Interpret Security Scan Results GITLAB-CERTIFIED-GIT-ASSOCIATE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   When interpreting a security scan report, which piece of information is most directly used to identify the specific weakness that was detected?

   • AThe asset hostname
   • BThe scanner version
   • CThe vulnerability identifier (e.g., CVE ID)
   • DThe scan timestamp
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security scan of a web application reports a critical-severity vulnerability in a public-facing login page that could allow SQL injection. The same scan reports a high-severity vulnerability in an internal API that could allow unauthorized data access. The team has a release scheduled in two days. What is the best course of action?

   • AFix the SQL injection before the release, as it is critical and public-facing.
   • BDelay the release until both vulnerabilities are fixed.
   • CFix the internal API vulnerability first, as it could lead to data breach.
   • DRelease as scheduled and fix both vulnerabilities in the next sprint.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security scan of a web application reports a vulnerability in a dependency that is no longer maintained. The vulnerability is rated high severity and could allow remote code execution. The application is currently in production. What is the most appropriate action?

   • AKeep the dependency and apply a manual patch to the code.
   • BReplace the unmaintained dependency with a maintained alternative that provides similar functionality.
   • CRemove the dependency and rewrite the functionality from scratch.
   • DIgnore the vulnerability because the dependency is no longer maintained.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A security scan identifies a known vulnerability in a third-party library used by a project. What is the most common remediation step for this type of finding?

   • AUpgrade the library to a patched version
   • BIgnore the finding because it is from a third party
   • CChange the project's name
   • DDelete the entire project
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A developer receives a security scan report for a web application. The report lists a critical-severity SQL injection in a login endpoint, a high-severity cross-site scripting (XSS) issue in a search feature, and a medium-severity information disclosure in an error page. The team has limited capacity this sprint. Which finding should the team address first?

   • AAll findings equally, because all vulnerabilities must be fixed before release.
   • BThe XSS issue, because it affects a user-facing feature and is more likely to be exploited.
   • CThe SQL injection, because it is rated critical and could allow unauthorized data access.
   • DThe information disclosure, because it is the easiest to fix and can be done quickly.
   Reveal Solution Discussion Select an answer first