Practise vocabulary for static analysis tools: AST traversal, visitor patterns, auto-fix, rules, plugins, and eslint/semgrep vocabulary.
0 / 18 completed
1 / 18
Static analysis examines source code ___ without executing it, to find bugs, style violations, security issues, or anti-patterns.
Static analysis (linting, type checking, code scanning) analyses code without running it — detecting issues at development time before deployment. Examples: ESLint (JavaScript), mypy (Python), Semgrep (multi-language security patterns).
2 / 18
A ___ pattern in AST-based linting visits each node type in the syntax tree, running the rule's check when a matching node is encountered.
The Visitor pattern is the foundation of AST-based linting: each rule registers visitors for specific node types ('CallExpression', 'ImportDeclaration'). As the traversal encounters each node, it calls the relevant visitor functions.
3 / 18
An ESLint ___ is an object containing metadata and visitor functions that detects a specific code pattern and optionally fixes it.
An ESLint rule is the atomic unit of analysis: it declares its severity, provides visitor functions for specific AST nodes, and optionally provides a 'fix' function that modifies the AST to auto-correct the violation.
4 / 18
Auto-fix in a linter ___ the code to comply with the rule, without requiring manual edits — triggered by --fix flag or IDE quick action.
Auto-fix generates AST or text transformations to correct violations: adding missing semicolons, reformatting imports, replacing deprecated APIs. The linter applies the transformation to the source file, saving manual correction work.
5 / 18
Semgrep uses ___ patterns that match code structures across multiple languages without needing language-specific AST visitors.
Semgrep's declarative patterns (e.g., `os.system(...)`) match structural code patterns across languages using a unified syntax. No need to write AST visitor code — the pattern language handles most common cases, making security rule authoring accessible to non-compiler-engineers.
6 / 18
During a code review of a new microservice written in Python, Sarah notices that the developer, Mark, is using a complex list comprehension to filter data. Another reviewer, David, comments on Slack: 'Hey Mark, this list comprehension is getting quite long and hard to read. Have you considered using a dedicated function with more descriptive variable names for better maintainability? Perhaps we could run a static analysis tool like Pylint to identify potential issues?'
Which of the following best describes David's intention in his Slack message, *specifically* regarding the use of static analysis?
The key here is understanding that static analysis doesn't *execute* the code. David's comment accurately reflects this – he's asking Pylint (a static analyzer) to examine the code for problems like complex logic and suggest improvements without running the program. The other options misinterpret static analysis as automatic refactoring or runtime monitoring, which are distinct processes. Pylint's role is purely analytical; it identifies potential issues based on defined rules.
7 / 18
def calculate_total(items):
total = 0
for item in items:
if item['quantity'] > 0:
total += item['price'] * item['quantity']
return total
During a code review of this Python function, Liam points out to Maya that the linter, SonarQube, has flagged it for potential 'Magic Numbers' – literal numerical values directly within the calculation. He suggests they investigate using named constants or variables to improve readability and maintainability. Which of the following statements *best* explains Liam's reasoning regarding SonarQube and static analysis in this context?
The correct answer highlights the core purpose of static analysis tools like SonarQube. While syntax errors are a common output, these tools go beyond that to identify *semantic* issues – in this case, 'Magic Numbers' which can reduce readability and increase the risk of introducing bugs later. The other options misrepresent SonarQube's capabilities or introduce irrelevant concerns (security vulnerabilities or personal preferences).
8 / 18
During a code review of a new microservice written in Python, Sarah notices that the developer, Mark, is using a complex list comprehension to filter data. Another reviewer, David, comments on Slack: 'Hey Mark, this list comprehension is getting quite long and hard to read. Have you considered using a dedicated function with more descriptive variable names for better maintainability? Perhaps we could run a static analysis tool like Pylint to identify potential issues?'
Which of the following best describes David's intention in his Slack message, *specifically* regarding the use of static analysis?
The key here is understanding that static analysis doesn't *execute* the code. David's comment accurately reflects this – he's asking Pylint (a static analyzer) to examine the code for problems like complex logic and suggest improvements without running the program. The other options misinterpret static analysis as automatic refactoring or runtime monitoring, which are distinct processes. Pylint's role is purely analytical; it identifies potential issues based on defined rules.
9 / 18
def calculate_total(items):
total = 0
for item in items:
if item['quantity'] > 0:
total += item['price'] * item['quantity']
return total
During a code review of this Python function, Liam points out to Maya that the linter, SonarQube, has flagged it for potential 'Magic Numbers' – literal numerical values directly within the calculation. He suggests they investigate using named constants or variables to improve readability and maintainability. Which of the following statements *best* explains Liam's reasoning regarding SonarQube and static analysis in this context?
The correct answer highlights the core purpose of static analysis tools like SonarQube. While syntax errors are a common output, these tools go beyond that to identify *semantic* issues – in this case, 'Magic Numbers' which can reduce readability and increase the risk of introducing bugs later. The other options misrepresent SonarQube's capabilities or introduce irrelevant concerns (security vulnerabilities or personal preferences).
10 / 18
During a code review of a new microservice written in Python, Sarah notices that the developer, Mark, is using a complex list comprehension to filter data. Another reviewer, David, comments on Slack: 'Hey Mark, this list comprehension is getting quite long and hard to read. Have you considered using a dedicated function with more descriptive variable names for better maintainability? Perhaps we could run a static analysis tool like Pylint to identify potential issues?'
Which of the following best describes David's intention in his Slack message, *specifically* regarding the use of static analysis?
The key here is understanding that static analysis doesn't *execute* the code. David's comment accurately reflects this – he's asking Pylint (a static analyzer) to examine the code for problems like complex logic and suggest improvements without running the program. The other options misinterpret static analysis as automatic refactoring or runtime monitoring, which are distinct processes. Pylint's role is purely analytical; it identifies potential issues based on defined rules.
11 / 18
def calculate_total(items):
total = 0
for item in items:
if item['quantity'] > 0:
total += item['price'] * item['quantity']
return total
During a code review of this Python function, Liam points out to Maya that the linter, SonarQube, has flagged it for potential 'Magic Numbers' – literal numerical values directly within the calculation. He suggests they investigate using named constants or variables to improve readability and maintainability. Which of the following statements *best* explains Liam's reasoning regarding SonarQube and static analysis in this context?
The correct answer highlights the core purpose of static analysis tools like SonarQube. While syntax errors are a common output, these tools go beyond that to identify *semantic* issues – in this case, 'Magic Numbers' which can reduce readability and increase the risk of introducing bugs later. The other options misrepresent SonarQube's capabilities or introduce irrelevant concerns (security vulnerabilities or personal preferences).
12 / 18
During a code review of a new microservice written in Python, Sarah notices that the developer, Mark, is using a complex list comprehension to filter data. Another reviewer, David, comments on Slack: 'Hey Mark, this list comprehension is getting quite long and hard to read. Have you considered using a dedicated function with more descriptive variable names for better maintainability? Perhaps we could run a static analysis tool like Pylint to identify potential issues?'
Which of the following best describes David's intention in his Slack message, *specifically* regarding the use of static analysis?
The key here is understanding that static analysis doesn't *execute* the code. David's comment accurately reflects this – he's asking Pylint (a static analyzer) to examine the code for problems like complex logic and suggest improvements without running the program. The other options misinterpret static analysis as automatic refactoring or runtime monitoring, which are distinct processes. Pylint's role is purely analytical; it identifies potential issues based on defined rules.
13 / 18
def calculate_total(items):
total = 0
for item in items:
if item['quantity'] > 0:
total += item['price'] * item['quantity']
return total
During a code review of this Python function, Liam points out to Maya that the linter, SonarQube, has flagged it for potential 'Magic Numbers' – literal numerical values directly within the calculation. He suggests they investigate using named constants or variables to improve readability and maintainability. Which of the following statements *best* explains Liam's reasoning regarding SonarQube and static analysis in this context?
The correct answer highlights the core purpose of static analysis tools like SonarQube. While syntax errors are a common output, these tools go beyond that to identify *semantic* issues – in this case, 'Magic Numbers' which can reduce readability and increase the risk of introducing bugs later. The other options misrepresent SonarQube's capabilities or introduce irrelevant concerns (security vulnerabilities or personal preferences).
14 / 18
During a standup meeting, the team lead asks Mark about his progress on fixing a linter warning related to unused variables. Mark replies: 'I'm using ESLint with the --fix flag to automatically resolve these.' What does the --fix flag primarily accomplish?
The --fix flag in linters like ESLint is designed to automate the process of correcting detected issues. It doesn't simply report warnings; it actively attempts to resolve them by modifying the code according to the configured rules. This is a common workflow for quickly addressing style and simple logic errors without manual intervention. The other options represent incorrect understandings of how this flag functions.
15 / 18
The API response from the static analysis tool shows the following error: 'Duplicate rule ID: eslint-no-unused-vars detected in project X.' What does this message most likely indicate?
Duplicate rule IDs in a static analysis tool's output generally mean that the same linter rule (identified by its unique ID) is being applied to the codebase more than once. This can lead to redundant warnings and unnecessary code modifications. The tool isn't malfunctioning; it's simply highlighting a configuration issue – often stemming from duplicated or incorrectly configured rules in the project settings. It's crucial to review and consolidate these configurations.
16 / 18
David is reviewing a PR that utilizes Semgrep for finding potential security vulnerabilities. The PR description includes the following snippet: 'Semgrep rules will automatically scan this code for common injection patterns and buffer overflows.' What does 'injection patterns' refer to in this context?
In security analysis, 'injection patterns' refers to techniques where an attacker can insert malicious code or data into a system's input fields – like SQL queries or command-line arguments – to compromise its integrity. Semgrep uses these patterns to detect and flag potentially vulnerable code. The other options represent misunderstandings of Semgrep's functionality as a security analysis tool.
17 / 18
During a Slack conversation about improving code quality, Sarah asks Mark: 'How can we use static analysis to prevent introducing bugs?' Mark responds with: 'We should configure our linter to enforce stricter formatting rules and automatically catch syntax errors.' Which of the following is the MOST accurate statement regarding this approach?
While static analysis tools like linters *can* significantly reduce the likelihood of introducing bugs by enforcing coding standards and catching syntax errors, they don't guarantee bug-free code. Bugs often stem from logic errors or complex interactions that aren't caught by simple rule enforcement. Enforcing stricter rules is a valuable preventative measure but should be part of a broader approach to software development.
18 / 18
A developer reports a warning from a code analysis tool regarding a potential race condition in a multithreaded application. The tool's output suggests using a static analysis approach to identify these issues. What is the primary benefit of this approach compared to solely relying on runtime testing?
The key benefit of using static analysis to detect race conditions (and other concurrency bugs) is that it can identify them *before* the application is executed. Runtime testing – while important – relies on simulating these scenarios during execution, which might not cover all possible combinations or edge cases. Static analysis examines the code's structure and logic to pinpoint potential problems proactively.
What does the "Static Analysis and Linting Vocabulary" exercise cover?
Practise vocabulary for static analysis tools: AST traversal, visitor patterns, auto-fix, rules, plugins, and eslint/semgrep vocabulary.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
How many questions are in "Static Analysis and Linting Vocabulary"?
This exercise has 18 questions. Each one gives instant feedback with an explanation, so you can see exactly why an answer is right or wrong.
Do I need to create an account to save my progress?
No account is required. The progress bar and score are tracked in your browser for the current session -- the exercise is designed to be a quick, repeatable drill rather than something you resume later.
What happens if I get an answer wrong?
You'll see the correct answer highlighted immediately, along with a short explanation of why it's correct. Wrong answers aren't penalized beyond your score, and you can keep going through every question.
How is this exercise different from reading an article?
Articles explain vocabulary and concepts through prose, while exercises like this one are interactive drills -- multiple-choice questions -- that test and reinforce your recall of specific terms and phrasing.
Can I retry this exercise?
Yes -- use the "Try again" button on the results screen to reset your score and go through all the questions again from the start.
Where can I find more Developer Tools Engineering exercises?
Browse the full Developer Tools Engineering hub for related drills, or check the site-wide exercises index for other IT English topics.
Is this exercise suitable for beginners?
This exercise assumes basic familiarity with IT terminology. If a term feels unfamiliar, check the site Glossary for a plain-English definition before attempting the questions.
How often is new content like this published?
New exercises are added regularly across all categories, alongside new vocabulary sets and articles. Check back on the exercises hub to see what's new.