Automated code analysis tools

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. What does an automated code analysis tool do?

A Scans source code or dependencies for known insecure patterns and vulnerable components

B Rewrites the whole program so it can never be attacked

2. Which statement about automated analysis and human code review is correct?

A Automated tools replace the need for human review

B Automated tools support human review but do not replace it

3. Static analysis examines code in which way?

A It checks the source code without running the program

B It only checks the program while users are running it

4. Which problem is a static analysis tool likely to flag?

A A hard-coded password in the source code

B A user who chooses to share their login with a friend

5. What does dependency scanning check?

A Whether the variable names in your own code are easy to read

B Whether third-party libraries used by the project have known vulnerabilities

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Static analysis scan		AScan + peer review
2Dependency scan		BFalse positive
3A tool flags a line of code as a risk, but a developer checks and finds it is actually safe		CTreating a clean scan as proof the code is secure. Tools only detect known patterns and miss logic flaws, so human review is still needed.
4Automated tools support human code review but do not replace it, because they only find known patterns		DIgnoring a warning without investigating it. Each result should be checked by a person to decide whether it is a real vulnerability or a false positive.
5Scan passed with no warnings, so skip code review		EChecks source code without running it, looking for known insecure patterns such as unsanitised input
6Warning found: delete it, it must be a false positive		FCompares the libraries a project uses against lists of known vulnerable versions

Definitions

automated code analysis

Fill in the Blanks

Complete each line of code by filling in the missing parts.

report ← ______Analysis("src/")

results ← __________Scan("package.json")

IF finding.confirmed = _____ THEN markAsFalsePositive(finding) END IF

releaseOk ← scanOk ___ reviewOk

npm _____ --production

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A patterns = ["eval(", "exec("]

B for line in source_lines

C for p in patterns:

D if p in line:

E report(line)

Question 2

A bad = {"libx": "1.0"}

B for name, ver in deps:

C if bad.get(name) == ver:

D print("Update", name)

Question 3

A for f in findings:

B real = human_check(f)

C if real:

D ignore(f)

E else:

F mark_false_positive(f)

Question 4

A report = static_scan(app.py)

B for issue in report:

C print(issue.line)

Question 5

A define scan(code, rules):

B found = []

C for r in rules:

D if r in code:

E found.append(r)

F return found

Answer Key

Automated code analysis tools

Section A: Quick Questions

A — Scans source code or dependencies for known insecure patterns and vulnerable components

B — Automated tools support human review but do not replace it

A — It checks the source code without running the program

A — A hard-coded password in the source code

B — Whether third-party libraries used by the project have known vulnerabilities

Section B: Match the Pairs

Static analysis scan → Checks source code without running it, looking for known insecure patterns such as unsanitised input

Dependency scan → Compares the libraries a project uses against lists of known vulnerable versions

A tool flags a line of code as a risk, but a developer checks and finds it is actually safe → False positive

Automated tools support human code review but do not replace it, because they only find known patterns → Scan + peer review

Scan passed with no warnings, so skip code review → Treating a clean scan as proof the code is secure. Tools only detect known patterns and miss logic flaws, so human review is still needed.

Warning found: delete it, it must be a false positive → Ignoring a warning without investigating it. Each result should be checked by a person to decide whether it is a real vulnerability or a false positive.

Section C: Definitions

automated code analysis — Tools that scan source code or dependencies for known insecure patterns and vulnerable components. They support, but do not replace, human code review.

Section D: Fill in the Blanks

report ← staticAnalysis("src/")

results ← dependencyScan("package.json")

IF finding.confirmed = FALSE THEN
    markAsFalsePositive(finding)
END IF

releaseOk ← scanOk AND reviewOk

npm audit --production

Section E: Spot the Error

B — A Python for loop header must end with a colon. The static analysis loop should be: for line in source_lines:

B — Looping over a dictionary gives only the keys, so name, ver cannot be unpacked. The dependency scan needs deps.items() to get each name and version pair.

D — If a person confirms the finding is real, it must be fixed, not ignored. Only false positives should be dismissed. The line should be fix(f).

A — The file name is a string, so it needs quotes. Without them Python looks for a variable called app and fails. It should be static_scan("app.py").

A — Python functions are declared with the keyword def, not define. The line should be def scan(code, rules):