A developer is reviewing a container scanning report and sees a vulnerability with a 'Confidence' rating of 'High'. What does this indicate?

The vulnerability is definitely exploitable in the image.

The vulnerability has a high severity score.

The scanner is highly confident that the vulnerability is present in the image.

The vulnerability is likely to be fixed in the next release.

What is the most appropriate remediation action for a high-severity vulnerability in an OS package that has a patched version available?

Wait for the next scheduled scan

Upgrade the package to the patched version

Ignore the vulnerability because it is in an OS package

A developer receives a container scanning report that lists a vulnerability with a 'Medium' severity in a package that is not used in the application's runtime path. The developer wants to understand the impact. What should the developer do?

Remove the package from the image.

Ignore the vulnerability because it is not in the runtime path.

Immediately update the package to the latest version.

Review the vulnerability details and determine if the package is actually used in any code path.

In a GitLab CI/CD pipeline, how do you specify which container image to scan?

By setting the `IMAGE` variable in the `.gitlab-ci.yml` file

By setting the `CS_IMAGE` variable to the image name

By using the `docker build` command with a `--scan` flag

By adding a `scan_image` job in the pipeline

What information is typically included in the vulnerability report for a specific vulnerability?

The names of all developers who contributed to the vulnerable code

The cost of fixing the vulnerability

The exact exploit code for the vulnerability

The affected component and remediation guidance

GitLabCertified Security Associate

Domain 3Objective 2

Assess Container Image Vulnerabilities GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 3)

Part of the Container Scanning domain, which makes up ~14% of our current practice bank.

20questions here

4free pages

5concepts

Questions 11–15

11application · medium
A developer is reviewing a container scanning report and sees a vulnerability with a 'Confidence' rating of 'High'. What does this indicate?
Select an answer first
12foundation · easy
What is the most appropriate remediation action for a high-severity vulnerability in an OS package that has a patched version available?
Select an answer first
13application · medium
A developer receives a container scanning report that lists a vulnerability with a 'Medium' severity in a package that is not used in the application's runtime path. The developer wants to understand the impact. What should the developer do?
Select an answer first
14foundation · easy
In a GitLab CI/CD pipeline, how do you specify which container image to scan?
Select an answer first
15foundation · easy
What information is typically included in the vulnerability report for a specific vulnerability?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GITLAB-CERTIFIED-SECURITY-SPECIALIST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitLab. “GITLAB-CERTIFIED-SECURITY-SPECIALIST” is a trademark of its owner, used for identification only.