Pre-Commit Code Evaluation ECDE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company is migrating a legacy application to a modern CI/CD pipeline. The application has a large number of dependencies, many of which are outdated and have known vulnerabilities. The security team wants to enforce a policy that no new critical vulnerabilities are introduced, but they cannot fix all existing vulnerabilities immediately. The development team wants to be able to merge new features without being blocked by pre-existing issues. Which strategy best balances these constraints?

   • AFail the build on any critical vulnerability, regardless of whether it is new or pre-existing, and require the team to fix all of them before merging any new features.
   • BDisable the dependency scanner entirely until all existing vulnerabilities are fixed, and then enable it with a strict policy.
   • CConfigure the dependency scanner to fail the build only on new critical vulnerabilities introduced in the current change, using a baseline of existing vulnerabilities that is tracked and reviewed regularly.
   • DUse a manual process where the security team reviews all new dependencies before they are added, and approve them on a case-by-case basis.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A team is integrating a SAST tool into their CI pipeline. The tool is very accurate but takes 20 minutes to run. The team has a policy that all pull requests must pass the CI pipeline before merging. Developers are complaining that the 20-minute wait is too long and is slowing down their workflow. Which approach best addresses the developers' concern while maintaining the security policy?

   • ADisable the SAST tool in the CI pipeline and run it manually on a weekly basis.
   • BIncrease the number of CI runners to reduce the SAST scan time from 20 minutes to 5 minutes.
   • CRun the full SAST scan only on the main branch after the merge, and rely on code review to catch issues in pull requests.
   • DRun a faster, incremental SAST scan on pull requests that only analyzes the changed files, and run the full scan on the main branch after the merge.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A team is adopting pre-commit hooks for a JavaScript project. They want to enforce security anti-patterns such as using eval() and detecting hardcoded secrets. They also want developers to receive clear feedback on how to fix issues. Which combination of tools and configuration best achieves this?

   • AJSHint with default settings and a manual code review checklist for secrets.
   • BA single custom Node.js script that checks for eval() and secret patterns, run as a pre-commit hook.
   • CPrettier for code formatting and a custom script that greps for 'eval' and common password patterns.
   • DESLint with eslint-plugin-security and a secret-scanning tool like gitleaks, both configured as pre-commit hooks with custom error messages.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A financial services company must comply with PCI DSS, which requires that cardholder data is not stored in source code. They use a monorepo with multiple teams. They want to enforce this policy automatically at the point of commit. What is the most robust way to enforce this policy?

   • AUse a CI job that runs after the push and alerts the security team if cardholder data is found.
   • BAdd a client-side pre-commit hook that runs a regex-based scanner for credit card numbers.
   • CImplement a server-side pre-receive hook that scans all commits for patterns matching cardholder data and rejects the push if found.
   • DRequire all developers to manually review their code for cardholder data before committing.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A development team is using a SAST tool in their CI pipeline. The tool has identified a SQL injection vulnerability in a new feature branch. The developer who wrote the code is unsure how to fix it and is asking for guidance. What is the most effective way to provide actionable feedback?

   • ATell the developer to search the internet for 'SQL injection fix' and figure it out.
   • BAssign the finding to a senior developer to fix, without involving the original developer.
   • CProvide the developer with a link to the SAST tool's documentation for the specific vulnerability rule, along with a code example of a secure fix.
   • DDisable the SAST rule for this project to avoid blocking the feature.
   Reveal Solution Discussion Select an answer first