Apply AI-assisted Security Workflows CERTIFIED-GITLAB-DUO-AI-ASSOCIATE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company is adopting GitLab Duo AI for security scanning. The security team wants to ensure that the AI scan results are visible to all developers and that findings can be tracked and resolved. What is the best way to achieve this?

   • AConfigure the AI security scan to run in the CI/CD pipeline and report findings directly in the merge request.
   • BHave the AI security scan send results to a separate email distribution list that only the security team can access.
   • CStore the AI security scan results in a shared network drive and ask developers to check it manually.
   • DRun the AI security scan only on the main branch and post the results to a public dashboard.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   When reviewing an AI-generated security finding, what does the severity level primarily indicate?

   • AThe programming language used in the affected code
   • BThe time required to fix the vulnerability
   • CThe number of lines of code affected by the issue
   • DThe potential impact of the vulnerability if exploited
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A team is using GitLab Duo AI to scan their code for security vulnerabilities. They notice that the AI scan only runs when a developer manually triggers it from the command line. The team wants to ensure that the scan runs automatically on every code change. What should they do?

   • ACreate a cron job on the developer's local machine that runs the AI security scan every hour.
   • BSchedule the AI security scan to run once a week on the main branch only.
   • CAdd a CI/CD job to the .gitlab-ci.yml file that runs the AI security scan on every push to the repository.
   • DSet up a manual checklist in the merge request template that reminds developers to run the AI security scan.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   After an AI security scan identifies a SQL injection vulnerability, what is the recommended way to remediate the issue using AI assistance?

   • ARewrite the whole application from scratch
   • BDelete the entire file containing the vulnerability
   • CIgnore the finding because AI is not reliable
   • DApply the suggested fix provided by the AI tool
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A developer at a fintech company commits a change that includes a database query built by concatenating user input from a web form. Before pushing to the remote repository, they use GitLab Duo's AI-powered static analysis on the diff. The AI flags the change as a potential SQL injection vulnerability with a 'Critical' severity. The developer is unsure why the AI flagged it since the code passes all unit tests. What is the most likely reason the AI identified this as a critical vulnerability?

   • AThe AI flagged it because the database query is not wrapped in a transaction, which is a mandatory requirement for all fintech applications.
   • BThe AI flagged it because the code uses a deprecated database driver that is no longer supported by the vendor.
   • CThe AI flagged it because the unit tests do not cover the database layer, so the AI assumes the code is insecure by default.
   • DThe AI detected that the user input is not parameterized and is directly concatenated into the SQL query string, which is a classic injection pattern.
   Reveal Solution Discussion Select an answer first