Apply AI-assisted Security Workflows CERTIFIED-GITLAB-DUO-AI-ASSOCIATE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A developer wants to use GitLab Duo AI to automatically check new code for security issues before merging. Where should they look for the AI-generated security findings?

   • AIn the merge request widget
   • BIn the CI/CD pipeline logs only
   • CIn the GitLab Duo Chat history
   • DIn the project's README file
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A developer is reviewing a GitLab Duo AI security report for a Java application. The report flags a hardcoded password in the source code. The developer is surprised because the password is used for a test environment, not production. What is the best practice for handling this finding?

   • AMove the hardcoded password to a separate configuration file that is not scanned by the AI tool.
   • BIgnore the finding because the password is only for a test environment and does not pose a real security risk.
   • CEncrypt the hardcoded password in the source code so that it is not readable by the AI tool.
   • DRemove the hardcoded password and use environment variables or a secrets manager, even for test environments.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   During a code review, a developer notices a file containing an API key that is committed to the repository. Which type of security vulnerability does this represent?

   • AInsecure dependency
   • BCross-site scripting
   • CHardcoded secret
   • DInjection flaw
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A software team wants to adopt a 'security as code' approach and ensure that AI-assisted security scanning is part of their daily development workflow. They currently have a GitLab instance with multiple projects. The team lead wants to enforce a policy that no code can be merged without a successful AI security scan. What is the most effective way to implement this policy?

   • ASend a company-wide email asking all developers to remember to run the AI security scan before pushing their code.
   • BCreate a CI/CD template that includes the AI security scan job and apply it to all projects, then configure merge request approval rules to require the scan to pass.
   • CEnable AI security scanning only on the main branch after code is merged, and rely on the scan results to fix issues in the next release.
   • DHire a dedicated security team to manually review every merge request after it is merged into the main branch.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A developer receives a GitLab Duo AI security finding that flags a potential path traversal vulnerability in a file upload feature. The AI suggests validating the file name and path to prevent directory traversal. The developer is not sure if the finding is a false positive because the application runs in a sandboxed environment. What should the developer do?

   • AIgnore the finding because the sandboxed environment prevents any real-world exploitation.
   • BInvestigate the code path to confirm the vulnerability, and if it is real, apply the AI's suggested fix.
   • CClose the finding as a false positive because the AI tool is known to produce false positives for path traversal.
   • DAsk another developer to review the code and decide if the finding is valid, without checking the AI's remediation guidance.
   Reveal Solution Discussion Select an answer first