Which tools can you use to perform static code analysis?

• A. Githook
• B. Sonarcube
• C. Jenkins
• D. PMD

Answer: (B)

Static code analysis examines source code without executing it to surface issues like bugs, vulnerabilities, and maintainability problems. SonarQube is a comprehensive static analysis platform that automatically analyzes code, enforces a wide set of rules across languages, and presents results in a centralized dashboard. It supports many languages, integrates with CI/CD pipelines, and lets you define quality gates so code must meet standards before moving forward. This breadth of automatic checks, language support, and governance features makes it the best choice for performing static code analysis among the options.

Githook isn’t a static analysis tool; it’s a mechanism to run scripts in response to Git events. Jenkins is a CI server used to orchestrate builds and tasks, not the analysis engine itself. PMD is a static analyzer focused on specific languages, but it doesn’t provide the same wide language support, dashboards, and governance capabilities that SonarQube offers.