Assess Container Image Vulnerabilities GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A container scanning report for a Java application shows a vulnerability in the `log4j` library. The application uses Maven for dependency management. What is the most likely source of this vulnerability?

   • AThe application's `pom.xml` file
   • BThe Dockerfile's `RUN` commands
   • CThe base image's OS package repository
   • DThe GitLab Container Registry's metadata
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A GitLab container scanning report for a Node.js application shows a vulnerability in the `lodash` package. The application's `package.json` lists `lodash` as a direct dependency. What is the most likely source of this vulnerability?

   • AThe GitLab Container Registry's metadata
   • BThe base image's OS package repository
   • CThe application's dependency manifest
   • DThe Dockerfile's `RUN` commands
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of container image vulnerability scanning in GitLab?

   • ATo ensure the container image is free of any security issues
   • BTo identify known vulnerabilities in the container image's OS packages and application dependencies
   • CTo automatically fix all vulnerabilities in the container image
   • DTo monitor the container image at runtime for active attacks
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security engineer is reviewing a container scanning report for an image that will be deployed to a production environment. The report shows a 'Critical' vulnerability in a package that is only used during the build stage and is not present in the final image. The engineer needs to decide whether to block the deployment. What is the most appropriate action?

   • ABlock the deployment because the vulnerability is Critical.
   • BModify the build process to use a patched version of the package.
   • CAllow the deployment because the vulnerable package is not in the final image.
   • DSuppress the vulnerability in the report to avoid confusion.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard · select all that apply

   A container scanning report for a Ruby on Rails application shows vulnerabilities in both the `libssl` package and the `nokogiri` gem. The application is built using a Debian-based base image. Which of the following are valid sources for these vulnerabilities? Select all that apply.

   • AThe Debian base image's OS package repository
   • BThe Dockerfile's `RUN gem install` command
   • CThe GitLab Container Registry's vulnerability database
   • DThe application's Gemfile.lock
   Check answers Discussion Select an answer first