A team wants to add SAST to their pipeline but is concerned about the SAST job failing the pipeline when it encounters an error. They want the pipeline to continue even if SAST fails, but they still want to see the SAST results in the Security tab. What should they do?

Set `when: manual` on the SAST job.

Set `allow_failure: true` on the SAST job.

Set `timeout: 30 minutes` on the SAST job.

Set `retry: 2` on the SAST job.

A team has configured dependency scanning in their pipeline. The job runs, but the pipeline fails because the dependency scanning job fails. What is the most likely cause?

The dependency scanning analyzer could not download the required database or dependencies.

The pipeline was triggered by a merge request.

The project does not have a `package.json` file.

The dependency scanning job is not allowed to fail.

After running SAST, the Security tab shows a vulnerability with a 'Critical' severity. The team lead wants to track this issue without blocking the current merge request. What is the appropriate action?

Ignore the vulnerability and proceed with the merge.

Create a GitLab issue from the vulnerability and dismiss the finding.

Add the vulnerability to the project's README for documentation.

Delete the vulnerability from the Security tab.

GitLabCertified Fundamentals Associate

Domain 5Objective 1

Set up Basic Security Scanning GITLAB-CERTIFIED-GIT-ASSOCIATE Practice Questions (Page 2)

Part of the Security Scanning Basics domain, which makes up ~13% of our current practice bank.

27questions here

6free pages

5concepts

Questions 6–10

6expert · hard
A team wants to add SAST to their pipeline but is concerned about the SAST job failing the pipeline when it encounters an error. They want the pipeline to continue even if SAST fails, but they still want to see the SAST results in the Security tab. What should they do?
Select an answer first
7application · medium
A team has configured dependency scanning in their pipeline. The job runs, but the pipeline fails because the dependency scanning job fails. What is the most likely cause?
Select an answer first
8foundation · easy
Which vulnerability management action in GitLab indicates that a finding has been verified as a real issue that needs to be addressed?
Select an answer first
9application · medium
After running SAST, the Security tab shows a vulnerability with a 'Critical' severity. The team lead wants to track this issue without blocking the current merge request. What is the appropriate action?
Select an answer first
10foundation · easy
A developer wants to identify known vulnerabilities in the open-source libraries used by their project. Which GitLab security scanning type should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GITLAB-CERTIFIED-GIT-ASSOCIATE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitLab. “GITLAB-CERTIFIED-GIT-ASSOCIATE” is a trademark of its owner, used for identification only.

Set up Basic Security Scanning GITLAB-CERTIFIED-GIT-ASSOCIATE Practice Questions (Page 2)

Questions 6–10

A team wants to add SAST to their pipeline but is concerned about the SAST job failing the pipeline when it encounters an error. They want the pipeline to continue even if SAST fails, but they still want to see the SAST results in the Security tab. What should they do?

A team has configured dependency scanning in their pipeline. The job runs, but the pipeline fails because the dependency scanning job fails. What is the most likely cause?

Which vulnerability management action in GitLab indicates that a finding has been verified as a real issue that needs to be addressed?

After running SAST, the Security tab shows a vulnerability with a 'Critical' severity. The team lead wants to track this issue without blocking the current merge request. What is the appropriate action?

A developer wants to identify known vulnerabilities in the open-source libraries used by their project. Which GitLab security scanning type should they use?

Keep studying — Security Scanning Basics