nerdexam
Cisco

350-901 · Question #6

Which two statements describe advantages of static code analysis over unit tests? (Choose two.)

The correct answer is A. It checks for potential tainted data where input is not checked. B. It enforces proper coding standards and style. Static code analysis offers advantages over unit tests by identifying potential security vulnerabilities like tainted data where input validation is missing and by automatically enforcing coding standards and stylistic guidelines.

Software Development and Design

Question

Which two statements describe advantages of static code analysis over unit tests? (Choose two.)

Options

  • AIt checks for potential tainted data where input is not checked.
  • BIt enforces proper coding standards and style.
  • CIt performs a quick analysis of whether tests will pass or fail when run.
  • DIt checks for race conditions in threaded applications.
  • EIt estimates the performance of the code when run.

How the community answered

(31 responses)
  • A
    94% (29)
  • D
    3% (1)
  • E
    3% (1)

Why each option

Static code analysis offers advantages over unit tests by identifying potential security vulnerabilities like tainted data where input validation is missing and by automatically enforcing coding standards and stylistic guidelines.

AIt checks for potential tainted data where input is not checked.Correct

Static code analysis tools can perform data flow analysis to detect potential security vulnerabilities such as tainted input data being used without proper sanitization, which is often difficult to cover exhaustively with unit tests.

BIt enforces proper coding standards and style.Correct

Static analysis is highly effective at enforcing coding standards, style guides, and best practices across a codebase, ensuring consistency and maintainability, a function not performed by unit tests.

CIt performs a quick analysis of whether tests will pass or fail when run.

Static analysis examines code without executing it and therefore cannot determine if unit tests will pass or fail; that is the purpose of running the unit tests themselves.

DIt checks for race conditions in threaded applications.

While some advanced static analysis tools attempt to identify potential race conditions, dynamic analysis tools that observe code execution are generally more effective at detecting actual concurrency issues that manifest at runtime.

EIt estimates the performance of the code when run.

Static analysis cannot estimate the performance of code when it runs because performance evaluation requires actual code execution and measurement, which is typically done through profiling or performance testing.

Concept tested: Static code analysis vs. unit testing

Source: https://learn.microsoft.com/en-us/azure/devops/pipelines/build/static-code-analysis?view=azure-devops

Topics

#Static Code Analysis#Unit Testing#Software Quality#Security Vulnerabilities

Community Discussion

No community discussion yet for this question.

Full 350-901 Practice