Within software development what type of testing is commonly meant by the phrase code review?

Question

Options

• AAutomated static code analysis tools
• BCompilers run with extra diagnostic flags
• CManual peer inspection of source code by developers
• DRuntime dynamic analysis and fuzz testing tools

• A
  2% (1)
• B
  7% (3)
• C
  89% (39)
• D
  2% (1)

Explanation

In software development, 'code review' specifically refers to the manual peer inspection of source code by developers (Option C). During a code review, one or more developers examine another developer's code changes before they are merged into the main codebase. The goal is to identify bugs, logic errors, security vulnerabilities, style violations, and opportunities for improvement through human judgment and expertise.

Why the other options are incorrect:

• A (Automated static analysis tools): While static analysis tools (like SonarQube, ESLint, or Checkstyle) do inspect source code without executing it, they are distinct from code review. They are often run alongside code reviews but are not what the term 'code review' means.
• B (Compilers with extra diagnostic flags): Running a compiler with additional warnings or diagnostic flags is a form of static analysis performed by tooling, not a human review process. This is sometimes called 'compiler analysis' or 'build-time analysis.'
• D (Runtime dynamic analysis and fuzz testing): These techniques involve executing the code to observe its runtime behavior. Fuzz testing automatically feeds unexpected inputs to find crashes or vulnerabilities. Neither involves human inspection of source code, which is the hallmark of a code review.

Code review is a foundational software engineering practice that improves code quality, spreads knowledge across teams, and catches issues early in the development lifecycle.

No community discussion yet for this question.