How can you enable dependency scanning in a GitLab project that does not use Auto DevOps?

Install the dependency scanning analyzer on the GitLab server

Create a new project from the 'Dependency Scanning' template

Enable the 'Dependency Scanning' toggle in the project's Security & Compliance settings

Add the `Dependency-Scanning` template job to the `.gitlab-ci.yml` file

What is the purpose of dismissing a vulnerability finding in the GitLab vulnerability report?

To notify the security team via email

To automatically fix the vulnerability in the next pipeline

To permanently delete the finding from the report

To mark the finding as not applicable or accepted risk

A team wants to enforce that no new critical or high vulnerabilities are introduced in merge requests. They have dependency scanning enabled. What should they configure to achieve this?

Set `DS_MAJOR_VERSION: "4"` in the CI/CD variables to ensure the latest analyzers are used.

Configure the project's 'Merge request approvals' to require approval from the security team for all merge requests.

Enable the 'Security Approvals' feature in the project settings and set the approval rule to require approval for critical and high vulnerabilities.

Add a manual job to the pipeline that checks the vulnerability report and fails if any finding exists.

A development team has a dependency scanning finding that is a known false positive. They want to prevent it from blocking future merge requests, but they still want to see it in the vulnerability report for historical context. What should they do?

Dismiss the vulnerability with a comment explaining why it is a false positive.

Add the dependency to the `.gitlab-ci.yml` `DS_EXCLUDED_ANALYZERS` variable.

Change the severity of the vulnerability to 'Info' in the project settings.

Delete the vulnerability from the vulnerability report.

GitLabCertified Security Associate

Domain 2Objective 2

Configure Dependency Scanning GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 3)

Part of the Secret and Dependency Scanning domain, which makes up ~21% of our current practice bank.

19questions here

4free pages

6concepts

Questions 11–15

11foundation · easy
How can you enable dependency scanning in a GitLab project that does not use Auto DevOps?
Select an answer first
12foundation · easy
What is the purpose of dismissing a vulnerability finding in the GitLab vulnerability report?
Select an answer first
13application · medium
A team wants to enforce that no new critical or high vulnerabilities are introduced in merge requests. They have dependency scanning enabled. What should they configure to achieve this?
Select an answer first
14application · medium
A development team has a dependency scanning finding that is a known false positive. They want to prevent it from blocking future merge requests, but they still want to see it in the vulnerability report for historical context. What should they do?
Select an answer first
15foundation · easy
Which of the following is a supported language or package manager for GitLab dependency scanning?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GITLAB-CERTIFIED-SECURITY-SPECIALIST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitLab. “GITLAB-CERTIFIED-SECURITY-SPECIALIST” is a trademark of its owner, used for identification only.