A security engineer is reviewing a GitLab Duo AI security report for a Node.js application. The report includes a finding about a potential command injection vulnerability in a function that executes system commands. The AI provides a remediation suggestion to use a safer API. The engineer wants to understand the severity and impact of this finding before deciding on a fix. What should the engineer do?

Examine the AI report's severity rating and the affected code path to understand the potential impact, then apply the suggested remediation.

Ask the developer who wrote the code to confirm if the vulnerability is real, and if they say it is not, close the finding.

Ignore the AI report and manually review the code to determine if the vulnerability is real, without considering the AI's analysis.

Immediately deploy the application to production because the AI tool is known to produce false positives for command injection.

An AI security tool flags a vulnerability in a code change. What type of information is typically included in the remediation guidance provided with the finding?

The name of the developer who introduced the bug

The exact date and time the vulnerability was introduced

Steps or code suggestions to fix the vulnerability

A list of all files in the repository

What is the primary benefit of integrating AI-assisted security scanning into the CI/CD pipeline?

It automatically fixes all security issues without developer input

It guarantees that no vulnerabilities will ever be introduced

It eliminates the need for manual code reviews

It enables continuous security monitoring of code changes

GitLabCertified Duo Agent Platform Associate

Domain 4Objective 3

Apply AI-assisted Security Workflows CERTIFIED-GITLAB-DUO-AI-ASSOCIATE Practice Questions (Page 4)

Part of the AI-Assisted Code Workflows domain, which makes up ~29% of our current practice bank.

19questions here

4free pages

5concepts

Questions 16–19

16foundation · easy
A developer reviews a code snippet that concatenates user input directly into a SQL query string. Which type of security vulnerability does this code most likely exhibit?
Select an answer first
17application · medium
A security engineer is reviewing a GitLab Duo AI security report for a Node.js application. The report includes a finding about a potential command injection vulnerability in a function that executes system commands. The AI provides a remediation suggestion to use a safer API. The engineer wants to understand the severity and impact of this finding before deciding on a fix. What should the engineer do?
Select an answer first
18foundation · easy
An AI security tool flags a vulnerability in a code change. What type of information is typically included in the remediation guidance provided with the finding?
Select an answer first
19foundation · easy
What is the primary benefit of integrating AI-assisted security scanning into the CI/CD pipeline?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CERTIFIED-GITLAB-DUO-AI-ASSOCIATE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitLab. “CERTIFIED-GITLAB-DUO-AI-ASSOCIATE” is a trademark of its owner, used for identification only.

Apply AI-assisted Security Workflows CERTIFIED-GITLAB-DUO-AI-ASSOCIATE Practice Questions (Page 4)

Questions 16–19

A developer reviews a code snippet that concatenates user input directly into a SQL query string. Which type of security vulnerability does this code most likely exhibit?

An AI security tool flags a vulnerability in a code change. What type of information is typically included in the remediation guidance provided with the finding?

What is the primary benefit of integrating AI-assisted security scanning into the CI/CD pipeline?

Keep studying — AI-Assisted Code Workflows