Interpret Security Scan Results GITLAB-CERTIFIED-GIT-ASSOCIATE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security scan of a web application reports a high-severity vulnerability in a public-facing file upload feature that could allow an attacker to upload malicious files. The same scan reports a medium-severity vulnerability in an internal logging system that could allow an attacker to view sensitive logs. The team has a release scheduled in one week. What is the best course of action?

   • ARelease as scheduled and fix both vulnerabilities in the next sprint.
   • BDelay the release until both vulnerabilities are fixed.
   • CFix the file upload vulnerability before the release, as it is high severity and public-facing.
   • DFix the logging system vulnerability first, as it could lead to data exposure.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security scan of a web application reports a critical-severity vulnerability in a public-facing API that could allow an attacker to access other users' data. The same scan reports a high-severity vulnerability in an internal database that could allow an attacker to modify data. The team has a release scheduled in one week. What is the best course of action?

   • ARelease as scheduled and fix both vulnerabilities in the next sprint.
   • BFix the API vulnerability before the release, as it is critical and public-facing.
   • CDelay the release until both vulnerabilities are fixed.
   • DFix the database vulnerability first, as it could lead to data corruption.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security scan identifies a medium-severity vulnerability in a web application: a server-side request forgery (SSRF) in a URL preview feature. The recommended remediation is to validate and restrict the URLs that can be fetched. What is the most effective way to implement this remediation?

   • AAdd a timeout to the URL fetch request.
   • BImplement an allowlist of permitted domains and block all other requests.
   • CDisable the URL preview feature entirely.
   • DUse a blacklist of known malicious domains.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security scan of a web application reports a low-severity vulnerability in a public-facing search feature that could allow information disclosure. The same scan reports a high-severity vulnerability in an internal admin panel that could allow privilege escalation. The company is about to launch a new marketing campaign that will drive significant traffic to the search feature. What is the best course of action?

   • AFix both vulnerabilities before the campaign launch.
   • BFix the low-severity search feature vulnerability first, as it will be exposed to more users.
   • CFix the high-severity admin panel vulnerability first, as it has a higher severity.
   • DLaunch the campaign and fix both vulnerabilities in the next sprint.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   A security scan report lists a vulnerability with a CVSS score of 9.8. According to common severity ratings, how should this finding be classified?

   • AHigh severity
   • BCritical severity
   • CMedium severity
   • DLow severity
   Reveal Solution Discussion Select an answer first