Pre-Commit Code Evaluation ECDE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A DevOps team is integrating a SAST tool and a dependency scanner into their CI/CD pipeline. The pipeline currently runs on every push to a feature branch. The security team requires that any critical-severity vulnerability in a direct dependency or any SAST finding that matches a 'deny-list' rule must block the merge to the main branch. However, developers complain that the pipeline is too slow and blocks their work on feature branches. Which approach best satisfies both the security requirement and the developer workflow?

   • ADisable all security scans on feature branches and run the full SAST and dependency scan only on the main branch after the merge is complete.
   • BRun the full SAST and dependency scan on every push to the feature branch, but only fail the build on critical findings; allow the merge to main only if the pipeline passes with no critical findings.
   • CRun the full SAST and dependency scan only on pull requests, and require a manual security review by a security engineer before merging to main.
   • DRun a fast, incremental SAST scan and a dependency diff scan on feature branches, failing only on new critical findings; run the full SAST and dependency scan as a required status check for the merge to main.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A Python web application team wants to catch SQL injection and cross-site scripting (XSS) vulnerabilities before code is committed. They currently run a linter for style only. They need a tool that analyzes source code without executing it and integrates with their existing Git pre-commit workflow. Which tool should they add to their pre-commit configuration?

   • AESLint with the security plugin, run as a pre-commit hook.
   • BSnyk, configured to monitor the application's runtime dependencies in production.
   • CBandit, configured with a security severity threshold, run as a pre-commit hook.
   • DOWASP ZAP, configured to scan the running application in a staging environment.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A development team is integrating a SAST tool into their pre-commit pipeline. The tool is generating many false positives, causing developers to ignore the results. The security team wants to maintain security coverage while improving developer trust. What is the most effective strategy?

   • AAsk developers to fix all findings, including false positives, to clear the report.
   • BIncrease the severity threshold so only critical findings are reported.
   • CDisable the SAST tool entirely and rely on manual code reviews by senior developers.
   • DCreate a baseline of current findings, suppress known false positives with justifications, and review new findings regularly.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A Java application uses Maven to manage dependencies. The team wants to block commits that introduce a dependency with a known critical vulnerability. They also want to avoid slowing down the pre-commit hook significantly. Which approach best meets both requirements?

   • AManually review the pom.xml file for known CVEs before each commit.
   • BRun a nightly CI job that generates a report of vulnerable dependencies and emails the team.
   • CRun OWASP Dependency-Check as a pre-commit hook, failing the commit if any critical CVE is found.
   • DUse a Maven plugin to update all dependencies to the latest versions before every commit.
   Reveal Solution Discussion Select an answer first
6. 40expert · medium

   A team is using a linter as a pre-commit hook to enforce coding standards. The linter has a rule that flags the use of `eval()` in Python, which is a security anti-pattern. However, the team has a legitimate use case for `eval()` in a configuration parser. The team wants to allow this specific use case while still flagging other uses of `eval()`. Which approach is most appropriate?

   • AAsk the developer to rewrite the configuration parser to avoid using `eval()`.
   • BAdd an inline comment to the specific line of code that uses `eval()` to disable the rule for that line, and document why it is safe.
   • CDisable the `eval()` rule entirely in the linter configuration.
   • DMove the configuration parser to a separate file and exclude that file from the linter.
   Reveal Solution Discussion Select an answer first