Pre-Commit Code Evaluation ECDE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security team has integrated a SAST tool into the CI pipeline. The tool generates a report with hundreds of findings, many of which are in legacy code that is not being modified. Developers are ignoring the report because it is too noisy and they do not know which findings are relevant to their changes. What is the most effective way to improve the feedback loop?

   • AIncrease the severity threshold so that only critical findings are reported.
   • BDisable the SAST tool for the legacy code and only run it on new modules.
   • CSend the full SAST report to the security team and have them manually triage all findings before notifying developers.
   • DConfigure the SAST tool to only report findings in the lines of code that were changed in the current pull request (diff-aware scanning).
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   What is the role of regulatory compliance in pre-commit security checks?

   • ATo replace the need for external security audits
   • BTo ensure that code meets legal and industry standards, such as data protection requirements
   • CTo automatically report all code changes to regulatory authorities
   • DTo ensure the code is written in a specific programming language mandated by regulators
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A team has a pre-commit hook that runs both a SAST tool and a dependency scanner. The SAST tool takes 30 seconds, and the dependency scanner takes 4 minutes. Developers are complaining about the total time. They want to keep both tools but reduce the total time to under 1 minute. Which approach is most effective?

   • ARemove the SAST tool from the pre-commit hook and keep only the dependency scanner.
   • BIncrease the severity threshold for the dependency scanner to only scan for critical vulnerabilities, reducing its runtime.
   • CRun both tools in parallel using a pre-commit framework that supports concurrent execution.
   • DRun the SAST tool in the pre-commit hook and move the dependency scanner to a CI job that runs on pull requests.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   What is a pre-commit hook in a version control system like Git?

   • AA server-side service that stores commit metadata
   • BA script that runs automatically before a commit is finalized
   • CA tool that merges branches automatically
   • DA plugin that runs after a commit to notify the team
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   An organization uses GitLab for source control. They want to enforce a policy that no commit containing a hardcoded AWS access key ID can be pushed to any branch. They also want to ensure the check runs automatically without requiring developers to install anything locally. Which approach should they implement?

   • AUse a GitLab push rule that blocks commits containing the string 'AKIA'.
   • BConfigure a GitLab pre-receive hook on the server that runs a secret-scanning tool and rejects the push if a secret is found.
   • CAdd a client-side pre-commit hook to each developer's local repository that runs a secret scanner.
   • DCreate a CI job that runs after the push and sends an alert if a secret is found.
   Reveal Solution Discussion Select an answer first