nerdexam
(ISC)2

CSSLP · Question #360

Which categories of problems are suitable for static code analysis to detect in a software repository?

The correct answer is D. Syntax checking, approved API or library usage, and semantic validation of code logic and call. Static code analysis is well-suited for detecting problems like syntax errors, verifying approved API or library usage, and validating the semantic logic and call patterns within a software repository.

Secure Software Testing

Question

Which categories of problems are suitable for static code analysis to detect in a software repository?

Options

  • ASyntax checks, allowed function calls, and attempting to detect race conditions
  • BCloud Trace
  • CSyntax validation, permitted libraries, and runtime memory usage profiling
  • DSyntax checking, approved API or library usage, and semantic validation of code logic and call

How the community answered

(51 responses)
  • A
    4% (2)
  • C
    2% (1)
  • D
    94% (48)

Why each option

Static code analysis is well-suited for detecting problems like syntax errors, verifying approved API or library usage, and validating the semantic logic and call patterns within a software repository.

ASyntax checks, allowed function calls, and attempting to detect race conditions

While static analysis can check syntax and permitted calls, reliably detecting complex race conditions often requires dynamic analysis or specialized tools that observe runtime behavior.

BCloud Trace

Cloud Trace is a distributed tracing system used for performance monitoring of applications at runtime, not a static code analysis tool.

CSyntax validation, permitted libraries, and runtime memory usage profiling

Runtime memory usage profiling is a dynamic analysis technique that requires the code to be executed, which is outside the scope of static code analysis.

DSyntax checking, approved API or library usage, and semantic validation of code logic and callCorrect

Static code analysis excels at finding issues like syntax errors, verifying adherence to approved API or library usage policies, and performing semantic validation to detect logical flaws and incorrect call sequences directly from the source code without execution.

Concept tested: Static code analysis capabilities

Source: https://owasp.org/www-project-static-application-security-testing/

Topics

#Static Code Analysis#SAST#Syntax Validation#Semantic Analysis

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CSSLP Practice