問題文
A design team has to tell apart two ways of looking at human-readable code before a release, if the firm also has to say what becomes of the issues it finds. Which split does the secure development framework give, and where do the findings go?
選択肢
- A code review has tools look at the code to find issues on their own, while a code analysis has a person look at the code or the issues alongside the tools, and the framework defines which of the two is used, and the review or the analysis runs against the secure coding standards that the framework itself sets down, and the issues found together with the remediations put forward are recorded and triaged in a register or a ledger held apart from the development team, in that review-or-analysis choice.
- A code review has a person look directly at the code to find issues, while a code analysis has tools find them either on their own or alongside a person, and the firm defines which of the two is used, and the review or the analysis runs against the secure coding standards that the framework itself sets down, and the issues found together with the remediations put forward are recorded and triaged in a register or a ledger held apart from the development team, in that review-or-analysis choice.
- A code review has tools look at the code to find issues on their own, while a code analysis has a person look at the code or the issues alongside the tools, and the framework defines which of the two is used, and the review or the analysis runs against the secure coding standards of the firm, and the issues found together with the remediations put forward are recorded and triaged in the workflow or the issue tracking system of the development team, in that review-or-analysis choice.
- A code review has a person look directly at the code to find issues, while a code analysis has tools find them either on their own or alongside a person, and the firm defines which of the two is used, and the review or the analysis runs against the secure coding standards of the firm, and the issues found together with the remediations put forward are recorded and triaged in the workflow or the issue tracking system of the development team, in that review-or-analysis choice.