| 1: | Name several advantages to performing static white-box testing. |
| A1: | Static white-box testing finds bugs early in the development cycle, making them less time-consuming and less costly to fix. The software testers can gain information about how the software works, what potential weaknesses and risky areas exist, and can build a better working relationship with the programmers. Project status can be communicated to all team members who participate in the testing. |
| 2: | True or False: Static white-box testing can find missing items as well as problems. |
| A2: | True. Missing items are arguably more important than normal problems and can be found through static white-box testing. When the code is checked against published standards and guidelines and carefully analyzed in formal reviews, missing items become obvious. |
| 3: | What key element makes formal reviews work? |
| A3: | Process. Having a process that's followed is what makes the difference between a formal review and two pal programmers glancing over each other's code. |
| 4: | Besides being more formal, what's the big difference between inspections and other types of reviews? |
| A4: | The key difference is that with inspections, a person other than the original author of the code is the presenter. This obliges another person to fully understand the software being inspected. It's much more effective than having others simply review the software for bugs. |
| 5: | If a programmer was told that he could name his variables with only eight characters and the first character had to be capitalized, would that be a standard or a guideline? |
| A5: | That would be a standard. If he was told that a name of more than eight characters was preferred, that would be a guideline. |
| 6: | Should you adopt the code review checklist from this chapter as your team's standard to verify its code? |
| A6: | No! It's provided as a generic example only. There are some good test cases in it that you should consider when you test your code, but you should research and read about other published standards before adopting your own. |
| 7: | A common security issue known as a buffer overrun is in a class of errors known as what? They are caused by what? |
| A7: | Data Reference. They are caused by using variables, constants, arrays, strings, or records that aren't properly declared or initialized for the data that they can contain. |
