CAS-004 Practice Question: Drag and drop the steps to perform a secure code…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Step 1: Understand the codebase, Step 2: Run automated scanning tools, Step 3: Perform manual code review, Step 4: Document and communicate findings

  Why this is correct

  This is the correct order because you must first understand the code to know what to look for, then use automated tools to catch common issues, followed by manual review for logic flaws, and finally document and communicate the findings.

• ✗

  Step 1: Run automated scanning tools, Step 2: Understand the codebase, Step 3: Perform manual code review, Step 4: Document and communicate findings

  Why it's wrong here

  This is incorrect because running automated scans without understanding the code may lead to irrelevant findings and missing context; understanding the code should come first.

• ✗

  Step 1: Understand the codebase, Step 2: Perform manual code review, Step 3: Run automated scanning tools, Step 4: Document and communicate findings

  Why it's wrong here

  This is incorrect because manual review should be done after automated scans to focus on issues the tools cannot catch; doing manual review first wastes effort on easily detectable issues.

• ✗

  Step 1: Understand the codebase, Step 2: Run automated scanning tools, Step 3: Document and communicate findings, Step 4: Perform manual code review

  Why it's wrong here

  This is incorrect because documentation should be the final step after both automated and manual reviews are complete; documenting before manual review would miss findings.

Go deeper

Related to this question