It's A and B.
"Taint sources are locations in the program where data is being read from a potentially risky source, and include things like environment variables, data, files, file metadata"
This is something that we look at during static code analysis along with proper coding style and standards.
A and B are correct.
Static code analysis complements dynamic testing to provide additional advantages:
- Error detection: Static code analysis can identify hundreds of classes of bugs related to concurrency, tainted data, data flow, and static and dynamic memory. Some bugs are nearly impossible to detect with dynamic testing.
- Security vulnerabilities detection: Static code analysis can detect common vulnerabilities, such as those identified by OWASP, in the code and imported libraries.
- Low cost: Static code analysis may be easily automated without the overhead of writing test cases, instrumenting the code, and program execution.
- Coding standards compliance: Static analysis tools can analyze source syntax and enforce coding standards.
- Better source code: Static code analysis tools can identify unused code.
Static code analysis complements dynamic testing to provide additional advantages:
- Error detection: Static code analysis can identify hundreds of classes of bugs related to concurrency, tainted data, data flow, and static and dynamic memory. Some bugs are nearly impossible to detect with the dynamic testing.
- Security vulnerabilities detection: Static code analysis can detect common vulnerabilities, such as those identified by OWASP, in the code and imported libraries.
- Low cost: Static code analysis may be easily automated without the overhead of writing test cases, instrumenting the code, and program execution.
- Coding standards compliance: Static analysis tools can analyze source syntax and enforce coding standards.
- Better source code: Static code analysis tools can identify the unused code.
Source: Cisco DEVCOR 350-901 Study Guide
For me B is one of the answers but though choice between A and D.
Tainted data where input is not checked is not being tested by unit testing and therefore is a benefit of SCA. On the other hand, race conditions are also possible to check on SCA.
it's very difficult determine race conditions by just watching the code
upvoted 1 times
...
...
This section is not available anymore. Please use the main Exam Page.350-901 Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Bloody_sausage
Highly Voted 2 years, 6 months agowunderup
Highly Voted 2 years, 12 months agoTeringzooi
Most Recent 7 months, 3 weeks agodesignated
8 months, 3 weeks agoferock
1 year agohartak
1 year, 3 months agoB3nd3cida
2 years agocooruyber
2 years, 6 months agoravenfz
2 years, 7 months agoconman
2 years, 8 months agow3rkw3rk
2 years, 10 months agoElvergalarga
2 years, 2 months ago