DEVSECOPS practice question 3 of 10

Which of the following BEST represents a key principle of a peer code review?

Full set: 39 questions
Answer options
A: A peer code review enables the organization to identify defects earlier in the process Correct answer
B: A peer code review allows an organization to avoid using a formal change process
C: A peer code review enables deep worn and task speculation to improve the reliability of software
D: A peer code review enables management to take a hands-off approach to quality assurance
Correct Answer:
A. A peer code review enables the organization to identify defects earlier in the process
Explanation

A key principle and primary benefit of a peer code review is the early identification of defects, security vulnerabilities, and logic errors. By having another developer examine the code before it is merged into the main branch, issues can be caught and fixed when the cost of remediation is lowest. This practice aligns with the "shift left" security principle in DevSecOps, where quality and security checks are integrated as early as possible in the software development lifecycle. It also promotes knowledge sharing and adherence to coding standards across the team.

Why Incorrect

B. Peer code reviews are typically an integral part of a formal change process, providing a crucial quality gate and audit trail, not a way to bypass it.
C. While code reviews require focused work, "task speculation" is not a standard term or goal. The focus is on the quality and correctness of the submitted code.
D. Code reviews empower teams with quality ownership, but they do not replace management's responsibility for overall quality assurance; they are a tool to help achieve it.

References

1. McConnell, S. (2004). Code Complete (2nd ed.). Microsoft Press. Chapter 21, "Collaborative Construction," details how reviews are one of the most effective ways to find defects early.

2. Bacchelli, A., & Bird, C. (2013). Expectations, outcomes, and challenges of modern code review. Proceedings of the 35th International Conference on Software Engineering (ICSE '13), 712–721. https://doi.org/10.1109/ICSE.2013.6606629. This academic study identifies "finding defects" as a primary expected outcome of code reviews (Table 1, p. 714).

3. Siy, H., & Votta, L. (2005). Does the modern code inspection have value? Journal of Systems and Software, 74(2), 159-166. https://doi.org/10.1016/j.jss.2004.02.027. The research confirms the continued value of code inspections (a formal type of review) for defect detection.

Scroll to Top