Interpret Security Scan Results GITLAB-CERTIFIED-GIT-ASSOCIATE Practice Questions (Page 5)

Questions 21–23

1. 21application · medium

   A security scan identifies a high-severity vulnerability in a web application: a path traversal in a file download feature. The recommended remediation is to validate file paths and restrict access to the intended directory. What is the most effective way to implement this remediation?

   • AAdd a check to ensure the file exists before downloading.
   • BDisable the file download feature until a fix is implemented.
   • CUse a blacklist of dangerous characters like '../'.
   • DUse a whitelist of allowed file names and reject any other input.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security scan report for a web application lists a vulnerability in a third-party JavaScript library used on the login page. The library is outdated and has a known remote code execution (RCE) vulnerability. The team has a release scheduled for next week. What should the team do?

   • ARemove the library from the login page and rewrite the functionality from scratch.
   • BKeep the library as is, because the vulnerability is only in the login page.
   • CUpdate the library to the latest patched version and include it in the next release.
   • DDelay the release until the library is updated and fully tested.
   Reveal Solution Discussion Select an answer first
3. 23application · medium

   A security scan of a web application reports a medium-severity vulnerability in a public-facing contact form that could allow spam submissions. The same scan reports a low-severity vulnerability in an internal reporting tool that could allow information disclosure. The team has limited time this week. Which vulnerability should be addressed first?

   • ABoth vulnerabilities at the same time, because all vulnerabilities must be fixed.
   • BThe reporting tool vulnerability, because it could lead to data leaks.
   • CNeither vulnerability, because they are both low or medium severity.
   • DThe contact form vulnerability, because it is public-facing and could be exploited by anyone.
   Reveal Solution Discussion Select an answer first