CSSLP · Question #83
Which of the following software review processes increases the software security by removing the common vulnerabilities, such as format string exploits, race conditions, memory leaks, and buffer overf
The correct answer is B. Code review. Code review is a specific software review process that enhances software security by directly identifying and removing common vulnerabilities such as format string exploits, race conditions, memory leaks, and buffer overflows.
Question
Which of the following software review processes increases the software security by removing the common vulnerabilities, such as format string exploits, race conditions, memory leaks, and buffer overflows?
Options
- AManagement review
- BCode review
- CPeer review
- DSoftware audit review
How the community answered
(30 responses)- A3% (1)
- B93% (28)
- C3% (1)
Why each option
Code review is a specific software review process that enhances software security by directly identifying and removing common vulnerabilities such as format string exploits, race conditions, memory leaks, and buffer overflows.
Management review typically focuses on project progress, resource allocation, adherence to schedules, and overall strategic alignment, not on identifying specific code-level security vulnerabilities.
Code review involves a systematic examination of the source code by peers or automated tools to identify errors, including security vulnerabilities, before deployment. This process is highly effective in detecting specific coding flaws like buffer overflows, format string bugs, race conditions, and memory leaks that can directly compromise software security, thereby preventing exploits.
Peer review is a general term for review by colleagues, and while code review is a type of peer review, 'code review' is the more specific and direct process described for finding technical vulnerabilities.
Software audit review often occurs at a higher level or later stage to ensure compliance with standards and policies, and while it may reveal security issues, it's not primarily focused on direct code-level bug hunting in the same systematic way as a dedicated code review.
Concept tested: Secure development - code review
Topics
Community Discussion
No community discussion yet for this question.