A team is developing a Python application and wants to scan for security vulnerabilities in the source code. They also want to scan the Python dependencies for known vulnerabilities. Which combination of scanning types should they configure?

Dependency Scanning and Container Scanning

A team has a merge request that is blocked by a 'Critical' vulnerability. The vulnerability is a false positive, but the team needs to merge the MR today. The team wants to maintain an audit trail of the decision. What is the best course of action?

Disable the security scanning job for this pipeline only.

Merge the MR using the 'Merge Unblocked' option.

Confirm the vulnerability and merge the MR anyway.

Dismiss the vulnerability with a detailed comment explaining why it is a false positive.

When are security scans typically triggered in a GitLab pipeline?

Only on a scheduled nightly basis

Only when manually triggered by a user

Only after a successful deployment to production

As part of the CI/CD pipeline, often on every push or merge request

A team has a pipeline that includes SAST and DAST. The SAST job runs successfully, but the DAST job fails because the application is not deployed. The team wants to ensure DAST only runs after the application is deployed. What is the best approach?

Add a `needs` keyword to the DAST job to depend on the deployment job.

Use the `allow_failure` option on the DAST job.

Run DAST in a separate pipeline.

Set the `DAST_WEBSITE` variable to the production URL.

GitLabCertified Fundamentals Associate

Domain 5Objective 1

Set up Basic Security Scanning GITLAB-CERTIFIED-GIT-ASSOCIATE Practice Questions (Page 5)

Part of the Security Scanning Basics domain, which makes up ~13% of our current practice bank.

27questions here

6free pages

5concepts

Questions 21–25

21expert · hard
A team is developing a Python application and wants to scan for security vulnerabilities in the source code. They also want to scan the Python dependencies for known vulnerabilities. Which combination of scanning types should they configure?
Select an answer first
22expert · hard
A team has a merge request that is blocked by a 'Critical' vulnerability. The vulnerability is a false positive, but the team needs to merge the MR today. The team wants to maintain an audit trail of the decision. What is the best course of action?
Select an answer first
23foundation · easy
When are security scans typically triggered in a GitLab pipeline?
Select an answer first
24expert · hard
A team has a pipeline that includes SAST and DAST. The SAST job runs successfully, but the DAST job fails because the application is not deployed. The team wants to ensure DAST only runs after the application is deployed. What is the best approach?
Select an answer first
25application · easy
A team wants to scan their container image for known vulnerabilities in the base OS packages and application dependencies. Which GitLab security scanning type should they configure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GITLAB-CERTIFIED-GIT-ASSOCIATE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitLab. “GITLAB-CERTIFIED-GIT-ASSOCIATE” is a trademark of its owner, used for identification only.