Apply AI-assisted Security Workflows CERTIFIED-GITLAB-DUO-AI-ASSOCIATE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security analyst is reviewing a GitLab Duo AI security report that contains multiple findings. The report includes a 'Critical' severity finding for a remote code execution (RCE) vulnerability in a library, a 'High' severity finding for a SQL injection in a custom query, and a 'Medium' severity finding for a hardcoded API key. The team has limited resources and can only address one finding in the current sprint. Which finding should the team address first?

   • AThe RCE vulnerability in the library, because it has the highest severity and could allow an attacker to execute arbitrary code on the server.
   • BThe SQL injection in the custom query, because it is in the application's own code and can be fixed quickly.
   • CThe hardcoded API key, because it is a simple fix that can be done quickly and will reduce the number of findings.
   • DAll three findings simultaneously, because they are all security issues and should be addressed together.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A developer is using GitLab Duo AI to remediate a security finding in their code. The AI suggests a fix that involves changing the authentication logic to use a more secure hashing algorithm. The developer applies the suggested fix, but the application's existing user accounts no longer work because the passwords were hashed with the old algorithm. What should the developer do?

   • AApply the AI fix and ignore the broken user accounts because security is more important than user experience.
   • BRevert the AI fix and keep the old hashing algorithm because it is not worth breaking existing user accounts.
   • CImplement a migration strategy that rehashes existing passwords using the new algorithm when users log in, and apply the AI fix.
   • DAsk all users to reset their passwords immediately after deploying the AI fix.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A developer receives an AI-generated suggestion to replace a hardcoded API key with a reference to a secure environment variable. What should the developer do to remediate the issue?

   • ALeave the key as is because it is only for testing
   • BMove the key to a comment in the code
   • CImplement the suggested change and remove the hardcoded key
   • DEncrypt the key and keep it in the same file
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Where in the development workflow should AI-assisted security checks be incorporated to ensure continuous security monitoring?

   • AIn the CI/CD pipeline
   • BOnly in the production environment
   • COnly during annual security audits
   • DOnly when a security incident occurs
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A DevOps engineer wants to ensure that every merge request (MR) in their GitLab project automatically runs AI-assisted security scanning before code is merged. The team currently uses a standard CI/CD pipeline that runs unit tests and builds the application. What is the most efficient way to integrate AI-assisted security scanning into this workflow?

   • ACreate a separate GitLab project that runs the AI security scanner and have developers copy the results into the MR description manually.
   • BAdd a new job to the existing .gitlab-ci.yml file that invokes the GitLab Duo AI security scanner and make it a required job in the merge request approval rules.
   • CEnable the AI security scanner only in the production environment after the code has been deployed.
   • DAsk developers to run the AI security scanner manually on their local machines before pushing code to the repository.
   Reveal Solution Discussion Select an answer first