Interpret Security Scan Results GITLAB-CERTIFIED-GIT-ASSOCIATE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security scan of a web application reports a vulnerability in a third-party component that is used across multiple applications. The vulnerability is rated high severity and could allow an attacker to execute arbitrary code. The team is responsible for maintaining the component. What is the most appropriate action?

   • ARemove the component from all applications and rewrite the functionality.
   • BKeep the component as is, because it is used across multiple applications.
   • COnly update the component in the most critical application.
   • DUpdate the component to the latest patched version and test the applications that use it.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   When prioritizing security scan findings, which factor is most important to consider beyond the raw severity score?

   • AThe color of the scan report
   • BThe number of pages in the report
   • CThe exploitability of the vulnerability
   • DThe name of the scanning tool
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A security scan reports a Cross-Site Scripting (XSS) vulnerability in a web application. Which remediation step is most directly aimed at fixing this issue?

   • ASanitize user input and encode output
   • BChange the application's port number
   • CIncrease server memory
   • DDisable the web server logs
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security scan identifies a high-severity vulnerability in a web application: a security misconfiguration in the server that exposes sensitive headers. The recommended remediation is to remove or mask the sensitive headers. What is the most effective way to implement this remediation?

   • ADisable the server's header feature entirely.
   • BAdd a firewall rule to block requests that reveal the headers.
   • CIgnore the vulnerability because headers are not a significant risk.
   • DConfigure the server to remove or mask the sensitive headers in the response.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security scan of a web application reports a medium-severity vulnerability in a public-facing API that could allow an attacker to enumerate user accounts. The same scan also reports a low-severity vulnerability in an internal admin panel that could allow cross-site request forgery (CSRF). The company is about to launch a new feature that depends on the API. What is the best course of action?

   • ALaunch the feature and fix both vulnerabilities in the next sprint.
   • BFix the API vulnerability before the launch, as it poses a higher risk to user data.
   • CFix the CSRF vulnerability first, as it is in an admin panel and could lead to account takeover.
   • DFix both vulnerabilities before the launch, as both are security issues.
   Reveal Solution Discussion Select an answer first