A team is new to GitLab and wants to understand how container scanning fits into their CI/CD workflow. They have a Dockerfile that builds an image and they want to scan it before pushing to the registry. What is the correct workflow?

Use the GitLab Container Registry's built-in scanning feature without any pipeline configuration.

Run container scanning on the Dockerfile before building the image.

Build the image, push it to the registry, then run a separate scanning job that pulls the image and scans it.

Build the image, run the container scanning job on the built image, then push the image if the scan passes.

Which of the following are sources of vulnerabilities that GitLab container scanning can detect?

Only the base image's OS packages

OS packages and application dependencies

Only the application source code

A security team is evaluating a container image for production. The scan report shows a 'High' severity vulnerability in a package that is used only in a non-default configuration. The team has a policy to remediate all High and Critical vulnerabilities, but the package is required for a feature that is not yet enabled. What is the most appropriate action?

Remediate the vulnerability by updating the package to a patched version.

Suppress the vulnerability and document the risk.

Deploy the image and enable the feature later, assuming the vulnerability is not exploitable.

Remove the package from the image and disable the feature.

A container scanning report shows a vulnerability with a 'Low' severity in a package that is used in the application. The team has a policy to fix all vulnerabilities, but the fix requires a major version upgrade that could break compatibility. What is the most appropriate action?

Upgrade the package immediately to fix the vulnerability.

Assess the risk and potentially defer the upgrade until a compatible version is available.

Remove the package from the application.

Suppress the vulnerability in the report.

A developer wants to scan a container image that includes a Python application. Which of the following components would GitLab container scanning check for vulnerabilities?

Python packages installed via pip

The container runtime configuration

GitLabCertified Security Associate

Domain 3Objective 2

Assess Container Image Vulnerabilities GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 2)

Part of the Container Scanning domain, which makes up ~14% of our current practice bank.

20questions here

4free pages

5concepts

Questions 6–10

6application · medium
A team is new to GitLab and wants to understand how container scanning fits into their CI/CD workflow. They have a Dockerfile that builds an image and they want to scan it before pushing to the registry. What is the correct workflow?
Select an answer first
7foundation · easy
Which of the following are sources of vulnerabilities that GitLab container scanning can detect?
Select an answer first
8expert · hard
A security team is evaluating a container image for production. The scan report shows a 'High' severity vulnerability in a package that is used only in a non-default configuration. The team has a policy to remediate all High and Critical vulnerabilities, but the package is required for a feature that is not yet enabled. What is the most appropriate action?
Select an answer first
9application · medium
A container scanning report shows a vulnerability with a 'Low' severity in a package that is used in the application. The team has a policy to fix all vulnerabilities, but the fix requires a major version upgrade that could break compatibility. What is the most appropriate action?
Select an answer first
10foundation · easy
A developer wants to scan a container image that includes a Python application. Which of the following components would GitLab container scanning check for vulnerabilities?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GITLAB-CERTIFIED-SECURITY-SPECIALIST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitLab. “GITLAB-CERTIFIED-SECURITY-SPECIALIST” is a trademark of its owner, used for identification only.