A security analyst has reviewed a SAST finding and determined it is a false positive. What is the correct action in GitLab to handle this finding?

Resolve the vulnerability to mark it as fixed.

Dismiss the vulnerability with a comment explaining why it is a false positive.

Delete the vulnerability from the project.

Confirm the vulnerability to acknowledge it as a real issue.

A security team has verified a vulnerability and confirmed it is a real issue. They want to ensure it is not accidentally dismissed in the future. What action should they take?

Create an issue for the vulnerability.

How does a user typically add a security scanning job to their GitLab CI/CD pipeline?

By installing a plugin in the GitLab web interface

By writing a custom script from scratch in the .gitlab-ci.yml file

By including the appropriate security scanning template in the .gitlab-ci.yml file

By enabling a feature flag in the project settings

A team is building a microservices application with multiple services. They want to scan each service for vulnerabilities but are concerned about the CI time and cost of running full scans on every service for every commit. What is the most efficient strategy?

Run SAST on all services in a single pipeline, but use `rules` to only run on merge requests and the main branch.

Run SAST only on the main branch.

Use a single SAST job that scans all services at once.

Run SAST on every commit for all services.

A development team wants to add static application security testing (SAST) to their existing CI/CD pipeline without writing custom scanning logic. The project uses a standard .gitlab-ci.yml file. What is the most efficient way to enable SAST?

Create a custom job that runs `gitlab-sast` as a shell command in the `before_script` section.

Install the SAST analyzer as a GitLab Runner executor on the CI infrastructure.

Navigate to the project's Security & Compliance settings and enable the SAST toggle.

Add `include: - template: Jobs/SAST.gitlab-ci.yml` to the .gitlab-ci.yml file.

GitLabCertified Fundamentals Associate

Domain 5Objective 1

Set up Basic Security Scanning GITLAB-CERTIFIED-GIT-ASSOCIATE Practice Questions (Page 1)

Part of the Security Scanning Basics domain, which makes up ~13% of our current practice bank.

27questions here

6free pages

5concepts

Questions 1–5

1application · easy
A security analyst has reviewed a SAST finding and determined it is a false positive. What is the correct action in GitLab to handle this finding?
Select an answer first
2application · easy
A security team has verified a vulnerability and confirmed it is a real issue. They want to ensure it is not accidentally dismissed in the future. What action should they take?
Select an answer first
3foundation · easy
How does a user typically add a security scanning job to their GitLab CI/CD pipeline?
Select an answer first
4expert · hard
A team is building a microservices application with multiple services. They want to scan each service for vulnerabilities but are concerned about the CI time and cost of running full scans on every service for every commit. What is the most efficient strategy?
Select an answer first
5application · medium
A development team wants to add static application security testing (SAST) to their existing CI/CD pipeline without writing custom scanning logic. The project uses a standard .gitlab-ci.yml file. What is the most efficient way to enable SAST?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GITLAB-CERTIFIED-GIT-ASSOCIATE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitLab. “GITLAB-CERTIFIED-GIT-ASSOCIATE” is a trademark of its owner, used for identification only.