Pre-Commit Code Evaluation ECDE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a common vulnerability that SAST tools are designed to detect?

   • AMisconfigured cloud storage permissions
   • BPhishing email content
   • CSQL injection
   • DWeak Wi-Fi encryption
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security team is implementing a pre-commit SAST tool. They are concerned about the tool's false positive rate, which is currently 30%. They want to reduce this to below 10% without losing coverage of real vulnerabilities. Which approach is most effective?

   • ATune the SAST tool's rules and configurations based on the team's specific coding patterns and framework usage.
   • BDisable the SAST tool and rely on manual code reviews.
   • CIncrease the severity threshold to only report critical and high severity findings.
   • DSwitch to a different SAST tool that has a lower reported false positive rate.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   How does Static Application Security Testing (SAST) analyze source code for vulnerabilities?

   • ABy scanning the compiled binary for known malware signatures
   • BBy executing the code with test inputs and observing runtime behavior
   • CBy monitoring network traffic generated by the application during testing
   • DBy examining the source code structure, data flow, and control flow without executing it
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A team uses GitHub Actions for CI/CD. They want to run SAST on every pull request and block merging if critical vulnerabilities are found. They also want to avoid running the full scan on documentation-only changes. Which configuration best meets these requirements?

   • AUse a scheduled workflow that runs SAST nightly and posts comments on open pull requests.
   • BRun SAST as a pre-commit hook locally and rely on developers to report results.
   • CUse a GitHub Actions workflow triggered on pull_request with a path filter to run SAST only when source code files change, and set the job as a required status check.
   • DRun SAST on every push to any branch and use branch protection to require the status check to pass.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A team has a pre-commit hook that runs a SAST tool. The tool is producing a high number of false positives, which is causing developers to use the `--no-verify` flag to bypass the hook. The security lead wants to reduce false positives without losing coverage of real vulnerabilities. Which approach is most effective?

   • AConfigure the SAST tool to use a stricter rule set that only reports on high-confidence findings, and create a baseline of known false positives to suppress them.
   • BRemove the SAST tool from the pre-commit hook and rely on the CI pipeline to catch issues.
   • CAsk developers to manually review all findings and mark false positives in the tool's database.
   • DIncrease the severity threshold to only report critical findings, ignoring all medium and low severity issues.
   Reveal Solution Discussion Select an answer first