1) All the static analyzers you used, as well as most (if not all) commercial analyzers, have options that suppress the messages. Discuss the advantages and disadvantages of turning off a warning or a class of warnings.

2) Gary McGraw said, "In the end, even the most extensive...static analysis regime is simply a badness-ometer." Explain what he means in your own words.

3) Static analysis systems exist not just for testing source code. Some can make use of object (binary) code or Java/C# byte code. When might they be useful? What is a drawback of them?

4) What are three advantages of static source code analysis systems?

5) What are three disadvantages of static source code analysis systems? (Note: Do not include “slow” or “expensive” among the list of disadvantages.)

6) What are three techniques that static source code analysis systems normally use to find bugs?

Solution PreviewSolution Preview

This material may consist of step-by-step explanations on how to solve a problem or examples of proper writing, including the use of citations, references, bibliographies, and formatting. This material is made available for the sole purpose of studying and learning - misuse is strictly forbidden.

Question 1

       The main advantage of using the guidance offered by the warning messages can be seen through the perspective of a less experienced tester. The warning message might offer additional information about the source/root cause of the warning (in the best case).
It is necessary to recall that static analyzers often give a large amount of false positive and false negative results. In many situations it can be useful to let active the warning messages because these can be corroborated with the erroneous results.
On the other hand, it is also possible the warning to require too much re-coding of the program or to refer a possibility that in practice does not occur too much. For these types of situations it can be useful to turn off the warning or a class of warnings.
Not last, the warnings might not be appropriate (or very relevant) for the actual context. If the warning message is kept active, then it can create confusion....
for this solution

or FREE if you
register a new account!

PayPal, G Pay, ApplePay, Amazon Pay, and all major credit cards accepted.

Find A Tutor

View available Information Security Tutors

Get College Homework Help.

Are you sure you don't want to upload any files?

Fast tutor response requires as much info as possible.

Upload a file
Continue without uploading

We couldn't find that subject.
Please select the best match from the list below.

We'll send you an email right away. If it's not in your inbox, check your spam folder.

  • 1
  • 2
  • 3
Live Chats