DEVSECOPS practice question 3 of 10
Which of the following BEST represents a key principle of a peer code review?
Full set: 39 questionsA key principle and primary benefit of a peer code review is the early identification of defects, security vulnerabilities, and logic errors. By having another developer examine the code before it is merged into the main branch, issues can be caught and fixed when the cost of remediation is lowest. This practice aligns with the "shift left" security principle in DevSecOps, where quality and security checks are integrated as early as possible in the software development lifecycle. It also promotes knowledge sharing and adherence to coding standards across the team.
B. Peer code reviews are typically an integral part of a formal change process, providing a crucial quality gate and audit trail, not a way to bypass it.
C. While code reviews require focused work, "task speculation" is not a standard term or goal. The focus is on the quality and correctness of the submitted code.
D. Code reviews empower teams with quality ownership, but they do not replace management's responsibility for overall quality assurance; they are a tool to help achieve it.
1. McConnell, S. (2004). Code Complete (2nd ed.). Microsoft Press. Chapter 21, "Collaborative Construction," details how reviews are one of the most effective ways to find defects early.
2. Bacchelli, A., & Bird, C. (2013). Expectations, outcomes, and challenges of modern code review. Proceedings of the 35th International Conference on Software Engineering (ICSE '13), 712–721. https://doi.org/10.1109/ICSE.2013.6606629. This academic study identifies "finding defects" as a primary expected outcome of code reviews (Table 1, p. 714).
3. Siy, H., & Votta, L. (2005). Does the modern code inspection have value? Journal of Systems and Software, 74(2), 159-166. https://doi.org/10.1016/j.jss.2004.02.027. The research confirms the continued value of code inspections (a formal type of review) for defect detection.
Keep practicing
Take the free DEVSECOPS practice test
Ten exam-style questions with answers and explanations, plus the exam facts and study guides.
More questions
Other DEVSECOPS practice questions
- Question 1When of the following is BEST described as "a benefit of using a standard naming conventi…
- Question 2Which of the following is BEST described as ''the level of the IT security learning conti…
- Question 4Which of the following is NOT a security requirement unique to mobile applications?
- Question 5Which or the following BEST describes the proper order of the main stages of continuous i…
- Question 6Which of the following is BEST deserved as "being outside the scope of risk management in…
- Question 7Which of the following is BEST described by the statement containers that access an disks…
