A security analyst reviews the container scanning report for a production image. The report lists a vulnerability with severity 'Critical' in the `openssl` package, but the vulnerability is not present in the application's own code. The analyst needs to determine the appropriate remediation. Which action is most appropriate?

Ignore the vulnerability because it is not in the application code.

Add a suppression rule in the pipeline to hide the vulnerability from future reports.

Update the application's dependency lockfile to a newer version of `openssl`.

Rebuild the image using a newer base image that includes a patched version of `openssl`.

In a GitLab vulnerability report, what does the 'severity' field indicate?

The likelihood that the vulnerability will be exploited

The number of times the vulnerability has been reported

The criticality of the vulnerability based on its potential impact

The time required to fix the vulnerability

In a GitLab CI/CD pipeline, when does container scanning typically occur?

Only when a security incident is reported

At the end of the pipeline, after all tests have passed

After the container image is deployed to production

During the build stage, after the image is built and before it is pushed to a registry

Which of the following is a valid way to enable container scanning in a GitLab CI/CD pipeline?

Add a `scan` stage to the pipeline and define a `container_scan` job manually

Include the `container_scanning` template in the `.gitlab-ci.yml` file

Set the `SCAN_CONTAINER` environment variable to `true`

Install the GitLab Scanner CLI on the runner

When assessing the impact of a vulnerability found in a container image, which factor is most important to consider?

The size of the container image

The severity of the vulnerability and the exposure of the component

The number of vulnerabilities found in the image

GitLabCertified Security Associate

Domain 3Objective 2

Assess Container Image Vulnerabilities GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 1)

Part of the Container Scanning domain, which makes up ~14% of our current practice bank.

20questions here

4free pages

5concepts

Questions 1–5

1application · medium
A security analyst reviews the container scanning report for a production image. The report lists a vulnerability with severity 'Critical' in the `openssl` package, but the vulnerability is not present in the application's own code. The analyst needs to determine the appropriate remediation. Which action is most appropriate?
Select an answer first
2foundation · easy
In a GitLab vulnerability report, what does the 'severity' field indicate?
Select an answer first
3foundation · easy
In a GitLab CI/CD pipeline, when does container scanning typically occur?
Select an answer first
4foundation · easy
Which of the following is a valid way to enable container scanning in a GitLab CI/CD pipeline?
Select an answer first
5foundation · easy
When assessing the impact of a vulnerability found in a container image, which factor is most important to consider?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GITLAB-CERTIFIED-SECURITY-SPECIALIST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitLab. “GITLAB-CERTIFIED-SECURITY-SPECIALIST” is a trademark of its owner, used for identification only.