350-901 · Question #6
Which two statements describe advantages of static code analysis over unit tests? (Choose two.)
The correct answer is A. It checks for potential tainted data where input is not checked. B. It enforces proper coding standards and style. Static code analysis offers advantages over unit tests by identifying potential security vulnerabilities like tainted data where input validation is missing and by automatically enforcing coding standards and stylistic guidelines.
Question
Options
- AIt checks for potential tainted data where input is not checked.
- BIt enforces proper coding standards and style.
- CIt performs a quick analysis of whether tests will pass or fail when run.
- DIt checks for race conditions in threaded applications.
- EIt estimates the performance of the code when run.
How the community answered
(31 responses)- A94% (29)
- D3% (1)
- E3% (1)
Why each option
Static code analysis offers advantages over unit tests by identifying potential security vulnerabilities like tainted data where input validation is missing and by automatically enforcing coding standards and stylistic guidelines.
Static code analysis tools can perform data flow analysis to detect potential security vulnerabilities such as tainted input data being used without proper sanitization, which is often difficult to cover exhaustively with unit tests.
Static analysis is highly effective at enforcing coding standards, style guides, and best practices across a codebase, ensuring consistency and maintainability, a function not performed by unit tests.
Static analysis examines code without executing it and therefore cannot determine if unit tests will pass or fail; that is the purpose of running the unit tests themselves.
While some advanced static analysis tools attempt to identify potential race conditions, dynamic analysis tools that observe code execution are generally more effective at detecting actual concurrency issues that manifest at runtime.
Static analysis cannot estimate the performance of code when it runs because performance evaluation requires actual code execution and measurement, which is typically done through profiling or performance testing.
Concept tested: Static code analysis vs. unit testing
Source: https://learn.microsoft.com/en-us/azure/devops/pipelines/build/static-code-analysis?view=azure-devops
Topics
Community Discussion
No community discussion yet for this question.