Identifying Dead Code in Software Development

SY0-601 By islever Editorial Last updated

Short answer

B Unused features deactivated but present in the codebase constitute dead code.

Question

A software company has a shared codebase for multiple projects using the following strategy: • Unused features are deactivated but still present on the code. • New customer requirements trigger additional development work. Which of the following will most likely occur when the company uses this strategy?
  1. Malicious code
  2. Dead code Correct Answer
  3. Outsourced code
  4. Code obfuscation

Key Takeaways

The question tests the definition of 'dead code' versus other code types; the trap is confusing it with obfuscation or malicious intent.

This page explains that deactivated but present features constitute dead code, a common software security risk. It clarifies why this strategy leads to maintenance issues and potential vulnerabilities.

Common mistake: Learners often confuse 'dead code' with 'code obfuscation', thinking that hiding features makes them secure rather than just unused.

Expert Analysis

Why the Answer Is Correct

Dead code refers to source code that is included in the program but never executed during runtime. In the scenario described, unused features are deactivated but remain in the codebase, fitting the exact definition of dead code. This practice increases the attack surface without providing functionality.

Why the Other Options Are Wrong

Malicious code implies intentional harm, which isn't suggested by simple deactivation. Outsourced code refers to external development, not internal status. Code obfuscation involves making code hard to read, not merely leaving unused features present.

Community Comment Notes

Community consensus strongly supports B, noting that dead code is present but unreachable. As one user noted, "Dead code refers to portions of a program's source code that are never executed." Another added, "code that is present in the codebase but is no longer executed or reachable."

Exam Strategy

When analyzing software security questions, always distinguish between code that is intentionally hidden (obfuscation) and code that is simply unused (dead). Remember that unused code still consumes resources and may contain vulnerabilities.

Frequently Asked Questions

What is the difference between dead code and obfuscated code?

Dead code is unused and unexecuted, while obfuscated code is intentionally made difficult to understand for security.

Why is dead code a security concern?

It increases the attack surface and may contain undiscovered vulnerabilities that attackers can exploit.

More SY0-601 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. psowrong 👍 9 Answered B
    Dead code refers to portions of a program's source code that are never executed during the program's runtime. In this strategy, features that are deactivated but still present in the code are effectively dead code. They are not actively used or executed, yet they remain in the codebase.
  2. pinkdog 👍 5 Answered B
    dead code- code that is present in the codebase but is no longer executed or reachable. Malicious code- refers to code designed to harm or exploit outsourced code- involves code developed by external parties code obfuscation- is the process of making code more difficult to understand
  3. Hs1208 👍 1 Answered B
    Dead code refers to code that is present in the source code but is not executed during the normal operation of the software

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

MFA and Patch Management Control Type and Category

S-grade

Threat Hunting Data Sources for Exploitable Systems

S-grade

Full Weekly and Differential Daily Backup Strategy

S-grade

Access Auditing as the SaaS Vendor Risk to Focus On

S-grade

← Back to SY0-601 Study Guide