Pre-Commit Code Evaluation ECDE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security architect is designing the pre-commit and CI/CD security strategy for a new project. The team is small and has limited resources. The architect wants to maximize the security value of the automated checks while minimizing the maintenance burden. Which strategy is most appropriate?

   • AImplement only a CI pipeline with a SAST tool and a dependency scanner, and skip pre-commit hooks entirely.
   • BImplement only pre-commit hooks and rely on them to catch all security issues, without a CI pipeline.
   • CImplement a comprehensive set of pre-commit hooks that run every available security tool, and a CI pipeline that runs the same tools again.
   • DImplement a small set of high-value pre-commit hooks (secret detection and a security-focused linter) and a CI pipeline that runs a SAST tool and a dependency scanner.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A team is integrating a SAST tool into their pre-commit pipeline. The tool flags a potential SQL injection vulnerability in a query built using string concatenation. The developer insists the input is sanitized by an ORM and the finding is a false positive. The security team wants to maintain trust in the tool while addressing the finding. What is the best course of action?

   • ADisable the SAST rule for SQL injection to eliminate the false positive.
   • BRequire the developer to rewrite the query using parameterized statements, regardless of the ORM behavior.
   • CInvestigate the code path to confirm whether the ORM parameterizes the query, and if it does, add a suppression with a justification and a review date.
   • DIgnore the finding and move on, trusting the developer's judgment.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In a DevSecOps pipeline, what is the primary purpose of pre-commit code evaluation?

   • ATo automatically deploy code to production after passing security checks
   • BTo enforce coding style guidelines only, without considering security
   • CTo replace the need for runtime security testing in production
   • DTo identify and address security issues in code before it is committed to the repository
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the main purpose of dependency scanning in a pre-commit security check?

   • ATo verify that dependencies are compatible with the latest operating system
   • BTo identify known vulnerabilities in third-party libraries and packages
   • CTo remove all third-party code from the project
   • DTo ensure all dependencies are written in the same programming language
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is required to comply with PCI DSS, which mandates that all software components be free of known critical vulnerabilities. The company uses a mix of open-source and commercial libraries. The security team wants to enforce this requirement in the CI/CD pipeline. Which combination of controls is most appropriate?

   • ARely on the development team to manually check the NVD database for each library before adding it to the project.
   • BIntegrate a software composition analysis (SCA) tool into the CI pipeline that scans all dependencies and fails the build if any critical vulnerability is found, and require a manual review and approval for any exception.
   • CUse a tool that only scans open-source libraries and ignores commercial libraries, as commercial libraries are assumed to be secure.
   • DRun the SCA scan only on the main branch after the merge, and do not block the merge on findings.
   Reveal Solution Discussion Select an answer first