Pre-Commit Code Evaluation ECDE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A development team is adopting a new security linter for their Python codebase. The linter flags a large number of issues, many of which are style-related or are known false positives for their specific framework. The team wants to enforce the linter in pre-commit hooks, but they are concerned about overwhelming developers and slowing down the commit process. What is the best initial strategy?

   • AStart with a small set of high-value security rules, configure the linter to only report on new issues (not pre-existing ones), and use a baseline file to suppress known false positives.
   • BRun the linter only in CI and not in pre-commit, so developers are not blocked but the CI will fail on any issue.
   • CEnable all linter rules, fail the commit on any finding, and require developers to fix every issue before committing.
   • DDisable the linter entirely and rely on code review to catch security anti-patterns.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   In a CI/CD pipeline, what is the benefit of integrating pre-commit security tools as an early stage?

   • AIt allows security issues to be fixed after deployment
   • BIt replaces the need for any manual code review
   • CIt ensures that security checks run automatically on every code change
   • DIt eliminates the need for runtime security monitoring
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company is developing a Java application that uses several open-source libraries. The security team wants to enforce a policy that no library with a known critical vulnerability (CVSS score >= 9.0) can be added to the codebase. They also want to ensure that the policy is enforced before code is merged into the main branch. Which combination of actions is most effective?

   • ARequire developers to manually check the NVD database before adding a new library and document the review in the pull request.
   • BAdd a dependency scanning tool (e.g., OWASP Dependency-Check) to the CI pipeline and configure it to fail the build if any critical vulnerability is found in the project's dependencies.
   • CUse a tool like Snyk or Dependabot to automatically create pull requests when a vulnerability is found, but do not block the merge.
   • DAdd a pre-commit hook that runs the dependency scanner on the lock file and fails the commit if a critical vulnerability is found.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which statement best describes the role of pre-commit code evaluation in a DevSecOps pipeline?

   • AIt runs after code is merged to the main branch to verify production readiness
   • BIt provides early feedback to developers by checking code for security issues before it enters the repository
   • CIt is a manual review process performed by security experts before each commit
   • DIt is used only for compliance auditing and not for improving code security
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is a best practice for managing secrets in application code?

   • AShare secrets with the team via a public repository
   • BStore secrets in environment variables and reference them in code
   • CEncrypt secrets with a hardcoded key in the source code
   • DUse the same secret across all environments to simplify management
   Reveal Solution Discussion Select an answer first