A junior developer submits code with security vulnerabilities. Which formal review method would best catch such high-risk flaws?

Question

BlackTom AI · Accepted Answer

Here is a careful breakdown of each answer option in the context of catching high-risk security vulnerabilities during a formal review.
Option 1: Walkthrough. A walkthrough involves team members stepping through the code or design to understand its flow and catch issues, but it is typically less formal and may rely on the author’s explanations. While it can uncover some problems, it is not specifically tailored to formal, high-risk flaw detection and may miss subtle security vulnerabilities without a strict checklist.
Option 2: Pair programming. In pair programming, two developers work together at the same workstation, which can help catch defects early through real-time collaboration. However, this method focuses more on immediate coding quality and correctness rather than a formal, structured review aimed at identifying systemic security flaws across the codebase.
Option 3: Desk check. A desk check is an informal review where someone manually reads and traces the code without executing it, often lacking the rigor and documented procedure needed to reliably surface high-risk security issues. It is more lightweight and less likely to enforce security-focused controls than formal methods.
Option 4: Inspection. An inspection is a formal peer-review process with defined roles, checklists, entry/exit criteria, and documented findings. It emphasizes thoroughness, defect detection rates, and especially high-risk issues, including security vulnerabilities, by systematically examining work products against standards.
By aligning the characteristics with the goal of catching high-risk security flaws through a rigorous, structured process, Inspection best fits the requirement. It provides formal laser-focused scrutiny and a traceable record of identified vulnerabilities, which is essential for security-critical reviews.
The other options—Walkthrough, Pair programming, and Desk check—do not offer the same level of formal structure and security-focused rigor, making them less effective at reliably catching high-risk flaws in a security-sensitive context.

A junior developer submits code with security vulnerabilities. Which formal review method would best catch such high-risk flaws?单项选择题

类似问题

A Trello board shows several cards piling up in the 'Review' column. What is the likely cause?

Question at position 2 Manual code reviews by developers is an important part of software quality improvement.TrueFalse

A code review should address:

A code review should focus on:

AI-generated code must be reviewed just like human-written code.

What are some of the benefits of structured walk-throughs? Please note marks will be taken off for wrong answers.

Which of the following trees corresponds to a potential parse of the ambiguous sentence below, with correct syntactic categories? Some diagnostics are provided.

Which of the following sentences contain two non-finite verbs? Select all that apply.

更多留学生实用工具

智能学习助手

风格化写作助手

论文查重助手

文献引用助手

课堂转译助手

课堂笔记助手

Quiz搜索助手

学校历年真题

智能刷题助手

智能匹配练习

希望你的学习变得更简单