Pre-Commit Code Evaluation ECDE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An organization uses a self-hosted Git server. They want to enforce pre-commit security checks, but some developers work in environments where they cannot install additional tools locally. They need a solution that works for all developers without requiring local installation. What is the best approach?

   • AUse a CI pipeline that runs the checks after the push and notifies developers of failures.
   • BProvide a Docker container with all the security tools and require developers to run it before committing.
   • CAsk developers to manually run a script provided in the repository before committing.
   • DImplement a server-side pre-receive hook that runs the security checks and rejects pushes that fail.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   How can pre-commit checks enforce organizational security policies?

   • ABy encrypting the repository to prevent unauthorized access
   • BBy automatically generating compliance reports for regulators
   • CBy requiring developers to sign a compliance form before committing
   • DBy blocking commits that violate defined security rules
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A startup is building a new microservices application. The CTO wants to ensure that security checks are performed as early as possible in the development lifecycle. The team is currently using Git with a central repository and has a CI system that runs after code is pushed. Which statement best describes the value of adding pre-commit code evaluation in addition to the existing CI checks?

   • APre-commit evaluation provides immediate feedback to the developer on their local machine, catching issues before they are pushed, which reduces the number of failed CI runs and speeds up the development loop.
   • BPre-commit evaluation is primarily for enforcing coding style and has no security value.
   • CPre-commit evaluation replaces the need for CI security checks, so the CI pipeline can be simplified and run faster.
   • DPre-commit evaluation is only useful for secret detection and cannot perform SAST or dependency scanning effectively.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security engineer discovers that a hardcoded database password was committed to the repository two weeks ago and has been pushed to the remote. The password is for a production database. The engineer needs to remediate this issue. Which sequence of actions is most appropriate?

   • ARotate the database password immediately, then remove the secret from the repository history using a tool like `git filter-repo`, and finally add a secret detection tool to the pre-commit hooks.
   • BAdd a secret detection tool to the pre-commit hooks and rely on it to prevent future commits, without rotating the password or cleaning the history.
   • CRemove the secret from the repository history first, then rotate the database password, and then add a secret detection tool to the pre-commit hooks.
   • DJust rotate the database password and do not worry about the repository history, as the password is no longer valid.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A team uses a monorepo with multiple services in different languages (Python, Go, and JavaScript). They want to enforce a pre-commit hook that runs a language-appropriate SAST tool on only the files that have been staged for commit. The hook must not take more than a few seconds to run and must not produce false positives that block legitimate commits. Which configuration approach is most appropriate?

   • ARun the SAST tools only in the CI pipeline after the commit is pushed, and rely on the developer to fix any issues found.
   • BConfigure separate pre-commit hooks for each language, each running the appropriate SAST tool on the staged files of that language, and use a baseline or allow-list for known false positives.
   • CConfigure a single pre-commit hook that runs a generic SAST tool on all files in the repository, regardless of language, and fails the commit on any finding.
   • DUse a single SAST tool that supports all three languages and run it on the entire repository on every commit, but only warn on findings instead of failing the commit.
   Reveal Solution Discussion Select an answer first