only block on critical vulnerabilities, reducing the scan time.
   • BRemove the pre-commit hook and run the dependency scan only in a nightly CI job.
   • CCache the dependency scan results and only re-scan when the dependency file changes.
   • DMove the full dependency scan to the CI pipeline and use a lightweight pre-commit hook that only checks for newly added dependencies.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   What is the primary method used by secret detection tools to identify hardcoded credentials in source code?

   • AComparing the code against a database of leaked passwords
   • BExecuting the code and observing authentication attempts
   • CPattern matching for known secret formats and high-entropy strings
   • DAnalyzing network traffic from the development environment
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Besides security vulnerabilities, what other type of issue can dependency scanning detect?

   • ADatabase schema mismatches
   • BRuntime performance bottlenecks
   • CLicense compliance problems
   • DCode style violations
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A team uses a monorepo with a large number of dependencies. Their pre-commit dependency scan takes 10 minutes and is blocking commits. They want to reduce the time to under 2 minutes without losing the ability to catch new critical vulnerabilities. Which strategy is most effective?

   • ARun the full scan only on the CI server and remove it from the pre-commit hook.
   • BIncrease the severity threshold to only block on critical vulnerabilities, reducing the number of dependencies scanned.
   • CUse incremental scanning that only checks dependencies that have changed since the last scan, with a cached baseline.
   • DUse a faster but less comprehensive scanner that only checks the top 100 dependencies.
   Reveal Solution Discussion Select an answer first